# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.166
country_id: 2635167
description:
Dec 13 18:12:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.166, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<k1jWt9RF7YZX7LCm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.136
country_id: 1819730
description:
Dec 13 18:13:09 host2 sshd[1722501]: Disconnected from invalid user mohammad 152.32.129.136 port 32820 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.156
country_id: 2635167
description:
Dec 13 18:13:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<bdTNudRFI+W594mc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 13 18:13:49 host2 sshd[1722932]: Disconnected from invalid user sysadmin 209.141.33.240 port 37838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.169
country_id: 2635167
description:
Dec 13 18:14:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.169, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<8zvJu9RFuY+594mp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 13 18:14:20 host2 sshd[1723208]: Disconnected from invalid user dev 209.141.33.240 port 36280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 18:14:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Ny4WvdRFSq2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 18:15:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Elo3wdRFVIbCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Dec 13 18:15:50 host2 sshd[1724033]: Disconnected from invalid user ali 45.78.203.22 port 37622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.185.164.76
country_id: 2077456
description:
2025-12-13 18:15:57 dovecot_login authenticator failed for (cpe-101-185-164-76.wb06.wa.asp.telstra.net) [101.185.164.76]:33080: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-13 18:16:08 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:56848: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 18:15:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<x1Pdv9RFA6VetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-13 18:17:08 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:33742: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-12-13 18:16:43 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:47023: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-13 18:17:06 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:56456: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-13 18:17:22 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:50424: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.22
country_id: 1880251
description:
Dec 13 18:21:30 host2 sshd[1727291]: Disconnected from invalid user alex 45.78.203.22 port 59188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-12-13 18:21:51 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:34356: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 18:22:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Bhle29RFwIgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-13 18:22:29 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:58269: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-13 18:22:30 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:51244: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-12-13 18:22:37 dovecot_login authenticator failed for (2-55-68-141.orange.net.il) [2.55.68.141]:42958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 34.27.42.6 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-13 18:22:50 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:33963: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-13 18:23:10 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:40607: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 18:23:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<t9JY3NRFXLYIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 18:24:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<ZKhh4NRFytCB4gum>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.175.206.22
country_id: 1643084
description:
Dec 13 18:25:40 host2 sshd[1729681]: Disconnected from invalid user maman 103.175.206.22 port 60080 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 18:25:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=43.162.120.170, lip=66.85.158.92, session=<pL/Y5dRFCKwroniq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 18:25:51 host2 pure-ftpd[1729790]: (?@43.162.120.170) [INFO] New connection from 43.162.120.170


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 18:26:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=43.162.120.170, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<qSXv5tRFJN8roniq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 18:26:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<NOu16dRFTuvAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 18:27:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<3iuB69RF8Ow+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 18:28:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<7ped8NRFbMi8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 18:29:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<b/te8tRFXKYImxNM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.175.206.22
country_id: 1643084
description:
Dec 13 18:29:25 host2 sshd[1732371]: Disconnected from invalid user sam 103.175.206.22 port 42522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 13 18:30:45 host2 sshd[1733193]: Disconnected from invalid user webadmin 45.78.220.142 port 45330 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-13 18:30:47 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:41030: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-13 18:30:56 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:36124: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Dec 13 18:31:48 host2 sshd[1733746]: Disconnected from invalid user userftp 161.132.50.86 port 36318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:31:53 host2 sshd[1733793]: Disconnected from invalid user test-user 216.133.148.51 port 49420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-13 18:31:56 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:58534: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 13 18:32:04 host2 sshd[1733843]: Disconnected from invalid user nasrin 45.78.220.142 port 35520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.231.50
country_id: 1269750
description:
2025-12-13 18:32:18 dovecot_login authenticator failed for ([182.95.85.109]) [125.19.231.50]:49562: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.175.206.22
country_id: 1643084
description:
Dec 13 18:32:09 host2 sshd[1734013]: Disconnected from invalid user pavel 103.175.206.22 port 41304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Dec 13 18:33:55 host2 sshd[1734927]: Disconnected from invalid user leon 161.132.50.86 port 60666 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 18:34:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<FTahBdVFkPIvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.247.91
country_id: 241170
description:
Dec 13 18:34:32 host2 sshd[1735244]: Disconnected from invalid user server 156.245.247.91 port 57226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.50.86
country_id: 3932488
description:
Dec 13 18:34:33 host2 sshd[1735277]: Disconnected from invalid user ubuntu 161.132.50.86 port 53824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-13 18:35:42 dovecot_plain authenticator failed for (adder) [41.248.243.181]:52534: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 18:36:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Bl08CtVF/OhAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 18:36:17 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (spoty) [51.195.117.220]:19267: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 13 18:36:24 host2 sshd[1736471]: Disconnected from invalid user test 35.216.63.127 port 40404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:36:58 host2 sshd[1736769]: Disconnected from invalid user ubuntu 216.133.148.51 port 54536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-13 18:36:12 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:42831: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 18:36:38 host2 sshd[1736579]: Disconnected from invalid user admin 2.57.121.112 port 20809 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 18:36:51 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:36752: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-13 18:37:01 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:39609: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 13 18:37:47 host2 sshd[1737217]: Disconnected from invalid user weiqing 35.216.63.127 port 63256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:37:32 host2 sshd[1737092]: Disconnected from invalid user nasrin 216.133.148.51 port 48136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 18:37:40 host2 sshd[1737161]: Disconnected from invalid user  62.60.131.157 port 32576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-12-13 18:38:54 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:36115: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:39:14 host2 sshd[1738087]: Received disconnect from 216.133.148.51 port 40060:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-13 18:39:32 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:41503: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:40:23 host2 sshd[1738796]: Disconnected from invalid user webadmin 216.133.148.51 port 52438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 18:40:43 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (eprous) [51.195.117.220]:56431: 535 Incorrect authentication data (set_id=hostmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-13 18:41:57 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:50031: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-13 18:42:41 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:41089: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 18:42:56 host2 sshd[1740016]: Disconnected from invalid user user 2.57.121.25 port 35201 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-13 18:43:04 dovecot_login authenticator failed for ([192.252.214.22]) [182.95.115.70]:39002: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-13 18:42:20 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:62825: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-13 18:42:28 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:38714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 13 18:42:32 host2 sshd[1739822]: Disconnected from invalid user devuser 35.216.63.127 port 62628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 18:42:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<XAh1IdVFWOMuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 18:43:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<sos7JNVFGNPO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-12-13 18:43:35 dovecot_login authenticator failed for (111-70-49-182.emome-ip.hinet.net) [196.191.142.67]:52930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.96.124.174
country_id: 290557
description:
2025-12-13 18:43:34 dovecot_plain authenticator failed for bba-92-96-124-174.alshamil.net.ae ([31.57.166.48]) [92.96.124.174]:53612: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.55.152.112
country_id: 3469034
description:
2025-12-13 18:43:48 dovecot_plain authenticator failed for ([31.57.166.48]) [189.55.152.112]:7406: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.121.40.176
country_id: 3469034
description:
2025-12-13 18:44:02 dovecot_plain authenticator failed for ([31.57.166.48]) [168.121.40.176]:26193: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 13 18:44:14 host2 sshd[1740822]: Disconnected from invalid user denis 45.78.220.142 port 52494 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.135.131
country_id: 6252001
description:
Dec 13 18:44:32 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.91, session=<Fq2fKNVFsqBHBoeD>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.135.131
country_id: 6252001
description:
Dec 13 18:44:32 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.91, session=<dVeeKNVFPqBHBoeD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 18:44:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<nr41KdVFUcB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 18:45:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<4a3HK9VFjroI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 13 18:46:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<beqFL9VF+IbBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-13 18:48:01 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:14148: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.63
country_id: 3996063
description:
2025-12-13 18:47:31 dovecot_login authenticator failed for (189.219.138.63-clientes-izzi.mx) [189.219.138.63]:60097: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-13 18:47:52 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:47242: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-13 18:48:56 dovecot_login authenticator failed for ([102.38.3.109]) [102.38.3.109]:54680: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-13 18:48:34 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:54124: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-13 18:49:20 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:38302: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 18:51:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<BtnTP9VFetqB4kCN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 13 18:50:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS: Connection closed, session=<rW9aPdVF6kdChJlz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 18:51:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<sQAnQdVFHsCl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 18:51:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<vHCxQNVFMLAro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.208.184.2
country_id: 149590
description:
Dec 13 18:51:23 host2 sshd[1745260]: Disconnected from invalid user test-user 102.208.184.2 port 47868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 18:52:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<z1ywRdVFMsSG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-12-13 18:52:46 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:57017: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.248.139
country_id: 1562822
description:
Dec 13 18:53:44 host2 pure-ftpd[1746542]: (?@165.154.248.139) [INFO] New connection from 165.154.248.139


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.227.26
country_id: 1668284
description:
Dec 13 18:53:44 host2 pure-ftpd[1746540]: (?@165.154.227.26) [INFO] New connection from 165.154.227.26


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-13 18:53:17 dovecot_login authenticator failed for ([94.207.251.240]) [94.207.251.240]:35355: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 18:53:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<xZY8SNVFLqeH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 18:56:45 host2 sshd[1748610]: Disconnected from invalid user dev 154.221.17.42 port 42402 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 18:57:24 host2 sshd[1748977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.123
country_id: 6252001
description:
2025-12-13 18:58:18 dovecot_login authenticator failed for wsip-184-191-250-123.fv.ks.cox.net [184.191.250.123]:46175: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-13 18:58:31 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:41306: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Dec 13 18:59:56 host2 sshd[1750806]: Disconnected from invalid user rooter 133.117.74.174 port 46152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 19:00:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<2Qn2X9VFdI9npBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 19:00:40 host2 sshd[1751361]: Disconnected from invalid user ubuntu 154.221.17.42 port 39522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 19:00:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<X1oXYdVFCNqkXF7M>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 19:01:21 host2 sshd[1751782]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.243.161
country_id: 1733045
description:
2025-12-13 19:01:19 dovecot_plain authenticator failed for ([31.57.166.48]) [180.75.243.161]:36687: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 19:01:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<QnQ7ZtVFtKQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-13 19:02:40 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:51680: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-13 19:02:44 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:34270: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-13 19:03:12 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:49835: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-13 19:03:11 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:42656: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 19:03:46 host2 sshd[1753388]: Disconnected from invalid user book 154.221.17.42 port 33330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 19:04:29 host2 sshd[1753930]: Disconnected from invalid user wiki 154.221.17.42 port 45756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 19:05:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<4rMrctVF8KuWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Dec 13 19:05:54 host2 sshd[1754803]: Disconnected from invalid user alex 200.89.178.151 port 62754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 19:05:57 host2 sshd[1754828]: Disconnected from invalid user yxu 154.221.17.42 port 42268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.210.105
country_id: 6252001
description:
Dec 13 19:06:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.104.210.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Sjk1dtVFQaOsaNJp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.202
country_id: 6252001
description:
Dec 13 19:06:18 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.202, lip=66.85.158.91, TLS, session=<ynSCdtVFxnWs7OTK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Dec 13 19:06:23 host2 sshd[1755101]: Disconnected from invalid user virtualbox 133.117.74.174 port 56312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-13 19:07:52 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:39270: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.171
country_id: 1733045
description:
2025-12-13 19:07:51 dovecot_login authenticator failed for ([49.124.152.171]) [49.124.152.171]:51946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-13 19:08:04 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:46084: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 13 19:08:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XAdOfdVFxC/UZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-13 19:08:14 dovecot_login authenticator failed for (nsg-corporate-126.60.187.122.airtel.in) [122.187.60.126]:38088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 19:08:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<iievf9VFnp68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-13 19:08:56 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:50716: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-13 19:09:09 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:34210: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.89.178.151
country_id: 3865483
description:
Dec 13 19:09:15 host2 sshd[1757109]: Disconnected from invalid user alex 200.89.178.151 port 14542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Dec 13 19:09:25 host2 sshd[1757252]: Disconnected from invalid user alex 133.117.74.174 port 42046 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 19:09:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<o3ZKgtVFLOWnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.246.109.89
country_id: 798544
description:
2025-12-13 19:10:14 dovecot_plain authenticator failed for host-91-246-109-89.hypernet.biz.pl ([31.57.166.48]) [91.246.109.89]:33502: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.211.218.152
country_id: 6252001
description:
2025-12-13 19:10:25 dovecot_plain authenticator failed for c-73-211-218-152.hsd1.il.comcast.net ([31.57.166.48]) [73.211.218.152]:47028: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.200.176
country_id: 3437598
description:
2025-12-13 19:10:38 dovecot_plain authenticator failed for ([31.57.166.48]) [186.158.200.176]:48297: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-13 19:14:23 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:35656: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.222
country_id: 6252001
description:
2025-12-13 19:14:22 dovecot_login authenticator failed for wsip-184-191-242-222.fv.ks.cox.net [184.191.242.222]:50129: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-13 19:15:13 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:55655: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-13 19:15:44 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:56388: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-13 19:16:03 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:37183: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 19:16:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<4qOWm9VFyoM+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 19:16:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<TPAinNVFDChetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.12.84.15
country_id: 1269750
description:
Dec 13 19:20:18 host2 sshd[1765999]: Disconnected from invalid user avinash 61.12.84.15 port 55290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-13 19:22:18 dovecot_plain authenticator failed for (amathafte) [5.26.190.79]:34378: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.26.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.26.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 13 19:23:16 host2 sshd[1767952]: Disconnected from invalid user appuser 129.80.134.10 port 58556 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 61.12.84.15
country_id: 1269750
description:
Dec 13 19:23:47 host2 sshd[1768283]: Disconnected from invalid user alina 61.12.84.15 port 54628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-13 19:24:49 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:60450: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.12.84.15
country_id: 1269750
description:
Dec 13 19:24:30 host2 sshd[1768684]: Disconnected from invalid user dev 61.12.84.15 port 44100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 19:25:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<X3nWu9VFCrrAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 19:25:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<N7TPutVF8sAv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.158.102
country_id: 3017382
description:
Dec 13 19:27:06 host2 sshd[1770651]: Disconnected from invalid user admin1 51.77.158.102 port 42064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 13 19:26:36 host2 sshd[1770375]: Disconnected from invalid user administrator 129.80.134.10 port 52944 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-13 19:26:56 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (supty) [73.195.211.98]:39692: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-13 19:27:46 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:49764: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 19:28:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<mcI4xNVFwKjCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-13 19:28:07 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:38046: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-13 19:27:22 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:62910: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.158.102
country_id: 3017382
description:
Dec 13 19:27:38 host2 sshd[1770932]: Disconnected from invalid user sftptest 51.77.158.102 port 53926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec 13 19:28:18 host2 sshd[1771304]: Disconnected from invalid user wikijs 103.31.39.143 port 44660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-12-13 19:28:26 dovecot_login authenticator failed for ([188.126.240.80]) [188.126.240.80]:34680: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-13 19:28:40 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:37759: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 13 19:28:46 host2 sshd[1771670]: Disconnected from invalid user nabi 129.80.134.10 port 58970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 19:29:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<sxTfx9VFJJgIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 13 19:30:54 host2 sshd[1772955]: Disconnected from invalid user git 129.80.134.10 port 52204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 19:30:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<gsgQzNVFYI68pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.158.102
country_id: 3017382
description:
Dec 13 19:30:23 host2 sshd[1772680]: Disconnected from invalid user parham 51.77.158.102 port 53024 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.31.39.143
country_id: 1643084
description:
Dec 13 19:30:35 host2 sshd[1772788]: Disconnected from invalid user appadmin 103.31.39.143 port 34944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 19:31:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<G/3Lz9VFiu0+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 19:32:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<u+lA09VFqsI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-13 19:32:43 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:34891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-13 19:32:53 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:38452: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-13 19:33:01 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:42783: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-13 19:33:17 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:60470: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 19:34:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pP/F2tVFxNkvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.43
country_id: 1733045
description:
2025-12-13 19:34:25 dovecot_login authenticator failed for ([49.124.146.43]) [49.124.146.43]:59296: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.49
country_id: 798544
description:
Dec 13 19:37:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=89.231.35.49, lip=66.85.158.91, TLS, session=<7vFM5NVFQplZ5yMx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.110.58
country_id: 798544
description:
Dec 13 19:37:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.196.110.58, lip=66.85.158.91, TLS, session=<yll55dVFo6hbxG46>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 19:37:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<lLA559VFDs8ImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2025-12-13 19:38:35 dovecot_login authenticator failed for ([125.18.67.17]) [182.95.112.146]:48568: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-13 19:38:48 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:44592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-13 19:39:21 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:40797: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-13 19:39:39 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:44022: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 19:40:31 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (metana) [98.227.25.115]:44610: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Dec 13 19:40:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.91, session=<Ovrf8dVFgE1KUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 19:40:26 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (ploxillan) [51.195.117.220]:23002: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Dec 13 19:41:14 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.91, session=<rw1x89VF6AlKUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-13 19:41:35 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:36796: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-13 19:42:01 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:46950: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.33.80
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 143.244.33.80 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-13 19:43:29 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:59046: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 19:43:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+ylH/NVFPZR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-12-13 19:43:54 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:38836: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-13 19:44:01 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (boromblen) [73.213.237.28]:45688: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 19:44:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<zlkC/tVFPu7O7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 19:44:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<iRwyANZFrJgI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-13 19:49:23 dovecot_login authenticator failed for (nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:36960: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-12-13 19:49:37 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:36907: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.126.26
country_id: 3865483
description:
2025-12-13 19:50:06 dovecot_plain authenticator failed for ([31.57.166.48]) [170.233.126.26]:53729: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.255.121.2
country_id: 3469034
description:
2025-12-13 19:50:18 dovecot_plain authenticator failed for ([31.57.166.48]) [143.255.121.2]:59273: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 19:50:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<eBLhE9ZFTMsro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.28.199.9
country_id: 2635167
description:
2025-12-13 19:50:30 dovecot_plain authenticator failed for cpc102022-bagu16-2-0-cust776.1-3.cable.virginm.net ([31.57.166.48]) [86.28.199.9]:37586: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 19:52:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<8qJLHNZFWOyl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-13 19:53:02 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:33062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 19:53:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<7THOHdZFRsCG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.100
country_id: 3469034
description:
Dec 13 19:54:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=179.189.201.100, lip=66.85.158.91, TLS, session=<FrYKINZFprSzvclk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 19:53:33 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (detic) [98.227.25.115]:50958: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-12-13 19:53:32 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:57904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.5.108.126
country_id: 2186224
description:
Dec 13 19:53:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.5.108.126, lip=66.85.158.91, TLS, session=<HDyPHtZF/LxnBWx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 19:54:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<wjXVItZFLMKB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.42.26.27
country_id: 3469034
description:
Dec 13 19:55:46 host2 sshd[1792720]: Disconnected from invalid user water 201.42.26.27 port 46618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-13 19:56:48 dovecot_plain authenticator failed for (undillike) [92.62.243.175]:35558: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 13 19:57:43 host2 sshd[1794995]: Disconnected from invalid user oracle 103.136.200.241 port 44372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.147.178
country_id: 2750405
description:
Dec 13 19:57:53 host2 sshd[1795354]: Disconnected from invalid user dbadmin 51.158.147.178 port 43856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-13 19:57:57 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:39328: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2025-12-13 19:58:04 dovecot_login authenticator failed for ([49.124.153.15]) [49.124.153.15]:36170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-13 19:58:12 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:38472: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.75.185.190
country_id: 6252001
description:
2025-12-13 19:59:10 dovecot_login authenticator failed for (149-75-185-190.s445.c3-0.elg-e6k1.nape.il.cable.rcncustomer.com) [149.75.185.190]:60142: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-13 19:58:26 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:53544: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 13 19:58:27 host2 sshd[1796166]: Disconnected from invalid user clouduser 103.136.200.241 port 36898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 19:58:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<dUFUMdZF/tZnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 19:58:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=</dwcMtZF5s6H6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.108.138
country_id: 1269750
description:
2025-12-13 19:59:25 dovecot_login authenticator failed for ([182.76.36.105]) [182.78.108.138]:58252: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 13 20:00:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<r33UNtZF1rcjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.147.178
country_id: 2750405
description:
Dec 13 20:00:16 host2 sshd[1798461]: Disconnected from invalid user oracle 51.158.147.178 port 33528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 20:00:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<+MrKONZFeOYI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 20:01:19 host2 sshd[1799571]: Disconnected from invalid user admin 2.57.121.112 port 10538 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 13 20:02:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<cPquPdZF0uhChJl8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.147.178
country_id: 2750405
description:
Dec 13 20:02:46 host2 sshd[1801345]: Disconnected from invalid user steam 51.158.147.178 port 44608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.42.26.27
country_id: 3469034
description:
Dec 13 20:02:58 host2 sshd[1801584]: Disconnected from invalid user svxlink 201.42.26.27 port 36702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 13 20:02:44 host2 sshd[1801285]: Disconnected from invalid user admin 103.136.200.241 port 33682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-13 20:03:58 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:50288: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.147.178
country_id: 2750405
description:
Dec 13 20:03:21 host2 sshd[1802443]: Disconnected from invalid user aditya 51.158.147.178 port 47748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-13 20:04:50 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:34962: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.5
country_id: 294640
description:
2025-12-13 20:04:17 dovecot_login authenticator failed for ([46.210.95.5]) [46.210.95.5]:60843: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.247.150
country_id: 933860
description:
Dec 13 20:04:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=41.76.247.150, lip=66.85.158.91, TLS, session=<zsgnRdZFAMApTPeW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-13 20:04:28 dovecot_login authenticator failed for host-148-170-156-248.public.eastlink.ca [148.170.156.248]:53986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.23.201
country_id: 798544
description:
Dec 13 20:04:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=80.82.23.201, lip=66.85.158.91, TLS, session=<aVBrRtZFyrFQUhfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.42.26.27
country_id: 3469034
description:
Dec 13 20:06:26 host2 sshd[1805646]: Disconnected from invalid user dev1 201.42.26.27 port 38420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.0.148.241
country_id: 1269750
description:
Dec 13 20:06:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=202.0.148.241, lip=66.85.158.91, TLS, session=<uNBwTdZFpM/KAJTx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.65
country_id: 798544
description:
Dec 13 20:07:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=46.20.58.65, lip=66.85.158.91, TLS, session=<b0vITtZF3sMuFDpB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 20:07:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<efxZUtZFFIKWXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.42.26.27
country_id: 3469034
description:
Dec 13 20:08:15 host2 sshd[1807478]: Disconnected from invalid user foundry 201.42.26.27 port 54166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 20:08:50 host2 sshd[1808153]: Disconnected from invalid user user 2.57.121.25 port 11315 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 20:09:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Z/BdWdZFeNK8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.78.197.236
country_id: 3658394
description:
2025-12-13 20:09:49 dovecot_plain authenticator failed for ([31.57.166.48]) [181.78.197.236]:47329: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-13 20:10:00 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (mangosess) [188.219.104.210]:35699: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.4
country_id: 6252001
description:
Dec 13 20:10:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.4, lip=66.85.158.92, TLS, session=<g1fnWtZFpN9C5DUE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.62.149.171
country_id: 3469034
description:
2025-12-13 20:09:24 dovecot_plain authenticator failed for ([31.57.166.48]) [187.62.149.171]:40464: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.53.187
country_id: 3469034
description:
2025-12-13 20:09:37 dovecot_plain authenticator failed for ip-53-187.zaptche.com.br ([31.57.166.48]) [177.22.53.187]:42502: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 13 20:10:37 host2 sshd[1810065]: Disconnected from invalid user ubuntu 70.54.182.130 port 38020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:11:35 host2 sshd[1810970]: Disconnected from invalid user dspace 179.40.112.10 port 39070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.115
country_id: 3469034
description:
Dec 13 20:12:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<awanish@maximsholdings.com>, method=PLAIN, rip=187.120.72.115, lip=66.85.158.91, TLS, session=<DZpgYNZFuIu7eEhz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-13 20:12:11 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (hentellflo) [73.224.171.101]:60340: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-13 20:13:10 dovecot_login authenticator failed for (221-169-97-62.cust.smartcall.no) [62.97.169.221]:51645: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.54
country_id: 3469034
description:
Dec 13 20:12:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<awanish>, method=PLAIN, rip=177.44.71.54, lip=66.85.158.91, TLS, session=<sWuSYdZFAcSxLEc2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Dec 13 20:12:40 host2 sshd[1812087]: Disconnected from invalid user leandro 172.208.48.177 port 43388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 20:12:52 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (preforath) [73.197.236.163]:33196: 535 Incorrect authentication data (set_id=jobs@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:12:58 host2 sshd[1812375]: Disconnected from invalid user ubuntu 179.40.112.10 port 58258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.173.59.73
country_id: 1605651
description:
2025-12-13 20:14:06 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.173.59.73]:46512: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 20:13:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<yfJaZtZFuLk+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.35
country_id: 6252001
description:
2025-12-13 20:13:23 dovecot_login authenticator failed for ([98.181.46.35]) [98.181.46.35]:47654: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:13:53 host2 sshd[1813421]: Disconnected from invalid user admin 179.40.112.10 port 44148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-13 20:15:21 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:48252: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-13 20:15:28 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:35089: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.11.122.162
country_id: 6252001
description:
2025-12-13 20:15:58 dovecot_plain authenticator failed for c-24-11-122-162.hsd1.ut.comcast.net ([31.57.166.48]) [24.11.122.162]:52733: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.48.80.11
country_id: 3865483
description:
2025-12-13 20:16:10 dovecot_plain authenticator failed for ([31.57.166.48]) [190.48.80.11]:58878: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.48.80.11
country_id: 3865483
description:
2025-12-13 20:16:17 dovecot_login authenticator failed for ([31.57.166.48]) [190.48.80.11]:58878: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Dec 13 20:16:18 host2 sshd[1816081]: Disconnected from invalid user david 172.208.48.177 port 52960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:16:31 host2 sshd[1816234]: Disconnected from invalid user unifi 179.40.112.10 port 58288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 20:17:04 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (guele) [51.195.117.220]:22446: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 13 20:17:15 host2 sshd[1816968]: Disconnected from invalid user ahmad 189.112.0.11 port 47056 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:17:19 host2 sshd[1817063]: Disconnected from invalid user dino 179.40.112.10 port 44170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-13 20:17:36 dovecot_login authenticator failed for (128.102.88.80.sta.ac-net.se) [80.88.102.128]:60842: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Dec 13 20:17:36 host2 sshd[1817311]: Disconnected from invalid user dino 172.208.48.177 port 33206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 13 20:19:06 host2 sshd[1818538]: Disconnected from invalid user john 189.112.0.11 port 43172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-13 20:18:23 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:47287: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 20:18:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<leVIedZFiDpetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 13 20:19:48 host2 sshd[1819219]: Disconnected from invalid user lin 189.112.0.11 port 55200 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.203
country_id: 6252001
description:
Dec 13 20:19:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=147.185.133.203, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<rMqHfdZFT9iTuYXL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 13 20:19:59 host2 sshd[1819387]: Disconnected from invalid user sftpuser 70.54.182.130 port 48202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 13 20:20:30 host2 sshd[1820115]: Disconnected from invalid user jason 189.112.0.11 port 38996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 13 20:20:56 host2 sshd[1820531]: Disconnected from invalid user ahmad 190.181.25.210 port 34950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.203
country_id: 6252001
description:
Dec 13 20:21:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=147.185.133.203, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<9r+tgdZFkO+TuYXL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 13 20:21:46 host2 sshd[1821312]: Disconnected from invalid user ubuntu 190.181.25.210 port 41877 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 13 20:22:37 host2 sshd[1821886]: Disconnected from invalid user jay 190.181.25.210 port 48806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-13 20:22:44 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:53268: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-13 20:22:55 dovecot_plain authenticator failed for (letristal) [65.20.149.93]:40051: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-13 20:22:21 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:61461: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Dec 13 20:22:34 host2 sshd[1821870]: Disconnected from invalid user john 51.75.253.68 port 51638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-12-13 20:22:39 dovecot_login authenticator failed for (abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:39863: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 13 20:23:10 host2 sshd[1822240]: Disconnected from invalid user ftpuser 189.112.0.11 port 58898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-13 20:24:11 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:53097: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 20:23:14 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:56052: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-13 20:23:45 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:55741: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.253.68
country_id: 3017382
description:
Dec 13 20:25:34 host2 sshd[1824446]: Disconnected from invalid user shree 51.75.253.68 port 45306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-13 20:26:26 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (tooda) [73.13.220.220]:33584: 535 Incorrect authentication data (set_id=jobs@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 20:26:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<g4WuldZFnoYv7PP+>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.75.253.68
country_id: 3017382
description:
Dec 13 20:27:05 host2 sshd[1825557]: Received disconnect from 51.75.253.68 port 35402:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.203
country_id: 6252001
description:
Dec 13 20:28:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.203, lip=66.85.158.91, TLS, session=<rGqymtZFUvSTuYXL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.105
country_id: 6252001
description:
2025-12-13 20:28:10 dovecot_login authenticator failed for ([98.185.120.105]) [98.185.120.105]:60924: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-13 20:28:35 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:51010: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.64.191
country_id: 294640
description:
2025-12-13 20:30:03 dovecot_login authenticator failed for (31-154-64-191.orange.net.il) [2.55.64.191]:42789: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-13 20:29:35 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:50918: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 20:29:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<TFZcoNZF9p68pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 20:30:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<rGYQo9ZFusw+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.207.250.28
country_id: 130758
description:
2025-12-13 20:30:36 dovecot_plain authenticator failed for (sartion) [213.207.250.28]:38602: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-13 20:31:05 dovecot_plain authenticator failed for (coied) [5.11.143.72]:46060: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 20:31:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<CLe9qNZF9N0+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 20:33:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<qRFKr9ZF/DkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 20:35:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<c0C3ttZF/uEIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-13 20:36:17 dovecot_login authenticator failed for (30-170-97-62.cust.smartcall.no) [62.97.170.30]:36467: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-12-13 20:36:47 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:39616: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-13 20:38:48 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:48518: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-13 20:39:04 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:56250: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.244
country_id: 6252001
description:
Dec 13 20:39:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.244, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<igjcwtZFDNGTuYX0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.85.44.247
country_id: 6252001
description:
2025-12-13 20:40:07 dovecot_plain authenticator failed for (thordnes) [73.85.44.247]:43448: 535 Incorrect authentication data (set_id=jobs@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.244
country_id: 6252001
description:
Dec 13 20:40:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.244, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<6f21xtZF1P+TuYX0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-13 20:42:38 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:51889: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 20:42:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Tsczz9ZFi+1100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-13 20:43:05 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:54845: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-12-13 20:44:00 dovecot_plain authenticator failed for (raked) [37.34.237.45]:41744: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 20:44:03 dovecot_plain authenticator failed for (plitierd) [154.144.243.93]:44244: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 20:45:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<EIak2dZFIL3O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-13 20:45:21 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (astryze) [24.15.216.41]:39104: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-13 20:45:24 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (parebal) [68.38.201.238]:49984: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-13 20:45:34 dovecot_plain authenticator failed for (woonyle) [102.53.15.17]:50825: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 20:46:56 host2 sshd[1841252]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 20:47:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<7FCm3tZFrOcImxNM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.244
country_id: 6252001
description:
Dec 13 20:47:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.244, lip=66.85.158.92, TLS, session=<5OYn39ZFuvmTuYX0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-13 20:47:37 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:52642: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-13 20:47:49 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:43550: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-13 20:47:56 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:34756: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-13 20:48:16 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:48812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-13 20:48:53 dovecot_login authenticator failed for ([125.19.248.170]) [125.19.248.170]:52434: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.146
country_id: 3996063
description:
2025-12-13 20:49:09 dovecot_login authenticator failed for (187.161.222.146-clientes-izzi.mx) [187.161.222.146]:58472: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 20:50:54 host2 sshd[1843900]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.171.250
country_id: 149590
description:
Dec 13 20:51:34 host2 sshd[1844464]: Disconnected from invalid user supervisor 154.73.171.250 port 4910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 13 20:51:38 host2 sshd[1844524]: Disconnected from invalid user richard 172.174.5.146 port 38168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 13 20:51:51 host2 sshd[1844657]: Disconnected from invalid user ftp1 70.54.182.130 port 45459 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.252.152.13
country_id: 298795
description:
Dec 13 20:53:03 host2 sshd[1845394]: Disconnected from invalid user odoo 89.252.152.13 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 13 20:53:46 host2 sshd[1846061]: Disconnected from invalid user tuser 193.123.68.117 port 37026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 13 20:54:05 host2 sshd[1846363]: Disconnected from invalid user git 103.132.243.250 port 57468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 13 20:54:08 host2 sshd[1846604]: Disconnected from invalid user user 50.232.189.209 port 42758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Dec 13 20:54:12 host2 sshd[1846638]: Disconnected from invalid user git 181.123.136.11 port 48490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-13 20:53:17 dovecot_plain authenticator failed for (undivily) [92.62.243.175]:55770: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-13 20:53:18 dovecot_plain authenticator failed for (undid) [65.20.149.93]:37760: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 20:53:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<8dOx9dZFntWG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-12-13 20:53:52 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:58920: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 13 20:53:55 host2 sshd[1846212]: Disconnected from invalid user user123 172.174.5.146 port 61638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-13 20:54:06 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:59756: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Dec 13 20:54:54 host2 sshd[1847462]: Disconnected from invalid user jin 166.170.48.43 port 37182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-13 20:55:00 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:55036: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 13 20:54:22 host2 sshd[1846954]: Disconnected from invalid user odoo 92.207.4.157 port 34642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.38
country_id: 3996063
description:
2025-12-13 20:54:48 dovecot_login authenticator failed for (187.161.136.38-clientes-izzi.mx) [187.161.136.38]:55597: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.53.125.97
country_id: 6252001
description:
2025-12-13 20:55:57 dovecot_plain authenticator failed for ([31.57.166.48]) [69.53.125.97]:52344: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.99.87.8
country_id: 2589581
description:
2025-12-13 20:55:37 dovecot_plain authenticator failed for ([31.57.166.48]) [105.99.87.8]:43052: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 13 20:55:40 host2 sshd[1848310]: Disconnected from invalid user git 92.207.4.157 port 35522 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 13 20:56:04 host2 sshd[1848591]: Disconnected from invalid user odoo 50.232.189.209 port 51984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 13 20:55:26 host2 sshd[1848136]: Disconnected from invalid user jin 50.232.189.209 port 39502 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec 13 20:55:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<mn4j/dZFXOa4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.174.21.219
country_id: 298795
description:
2025-12-13 20:55:40 dovecot_plain authenticator failed for (anplast) [185.174.21.219]:54230: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.181.74.26
country_id: 6252001
description:
2025-12-13 20:55:47 dovecot_plain authenticator failed for c-69-181-74-26.hsd1.ca.comcast.net ([31.57.166.48]) [69.181.74.26]:35072: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 13 20:56:16 host2 sshd[1848758]: Disconnected from invalid user richard 92.207.4.157 port 50076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Dec 13 20:56:55 host2 sshd[1849265]: Disconnected from invalid user ftpuser 166.170.48.43 port 59684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 20:57:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<CofXBNdFspc+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Dec 13 20:57:45 host2 sshd[1849832]: Disconnected from invalid user cgpexpert 159.89.161.111 port 49512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 13 20:57:55 host2 sshd[1849951]: Disconnected from invalid user userftp 172.174.5.146 port 48104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.250.204.237
country_id: 1269750
description:
Dec 13 20:58:00 host2 sshd[1849982]: Disconnected from invalid user aso 160.250.204.237 port 39474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 20:57:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<6BkpA9dFkI+l6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Dec 13 20:57:18 host2 sshd[1849486]: Disconnected from invalid user supervisor 103.76.120.69 port 53268 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.252.152.13
country_id: 298795
description:
Dec 13 20:58:41 host2 sshd[1850428]: Disconnected from invalid user kapsch 89.252.152.13 port 34294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 13 20:58:43 host2 sshd[1850432]: Disconnected from invalid user kapsch 103.132.243.250 port 43266 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 20:59:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Jr+eCtdFCLGB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.250.204.237
country_id: 1269750
description:
Dec 13 20:59:35 host2 sshd[1851184]: Disconnected from invalid user tuser 160.250.204.237 port 55494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.21.241.143
country_id: 2921044
description:
Dec 13 21:00:49 host2 sshd[1852093]: Disconnected from invalid user frappe 213.21.241.143 port 60322 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 13 21:00:52 host2 sshd[1852157]: Disconnected from invalid user administrador 103.132.243.250 port 33734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.171.250
country_id: 149590
description:
Dec 13 21:00:57 host2 sshd[1852219]: Disconnected from invalid user hadoop 154.73.171.250 port 21838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 21:00:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<yID5DddF5sqnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Dec 13 21:00:43 host2 sshd[1852004]: Disconnected from invalid user odoo 181.123.136.11 port 50414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.250.204.237
country_id: 1269750
description:
Dec 13 21:01:16 host2 sshd[1852483]: Disconnected from invalid user kapsch 160.250.204.237 port 44182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 21:01:18 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (tenutiler) [73.197.236.163]:40934: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.21.241.143
country_id: 2921044
description:
Dec 13 21:01:23 host2 sshd[1852600]: Disconnected from invalid user aso 213.21.241.143 port 22544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Dec 13 21:01:31 host2 sshd[1852681]: Disconnected from invalid user github 159.89.161.111 port 34600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 21:01:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<W9kwE9dFcqmH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Dec 13 21:02:41 host2 sshd[1853322]: Disconnected from invalid user admin 103.76.120.69 port 45108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 21:03:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<fVQ5GNdFJIo+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Dec 13 21:03:57 host2 sshd[1854778]: Disconnected from invalid user christelle 159.89.161.111 port 44200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 13 21:03:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<GzSTGNdFEu5og7HN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.250.204.237
country_id: 1269750
description:
Dec 13 21:03:37 host2 sshd[1854497]: Disconnected from invalid user jin 160.250.204.237 port 45924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Dec 13 21:04:55 host2 sshd[1855543]: Disconnected from invalid user postgres 103.76.120.69 port 54990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.22.8.217
country_id: 3865483
description:
2025-12-13 21:04:18 dovecot_login authenticator failed for ([186.22.8.217]) [186.22.8.217]:50634: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.234
country_id: 2186224
description:
2025-12-13 21:04:33 dovecot_login authenticator failed for ([121.73.169.234]) [121.73.169.234]:45434: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 21:04:40 host2 sshd[1855388]: Disconnected from invalid user admin 2.57.121.112 port 39138 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 21:04:46 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (velip) [196.47.172.253]:51683: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Dec 13 21:06:54 host2 sshd[1856962]: Disconnected from invalid user supermaint 181.123.136.11 port 33854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-13 21:08:14 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:34154: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 21:10:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<HIjbMddFLK+8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-13 21:12:42 dovecot_login authenticator failed for ([122.185.184.134]) [182.95.226.82]:59112: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-13 21:12:58 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:53616: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 21:13:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<bmvUO9dFtMeWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-13 21:13:11 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3788: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-13 21:14:15 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:48575: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-13 21:14:21 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (cotongly) [73.13.220.220]:58392: 535 Incorrect authentication data (set_id=media@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-13 21:14:29 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:55594: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 21:17:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<LLg2StdFXMc+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.205.247
country_id: 3895114
description:
2025-12-13 21:17:20 dovecot_plain authenticator failed for ([31.57.166.48]) [45.225.205.247]:53406: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.190.150.104
country_id: 6252001
description:
2025-12-13 21:17:31 dovecot_plain authenticator failed for c-73-190-150-104.hsd1.tn.comcast.net ([31.57.166.48]) [73.190.150.104]:52008: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.53.230.246
country_id: 1527747
description:
2025-12-13 21:17:46 dovecot_plain authenticator failed for ([31.57.166.48]) [185.53.230.246]:1093: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-13 21:18:43 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:46236: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-13 21:19:26 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:56426: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-13 21:19:53 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:39133: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 21:20:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<5O/5VddFtug+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 21:21:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<6rUrWddF3ixetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.239.134
country_id: 99237
description:
2025-12-13 21:21:31 dovecot_plain authenticator failed for ([31.57.166.48]) [62.201.239.134]:10007: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.9.34.117
country_id: 1643084
description:
2025-12-13 21:21:45 dovecot_plain authenticator failed for ([31.57.166.48]) [182.9.34.117]:47811: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.51.25.204
country_id: 290557
description:
2025-12-13 21:22:00 dovecot_plain authenticator failed for bba-2-51-25-204.alshamil.net.ae ([31.57.166.48]) [2.51.25.204]:35332: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-13 21:23:40 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:58576: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 21:24:13 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (rhoust) [51.195.117.220]:15699: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-13 21:24:27 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:34325: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-12-13 21:28:51 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:54738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-13 21:29:08 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:48106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 21:31:24 host2 sshd[1877331]: Disconnected from invalid user  62.60.131.157 port 53398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-12-13 21:32:43 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:51604: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.97
country_id: 6252001
description:
2025-12-13 21:32:55 dovecot_login authenticator failed for ([98.185.120.97]) [98.185.120.97]:45723: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-13 21:33:09 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (gonontrose) [73.208.81.125]:57452: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.38.102.187
country_id: 130758
description:
2025-12-13 21:33:16 dovecot_plain authenticator failed for (quabrubaff) [89.38.102.187]:50630: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 21:35:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Ug6yitdFsoA+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 21:37:51 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:41990: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-13 21:38:01 dovecot_plain authenticator failed for (gedned) [199.192.123.12]:40922: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-13 21:38:04 dovecot_plain authenticator failed for (esifous) [176.113.155.132]:42893: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-12-13 21:38:10 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:55206: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-13 21:38:25 dovecot_login authenticator failed for ([27.123.113.10]) [27.123.113.10]:42824: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-13 21:38:39 dovecot_login authenticator failed for ([136.232.73.130]) [136.232.73.130]:58580: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 21:40:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<TURhnddFdq0+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-13 21:41:33 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (finkily) [73.137.7.97]:41424: 535 Incorrect authentication data (set_id=monitoring@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 21:42:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<NUpSpNdFsLQIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-13 21:43:22 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:29441: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-12-13 21:43:39 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:54937: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.179
country_id: 3175395
description:
Dec 13 21:43:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<awanish@maximsholdings.com>, method=PLAIN, rip=185.197.9.179, lip=66.85.158.91, TLS, session=<n5Y+qNdFmLG5xQmz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.149
country_id: 798544
description:
Dec 13 21:43:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<awanish>, method=PLAIN, rip=85.202.108.149, lip=66.85.158.91, TLS, session=<+3VOqddFPN9VymyV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-13 21:44:16 dovecot_login authenticator failed for ([1.7.229.162]) [136.232.73.130]:46572: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-12-13 21:44:26 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:36773: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-13 21:47:16 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (fultical) [71.224.169.28]:42254: 535 Incorrect authentication data (set_id=monitoring@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-13 21:50:19 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (cotal) [174.169.224.27]:42592: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 158.94.210.79 - Itemid=459&amp "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 21:52:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=</JVCyddFXIOG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 21:55:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<Ax/51NdF4OYImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-13 21:57:29 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:58450: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 21:57:52 host2 pure-ftpd[1915452]: (?@43.162.120.170) [INFO] New connection from 43.162.120.170


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 21:57:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=43.162.120.170, lip=66.85.158.91, session=<7YcV3NdFgrEroniq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-13 21:57:56 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:52658: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-13 21:58:30 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (azzle) [174.166.153.20]:47102: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 22:01:17 host2 dovecot[1284858]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=43.162.120.170, lip=66.85.158.91, TLS handshaking, session=<JKlN6NdFOo8roniq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 22:01:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<abM76NdFark+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.49.67
country_id: 298795
description:
2025-12-13 22:01:24 dovecot_plain authenticator failed for ([31.57.166.48]) [78.186.49.67]:54372: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.197
country_id: 6252001
description:
Dec 13 22:00:40 host2 pure-ftpd[1918437]: (?@64.62.197.197) [INFO] New connection from 64.62.197.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.245.16.197
country_id: 298795
description:
2025-12-13 22:01:11 dovecot_plain authenticator failed for ([31.57.166.48]) [88.245.16.197]:57496: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-13 22:02:35 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:45479: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
country_id: 1269750
description:
2025-12-13 22:03:24 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:51153: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-13 22:02:40 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:53670: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-12-13 22:02:51 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:42730: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 22:02:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<dDUm7tdFmrmB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.39.87.7
country_id: 6251999
description:
2025-12-13 22:03:41 dovecot_login authenticator failed for d72-39-87-7.home1.cgocable.net [72.39.87.7]:46486: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 22:04:06 dovecot_login authenticator failed for ([103.251.31.154]) [103.251.31.154]:36134: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.201
country_id: 3469034
description:
Dec 13 22:04:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=191.53.128.201, lip=66.85.158.91, TLS, session=<jkuh8ddF5om/NYDJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-13 22:04:32 dovecot_plain authenticator failed for (uropers) [62.73.121.209]:52551: 535 Incorrect authentication data (set_id=monitoring@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 22:04:37 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59144: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.45
country_id: 690791
description:
Dec 13 22:04:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=176.103.11.45, lip=66.85.158.91, TLS, session=<IZwR89dFOeuwZwst>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 22:05:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<lKE49tdFyKiH6yFP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.204
country_id: 6252001
description:
Dec 13 22:05:31 host2 pure-ftpd[1922923]: (?@205.210.31.204) [INFO] New connection from 205.210.31.204


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.65.255
country_id: 2750405
description:
Dec 13 22:06:18 host2 sshd[1923660]: Disconnected from invalid user shalini 157.245.65.255 port 45770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.65.255
country_id: 2750405
description:
Dec 13 22:07:25 host2 sshd[1924591]: Disconnected from invalid user rp 157.245.65.255 port 37668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-13 22:07:31 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:45948: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-13 22:08:26 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:55930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-13 22:07:41 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:44820: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.65.255
country_id: 2750405
description:
Dec 13 22:07:58 host2 sshd[1925114]: Disconnected from invalid user steam 157.245.65.255 port 43378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2025-12-13 22:08:11 dovecot_login authenticator failed for 80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:46388: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-13 22:09:24 dovecot_login authenticator failed for (191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:40714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-13 22:09:50 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:43397: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 22:10:10 dovecot_plain authenticator failed for (weeps) [64.72.74.162]:44399: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-13 22:10:39 dovecot_plain authenticator failed for (trecum) [24.187.213.29]:55438: 535 Incorrect authentication data (set_id=noreply@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-13 22:10:43 dovecot_plain authenticator failed for (uplese) [80.227.102.242]:54652: 535 Incorrect authentication data (set_id=noreply@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.125
country_id: 3865483
description:
Dec 13 22:13:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.251.125, lip=66.85.158.91, TLS, session=<sOkqEthFituzAPt9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.51
country_id: 719819
description:
Dec 13 22:13:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.48.181.51, lip=66.85.158.91, TLS, session=<235vE9hFu7iyMLUz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 22:18:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<SHEVJdhFaoI+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 22:18:10 host2 sshd[1934316]: Disconnected from invalid user admin 2.57.121.112 port 51018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-12-13 22:18:39 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:36914: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-13 22:18:51 dovecot_login authenticator failed for (industrianaval.fla.gvt.net.br) [187.58.66.231]:37581: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-13 22:19:34 dovecot_plain authenticator failed for (chignew) [88.149.153.106]:49397: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-13 22:19:39 dovecot_plain authenticator failed for (hannable) [91.73.188.251]:48116: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 22:22:29 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:60664: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-12-13 22:22:14 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:48762: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2025-12-13 22:23:22 dovecot_plain authenticator failed for (derred) [103.68.22.140]:44680: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 22:23:46 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (quisder) [196.47.172.253]:60383: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-13 22:23:58 dovecot_plain authenticator failed for (rectic) [185.214.169.10]:37183: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.220.191
country_id: 3625428
description:
2025-12-13 22:25:49 dovecot_plain authenticator failed for ([31.57.166.48]) [38.43.220.191]:50322: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.133.70.96
country_id: 3439705
description:
2025-12-13 22:26:01 dovecot_plain authenticator failed for r190-133-70-96.dialup.adsl.anteldata.net.uy ([31.57.166.48]) [190.133.70.96]:45018: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.221.157.140
country_id: 6252001
description:
Dec 13 22:26:01 host2 pure-ftpd[1940967]: (?@54.221.157.140) [INFO] New connection from 54.221.157.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-12-13 22:27:10 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:56680: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.195.94.152
country_id: 3469034
description:
2025-12-13 22:27:24 dovecot_plain authenticator failed for ([31.57.166.48]) [186.195.94.152]:5900: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-13 22:27:23 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:46548: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 22:27:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Uz89RthFGJc+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-13 22:27:44 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:39478: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.38.43.122
country_id: 290557
description:
2025-12-13 22:27:55 dovecot_plain authenticator failed for gprs-emirnet16886.emirates.net.ae ([31.57.166.48]) [5.38.43.122]:38403: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 22:28:23 host2 sshd[1942821]: Disconnected from invalid user admin 2.57.121.112 port 42614 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-13 22:28:32 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:51504: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-13 22:29:30 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:44199: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.206
country_id: 1269750
description:
2025-12-13 22:28:48 dovecot_login authenticator failed for ([182.95.63.206]) [182.95.63.206]:43706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-13 22:29:12 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:50334: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 158.94.210.79 - RE_Trinco "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user RE_Trinco (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.135
country_id: 1269750
description:
Dec 13 22:31:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.18.166.135, lip=66.85.158.91, TLS, session=<VXjmU9hFrbdnEqaH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.67
country_id: 3469034
description:
Dec 13 22:32:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=190.89.137.67, lip=66.85.158.91, TLS, session=<ModFVdhFsua+WYlD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-13 22:32:55 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:34090: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-13 22:33:32 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:57266: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-13 22:33:47 dovecot_login authenticator failed for (nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:39238: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-13 22:34:00 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:49672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-13 22:34:12 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:53522: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 22:36:32 host2 sshd[1948026]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.28.62
country_id: 1210997
description:
Dec 13 22:36:03 host2 sshd[1947786]: Disconnected from invalid user sinusbot 103.172.28.62 port 57486 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.166
country_id: 6252001
description:
Dec 13 22:36:49 host2 pure-ftpd[1948147]: (?@198.235.24.166) [INFO] New connection from 198.235.24.166


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.28.62
country_id: 1210997
description:
Dec 13 22:37:16 host2 sshd[1948361]: Disconnected from invalid user user 103.172.28.62 port 59458 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.28.62
country_id: 1210997
description:
Dec 13 22:38:02 host2 sshd[1948729]: Disconnected from invalid user sebastian 103.172.28.62 port 37772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.28.62
country_id: 1210997
description:
Dec 13 22:38:47 host2 sshd[1949081]: Disconnected from invalid user dspace 103.172.28.62 port 50008 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 22:40:28 host2 sshd[1950237]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-13 22:39:57 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (outte) [24.127.53.61]:58998: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.237
country_id: 3469034
description:
Dec 13 22:40:47 host2 sshd[1950383]: Disconnected from invalid user sistema 189.47.10.237 port 44634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-13 22:41:00 dovecot_plain authenticator failed for (aphically) [24.187.213.29]:56068: 535 Incorrect authentication data (set_id=office@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.237
country_id: 3469034
description:
Dec 13 22:42:11 host2 sshd[1951162]: Disconnected from invalid user ava 189.47.10.237 port 37098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 13 22:41:37 host2 sshd[1950889]: Disconnected from invalid user oracle 156.245.239.180 port 56844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 13 22:42:57 host2 sshd[1951482]: Disconnected from invalid user pdv 20.123.120.169 port 50044 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-13 22:43:27 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:51097: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-13 22:43:46 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:37611: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-13 22:44:15 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:49250: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-12-13 22:44:33 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:43858: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 13 22:43:36 host2 sshd[1951851]: Disconnected from invalid user ubuntu 20.123.120.169 port 34206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.199.196
country_id: 1861060
description:
Dec 13 22:44:43 host2 sshd[1952751]: Disconnected from invalid user centos 134.122.199.196 port 50906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 13 22:44:46 host2 sshd[1952804]: Disconnected from invalid user jerry 20.123.120.169 port 53322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.177.241.67
country_id: 2542007
description:
2025-12-13 22:45:52 dovecot_plain authenticator failed for ([31.57.166.48]) [160.177.241.67]:46248: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.74.17.134
country_id: 2542007
description:
2025-12-13 22:46:04 dovecot_plain authenticator failed for ([31.57.166.48]) [196.74.17.134]:41908: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.52.146.249
country_id: 2623032
description:
2025-12-13 22:46:19 dovecot_plain authenticator failed for 86-52-146-249.norlyscustomer.net ([31.57.166.48]) [86.52.146.249]:7614: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.199.196
country_id: 1861060
description:
Dec 13 22:46:43 host2 sshd[1954641]: Disconnected from invalid user oracle 134.122.199.196 port 33760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 13 22:46:56 host2 sshd[1954740]: Disconnected from invalid user test 156.245.239.180 port 56230 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 22:48:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<DzRUj9hFoIsIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2025-12-13 22:48:07 dovecot_login authenticator failed for (173-31-197-108.client.mchsi.com) [173.31.197.108]:33556: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Dec 13 22:48:34 host2 sshd[1955586]: Disconnected from invalid user newusername 209.141.53.124 port 34762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-13 22:47:54 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:49638: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 13 22:48:59 host2 sshd[1955742]: Disconnected from invalid user oguz 156.245.239.180 port 56396 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 22:50:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<CmdllthFUK8+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 22:51:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<HX/AmthFWtCnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 48.217.234.252
country_id: 6252001
description:
Dec 13 22:52:17 host2 sshd[1957780]: Disconnected from invalid user lee 48.217.234.252 port 39894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.177
country_id: 2215636
description:
2025-12-13 22:52:52 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:51221: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-13 22:53:14 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:44754: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-13 22:53:28 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:41782: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.222.239.130
country_id: 3996063
description:
Dec 13 22:52:37 host2 sshd[1957939]: Disconnected from invalid user term1 189.222.239.130 port 49059 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 22:52:39 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:42748: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.73.35.80
country_id: 1643084
description:
2025-12-13 22:54:55 dovecot_plain authenticator failed for ([31.57.166.48]) [36.73.35.80]:26460: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.86.93
country_id: 6252001
description:
2025-12-13 22:55:04 dovecot_plain authenticator failed for ([31.57.166.48]) [45.49.86.93]:43148: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.68.42
country_id: 3996063
description:
2025-12-13 22:55:14 dovecot_plain authenticator failed for fixed-187-189-68-42.totalplay.net ([31.57.166.48]) [187.189.68.42]:44140: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 48.217.234.252
country_id: 6252001
description:
Dec 13 22:55:58 host2 sshd[1960895]: Disconnected from invalid user erpnext 48.217.234.252 port 53292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.181.30.38
country_id: 1527747
description:
Dec 13 22:56:11 host2 sshd[1960997]: Disconnected from invalid user ftpuser 158.181.30.38 port 35874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Dec 13 22:56:16 host2 sshd[1961053]: Disconnected from invalid user sri 209.141.53.124 port 51038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Dec 13 22:57:00 host2 sshd[1961454]: Disconnected from invalid user mehdi 209.141.53.124 port 34958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.181.30.38
country_id: 1527747
description:
Dec 13 22:56:58 host2 sshd[1961425]: Disconnected from invalid user erpnext 158.181.30.38 port 48036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.255.176
country_id: 99237
description:
2025-12-13 22:58:38 dovecot_plain authenticator failed for ([31.57.166.48]) [62.201.255.176]:45743: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.38.39.101
country_id: 3865483
description:
2025-12-13 22:58:18 dovecot_plain authenticator failed for ([31.57.166.48]) [179.38.39.101]:59228: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.96.170
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.39.96.170 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.227.211.27
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.227.211.27 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.186.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.74.186.72 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.173
country_id: 2542007
description:
2025-12-13 22:59:01 dovecot_login authenticator failed for ([105.73.93.173]) [105.73.93.173]:60689: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.181.30.38
country_id: 1527747
description:
Dec 13 22:59:21 host2 sshd[1962772]: Disconnected from invalid user temp 158.181.30.38 port 50276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-13 22:59:24 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:44308: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.141.1
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.110.141.1 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.129.103.200
country_id: 3923057
description:
2025-12-13 22:58:52 dovecot_plain authenticator failed for ([31.57.166.48]) [190.129.103.200]:51501: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.211.224.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.211.224.48 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.37.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.149.37.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.110.238.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.110.238.73 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.255.176
country_id: 99237
description:
2025-12-13 22:58:47 dovecot_login authenticator failed for ([31.57.166.48]) [62.201.255.176]:45743: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-12-13 22:59:58 dovecot_login authenticator failed for ([125.215.199.37]) [125.215.199.37]:63843: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-12-13 23:00:31 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:49054: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-12-13 23:01:03 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:39086: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-12-13 23:01:09 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (heblate) [95.229.5.248]:55856: 535 Incorrect authentication data (set_id=operator@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-13 23:01:12 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (metace) [73.88.196.91]:57724: 535 Incorrect authentication data (set_id=operator@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-13 23:01:59 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:35288: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.222.0.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.222.0.133 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.99.234.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.99.234.48 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.133.33.139
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.133.33.139 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.74.0.44
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.74.0.44 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.142.243.90
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.142.243.90 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.26.180.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.26.180.181 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.38.143.190
country_id: 660013
description:
Denial of Service (DoS) attack was discovered from 45.38.143.190: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.153.229.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.153.229.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 23:04:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<8oW+ydhFwoUImxNM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.222.239.130
country_id: 3996063
description:
Dec 13 23:04:40 host2 sshd[1966145]: Disconnected from invalid user newusername 189.222.239.130 port 45347 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 23:03:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ioFKx9hFktY+PIM0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.226.83
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.168.226.83 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.120.156
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.38.120.156 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.141.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.168.141.35 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.217.125.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.217.125.239 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.211.195.245
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.211.195.245 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.33.195.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.33.195.73 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.252.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.252.10 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.60
country_id: 1269750
description:
Dec 13 23:06:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=103.18.166.60, lip=66.85.158.91, TLS, session=<1PH9zthFpJVnEqY8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.115.220
country_id: 3865483
description:
Dec 13 23:06:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=190.110.115.220, lip=66.85.158.91, TLS, session=<7o1M0NhFWqG+bnPc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.222.239.130
country_id: 3996063
description:
Dec 13 23:05:53 host2 sshd[1967027]: Disconnected from invalid user odoo 189.222.239.130 port 58125 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.251.105.121
country_id: 3996063
description:
2025-12-13 23:07:30 dovecot_plain authenticator failed for ([31.57.166.48]) [189.251.105.121]:32926: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.239.29.206
country_id: 6252001
description:
2025-12-13 23:07:52 dovecot_plain authenticator failed for 108-239-29-206.lightspeed.chtnsc.sbcglobal.net ([31.57.166.48]) [108.239.29.206]:41862: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-13 23:08:16 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (wrawnebum) [71.235.225.181]:37434: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-13 23:08:22 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:50094: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.167
country_id: 3996063
description:
2025-12-13 23:09:15 dovecot_login authenticator failed for ([177.236.146.167]) [177.236.146.167]:36493: 535 Incorrect authentication data (set_id=notifications@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-13 23:10:15 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:59974: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 23:11:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<8tvY4thFvuWH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.154
country_id: 1733045
description:
2025-12-13 23:13:23 dovecot_login authenticator failed for ([49.124.155.154]) [49.124.155.154]:54690: 535 Incorrect authentication data (set_id=notifications@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2025-12-13 23:14:02 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:62176: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-13 23:15:15 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (dostoon) [66.177.30.53]:32774: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-13 23:18:19 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:45083: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2025-12-13 23:18:26 dovecot_login authenticator failed for (189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:33664: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-13 23:18:40 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:40073: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-13 23:17:50 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:45516: 535 Incorrect authentication data (set_id=notifications@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-13 23:18:05 dovecot_login authenticator failed for (221-169-97-62.cust.smartcall.no) [62.97.169.221]:35670: 535 Incorrect authentication data (set_id=notifications@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 23:18:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<RuZn+9hFQODCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-13 23:19:20 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:50660: 535 Incorrect authentication data (set_id=notifications@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.170
country_id: 1733045
description:
2025-12-13 23:19:06 dovecot_login authenticator failed for ([49.124.154.170]) [49.124.154.170]:37158: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-13 23:19:53 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:44093: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.135.154.192
country_id: 3077311
description:
2025-12-13 23:23:32 dovecot_login authenticator failed for cst-prg-154-192.cust.vodafone.cz [46.135.154.192]:38455: 535 Incorrect authentication data (set_id=notifications@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-13 23:23:52 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:57315: 535 Incorrect authentication data (set_id=notifications)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-13 23:24:14 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:56372: 535 Incorrect authentication data (set_id=notifications@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 23:30:44 host2 sshd[1983741]: Disconnected from invalid user admin 2.57.121.112 port 5776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.92
country_id: 1733045
description:
2025-12-13 23:33:13 dovecot_login authenticator failed for ([49.125.201.92]) [49.125.201.92]:39072: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 13 23:33:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vzENMdlFkvpAPpxQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Dec 13 23:33:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rtkiMtlFlHNAPpyE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 13 23:33:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.91, TLS: Connection closed, session=<4eUIM9lF9vVAPpxQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Dec 13 23:33:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<MNg3M9lFTpZAPpyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-13 23:36:41 dovecot_plain authenticator failed for (metherle) [5.32.99.14]:45099: 535 Incorrect authentication data (set_id=orders@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-13 23:40:49 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:37424: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 23:41:06 host2 sshd[1990333]: Disconnected from invalid user admin 2.57.121.112 port 34241 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 23:41:26 host2 sshd[1990483]: Disconnected from invalid user user 2.57.121.25 port 7120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-13 23:42:10 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:58168: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.135.154.192
country_id: 3077311
description:
2025-12-13 23:42:10 dovecot_login authenticator failed for cst-prg-154-192.cust.vodafone.cz [46.135.154.192]:44409: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-13 23:41:49 dovecot_login authenticator failed for ([125.17.216.185]) [128.185.246.106]:40552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.253
country_id: 1733045
description:
2025-12-13 23:41:51 dovecot_login authenticator failed for ([49.124.150.253]) [49.124.150.253]:40744: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-13 23:42:54 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:33036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-13 23:43:08 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:55386: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 13 23:44:23 host2 sshd[1992062]: Disconnected from invalid user cs2server 59.98.148.5 port 39006 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 13 23:45:28 host2 pure-ftpd[1993236]: (?@66.132.153.124) [INFO] New connection from 66.132.153.124


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Dec 13 23:45:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, session=<OfSwXdlFyGJBMRRE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.201
country_id: 1880251
description:
Dec 13 23:46:30 host2 sshd[1993770]: Disconnected from invalid user pt 45.78.200.201 port 37996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.106.12
country_id: 1605651
description:
Dec 13 23:47:10 host2 sshd[1994173]: Disconnected from invalid user odoo 49.228.106.12 port 55588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-13 23:47:17 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:42454: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2025-12-13 23:47:48 dovecot_login authenticator failed for ([102.164.35.116]) [102.164.35.116]:53220: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 23:47:55 host2 sshd[1994602]: Disconnected from invalid user  62.60.131.157 port 18192 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-13 23:48:11 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:49356: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.67
country_id: 1733045
description:
2025-12-13 23:48:27 dovecot_login authenticator failed for ([49.125.201.67]) [49.125.201.67]:39506: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.153.3.119
country_id: 3175395
description:
Dec 13 23:49:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=185.153.3.119, lip=66.85.158.91, TLS, session=<PQ67adlFONy5mQN3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.54
country_id: 798544
description:
Dec 13 23:49:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=128.127.94.54, lip=66.85.158.91, TLS, session=<1JvIatlFotGAf142>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.200.201
country_id: 1880251
description:
Dec 13 23:48:42 host2 sshd[1995261]: Disconnected from invalid user admin 45.78.200.201 port 47508 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 23:49:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<r7QJbNlFuseB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 23:50:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<CPXvbNlFEOs+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.106.12
country_id: 1605651
description:
Dec 13 23:50:45 host2 sshd[1996492]: Disconnected from invalid user cs2server 49.228.106.12 port 46476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.201
country_id: 1880251
description:
Dec 13 23:50:52 host2 sshd[1996570]: Disconnected from invalid user myuser 45.78.200.201 port 59840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2025-12-13 23:51:00 dovecot_plain authenticator failed for (funtings) [173.165.182.203]:59953: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 13 23:51:25 host2 sshd[1996867]: Disconnected from invalid user myuser 59.98.148.5 port 51946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 23:51:40 host2 sshd[1996959]: Disconnected from invalid user user 2.57.121.25 port 25677 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 13 23:52:04 host2 sshd[1997240]: Disconnected from invalid user testuser 59.98.148.5 port 34304 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.162
country_id: 6252001
description:
Dec 13 23:52:08 host2 pure-ftpd[1997274]: (?@64.62.156.162) [INFO] New connection from 64.62.156.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 23:52:33 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (nustra) [96.230.65.90]:56910: 535 Incorrect authentication data (set_id=postmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-13 23:52:54 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:39702: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.249
country_id: 6252001
description:
Dec 13 23:52:58 host2 pure-ftpd[1997666]: (?@205.210.31.249) [INFO] New connection from 205.210.31.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-13 23:52:41 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:35505: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-13 23:52:47 dovecot_plain authenticator failed for (granganic) [192.34.128.202]:41808: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 13 23:55:58 host2 sshd[2000572]: Disconnected from invalid user admin 59.98.148.5 port 46670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2025-12-13 23:56:27 dovecot_plain authenticator failed for 68.129.5.84.rev.sfr.net (clondress) [84.5.129.68]:55325: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-13 23:57:27 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:47451: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-13 23:57:50 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:55078: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-13 23:59:14 dovecot_plain authenticator failed for (unmort) [5.11.141.74]:37876: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-13 23:59:38 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:50812: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.45
country_id: 6252001
description:
Dec 13 23:59:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.45, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Uxraj9lFDbpAPsUt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.20
country_id: 6252001
description:
Dec 13 23:59:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.20, lip=66.85.158.91, TLS handshaking: Connection closed, session=<av3Nj9lFv6xAPsUU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-13 23:59:00 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:39485: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec 14 00:00:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZJHekNlFROpAPsUR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Dec 14 00:00:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, TLS handshaking: Connection closed, session=<opjskNlFtodAPsUg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-12-14 00:01:20 dovecot_login authenticator failed for (nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:53159: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-14 00:01:24 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:58602: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.97
country_id: 6252001
description:
Dec 14 00:01:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.97, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Tk3xldlFOdPN0h9h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.17
country_id: 6252001
description:
2025-12-14 00:01:04 dovecot_login authenticator failed for ([98.181.44.17]) [98.181.44.17]:32956: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.182.175
country_id: 3469034
description:
2025-12-14 00:01:52 dovecot_login authenticator failed for ([177.10.182.175]) [177.10.182.175]:53220: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-14 00:04:24 dovecot_plain authenticator failed for (uncling) [65.20.174.63]:46521: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.79.53
country_id: 6252001
description:
Dec 14 00:05:40 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.56.79.53, lip=66.85.158.91, session=<T90WpdlF9uQtOE81>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.19.223.104
country_id: 6252001
description:
Dec 14 00:06:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.19.223.104, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DQEvqNlFrssDE99o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-14 00:06:38 dovecot_login authenticator failed for ([182.95.181.22]) [182.95.181.22]:53946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-14 00:06:48 dovecot_login authenticator failed for (syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:46645: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-14 00:07:26 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:55956: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-14 00:07:42 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:46084: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.25
country_id: 3469034
description:
Dec 14 00:09:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=187.120.76.25, lip=66.85.158.91, TLS, session=<DL5YstlFLeK7eEwZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-14 00:09:44 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:56062: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-14 00:10:04 dovecot_login authenticator failed for ([85.19.195.12]) [85.19.195.12]:36776: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-14 00:10:08 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:58736: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.177
country_id: 6252001
description:
Dec 14 00:10:27 host2 pure-ftpd[2009646]: (?@91.230.168.177) [INFO] New connection from 91.230.168.177


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.178
country_id: 6252001
description:
Dec 14 00:10:27 host2 pure-ftpd[2009644]: (?@91.230.168.178) [INFO] New connection from 91.230.168.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-14 00:09:51 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:51314: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.101
country_id: 798544
description:
Dec 14 00:10:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=91.246.213.101, lip=66.85.158.91, TLS, session=<vpS0s9lF6ctb9tVl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.70
country_id: 1269750
description:
2025-12-14 00:12:20 dovecot_login authenticator failed for (nsg-corporate-70.116.187.122.airtel.in) [122.187.116.70]:47486: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-12-14 00:12:59 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:40547: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.20.193
country_id: 290557
description:
2025-12-14 00:13:04 dovecot_login authenticator failed for ([94.207.20.193]) [94.207.20.193]:47035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-14 00:13:28 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:37870: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 14 00:12:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<BED6vtlF6NwImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-14 00:15:03 dovecot_plain authenticator failed for (outing) [192.34.128.202]:58162: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-12-14 00:15:39 +0530] info [webmaild] 178.16.55.198 - env_eng@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 14 00:20:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<E+SR2NlF5t/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-14 00:23:44 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:50730: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-14 00:23:03 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:55248: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2025-12-14 00:23:33 dovecot_login authenticator failed for pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:64666: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 00:25:19 host2 sshd[2019356]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-14 00:26:01 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:48585: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-14 00:26:16 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:41202: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 00:29:13 host2 sshd[2022437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-14 00:29:03 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:60378: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-14 00:29:57 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:52356: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-14 00:30:30 dovecot_plain authenticator failed for (norher) [65.20.164.137]:60970: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-14 00:30:33 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (diabizoaed) [71.224.169.28]:41574: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-14 00:30:46 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:48100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-14 00:31:14 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:50811: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-14 00:31:29 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [136.232.73.130]:41318: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-14 00:31:44 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:32963: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.162
country_id: 1733045
description:
2025-12-14 00:32:19 dovecot_login authenticator failed for ([49.124.154.162]) [49.124.154.162]:36950: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-14 00:32:55 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:61332: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 14 00:33:32 host2 pure-ftpd[2025175]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 14 00:33:39 host2 pure-ftpd[2025250]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.223
country_id: 3017382
description:
Dec 14 00:34:21 host2 pure-ftpd[2025585]: (?@91.196.152.223) [INFO] New connection from 91.196.152.223


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.216
country_id: 3017382
description:
Dec 14 00:34:21 host2 pure-ftpd[2025589]: (?@91.196.152.216) [INFO] New connection from 91.196.152.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-14 00:35:13 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:35815: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-14 00:35:40 dovecot_login authenticator failed for ([84.211.13.171]) [84.211.13.171]:34417: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-14 00:36:30 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:60545: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-14 00:36:50 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12135: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-14 00:37:57 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:42858: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-14 00:38:30 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:42258: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-14 00:39:00 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:53072: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Dec 14 00:39:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, session=<tnFTHdpFqpe4aYtF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 00:39:36 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (nuntip) [51.195.117.220]:59207: 535 Incorrect authentication data (set_id=root@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.85.44.247
country_id: 6252001
description:
2025-12-14 00:40:33 dovecot_plain authenticator failed for (mutan) [73.85.44.247]:49754: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-14 00:40:46 dovecot_plain authenticator failed for (renna) [102.53.15.18]:43149: 535 Incorrect authentication data (set_id=root@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 00:42:53 host2 sshd[2030688]: Disconnected from invalid user admin 2.57.121.112 port 11953 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-12-14 00:42:56 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (eacheawks) [95.229.5.248]:42920: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 00:44:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6WNGLtpFKJw+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 00:45:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<P0niNNpFYtKB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-12-14 00:46:33 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:45023: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-14 00:46:47 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:54875: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 00:46:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<mSulONpFWKanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-14 00:48:54 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (intils) [24.127.53.61]:50816: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-14 00:50:16 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:43967: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-14 00:50:28 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:41060: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.29.19
country_id: 933860
description:
Dec 14 00:54:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=83.143.29.19, lip=66.85.158.91, TLS, session=<S9+OUdpFjsJTjx0T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.36
country_id: 798544
description:
Dec 14 00:54:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=91.228.33.36, lip=66.85.158.91, TLS, session=<c6jPUtpFvdVb5CEk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-14 00:56:31 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:44392: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-14 00:56:49 dovecot_login authenticator failed for (201.173.250.36-clientes-izzi.mx) [201.173.250.36]:42075: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.137.70
country_id: 99237
description:
Dec 14 00:58:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=65.20.137.70, lip=66.85.158.91, TLS, session=<Kw8/YtpF9ZBBFIlG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.121.161
country_id: 3865483
description:
Dec 14 00:59:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info>, method=PLAIN, rip=190.181.121.161, lip=66.85.158.91, TLS, session=<GdyCY9pFuZ2+tXmh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-14 01:00:50 dovecot_login authenticator failed for (cm-84.211.11.216.get.no) [84.211.11.216]:39366: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-12-14 01:02:14 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:56194: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-14 01:01:51 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:47584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-14 01:05:07 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:45212: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-14 01:04:46 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:54144: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 01:04:58 host2 sshd[2047489]: Disconnected from invalid user user 2.57.121.25 port 9741 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-14 01:05:39 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:48379: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-14 01:05:55 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:34935: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-14 01:10:54 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:34706: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-14 01:10:58 +0530] info [cpaneld] 197.147.233.193 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-14 01:10:51 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (unbowdous) [73.183.74.177]:48706: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-14 01:15:05 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:38018: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-14 01:15:16 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:55225: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-14 01:19:43 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:55798: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-14 01:20:02 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:38550: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2025-12-14 01:20:26 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:53144: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-14 01:20:41 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:53818: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-14 01:20:59 dovecot_login authenticator failed for (nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:56016: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-14 01:21:21 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:57588: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.145.27
country_id: 290557
description:
2025-12-14 01:21:22 dovecot_login authenticator failed for ([91.74.145.27]) [91.74.145.27]:42674: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.238.221.65
country_id: 3996063
description:
2025-12-14 01:21:37 dovecot_login authenticator failed for ([177.238.221.65]) [177.238.221.65]:48364: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:22:55 host2 sshd[2059834]: Disconnected from invalid user pc 202.184.134.84 port 47312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-14 01:25:22 dovecot_plain authenticator failed for (azizedly) [91.72.153.110]:36809: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:24:43 host2 sshd[2060849]: Disconnected from invalid user appuser 49.49.231.208 port 36174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-14 01:25:11 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:60344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-14 01:25:38 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:53070: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-14 01:26:14 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:37396: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-14 01:25:28 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:10805: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:26:34 host2 sshd[2062130]: Disconnected from invalid user jorge 202.184.134.84 port 50954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:26:56 host2 sshd[2062387]: Disconnected from invalid user zenith 49.49.231.208 port 54158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-14 01:27:01 dovecot_login authenticator failed for (80.130.83.103.static.rapidnet.in) [103.83.130.80]:35257: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:27:17 host2 sshd[2062587]: Disconnected from invalid user ts3 202.184.134.84 port 46650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:28:22 host2 sshd[2063236]: Disconnected from invalid user runner 49.49.231.208 port 50516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.178
country_id: 1643084
description:
Dec 14 01:28:45 host2 sshd[2063466]: Disconnected from invalid user testuser 103.250.11.178 port 49342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:29:39 host2 sshd[2064040]: Disconnected from invalid user dimas 49.49.231.208 port 34022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:31:29 host2 sshd[2065529]: Disconnected from invalid user rfas 202.184.134.84 port 50866 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.11.178
country_id: 1643084
description:
Dec 14 01:30:39 host2 sshd[2065028]: Disconnected from invalid user user002 103.250.11.178 port 33558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:30:55 host2 sshd[2065168]: Disconnected from invalid user ubuntu 49.49.231.208 port 38616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:31:19 host2 sshd[2065449]: Disconnected from invalid user francesco 165.154.200.14 port 42210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-14 01:32:23 dovecot_plain authenticator failed for (manatalize) [105.114.21.51]:51947: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 14 01:33:16 host2 sshd[2066594]: Disconnected from invalid user jenkins 103.117.56.152 port 51438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-14 01:33:37 dovecot_plain authenticator failed for (uithmon) [105.114.21.51]:55394: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-14 01:33:40 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (huthea) [73.0.235.30]:35248: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 14 01:33:51 host2 sshd[2066920]: Disconnected from invalid user francesco 158.174.210.161 port 18730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-14 01:34:00 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (poredis) [73.197.194.98]:43610: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:35:04 host2 sshd[2067782]: Disconnected from invalid user itadmin 202.184.134.84 port 42774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-14 01:35:19 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:36346: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2025-12-14 01:35:48 dovecot_login authenticator failed for (nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:45755: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 14 01:35:57 host2 sshd[2068509]: Disconnected from invalid user jack 158.174.210.161 port 37063 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 14 01:36:34 host2 sshd[2068956]: Disconnected from invalid user yzh 158.174.210.161 port 18342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 14 01:37:45 host2 sshd[2069712]: Disconnected from invalid user admin 158.174.210.161 port 8271 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 14 01:38:16 host2 sshd[2070045]: Disconnected from invalid user monika 103.117.56.152 port 51914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 14 01:39:10 host2 sshd[2070610]: Disconnected from invalid user tpaterni 103.117.56.152 port 41338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 14 01:39:40 host2 sshd[2070883]: Disconnected from invalid user vyos 45.78.224.217 port 35566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-14 01:39:44 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:51951: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
country_id: 1819730
description:
2025-12-14 01:39:33 dovecot_login authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:59265: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 14 01:40:29 host2 sshd[2071652]: Disconnected from invalid user administrator 103.117.56.152 port 35012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-12-14 01:40:33 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:60032: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-14 01:40:57 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:49557: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.200.197
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.202.200.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-14 01:44:16 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:60548: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-14 01:43:40 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:40771: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-14 01:43:56 dovecot_login authenticator failed for ([182.95.58.130]) [182.95.58.130]:57740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.78
country_id: 2542007
description:
2025-12-14 01:43:59 dovecot_login authenticator failed for ([105.73.190.78]) [105.73.190.78]:49819: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:45:04 host2 sshd[2074990]: Disconnected from invalid user jack 165.154.200.14 port 57298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 01:45:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<CgiTCNtFULo+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 01:45:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=</AhPCdtFzr2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2025-12-14 01:45:22 dovecot_login authenticator failed for (2-55-126-88.orange.net.il) [2.55.126.88]:49837: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:45:52 host2 sshd[2075743]: Disconnected from invalid user userftp 165.154.200.14 port 41312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.227
country_id: 3469034
description:
Dec 14 01:45:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=187.120.73.227, lip=66.85.158.91, TLS, session=<yaRpCttF7sK7eEnj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-14 01:46:01 dovecot_login authenticator failed for (cm-84.213.188.130.get.no) [84.213.188.130]:56461: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.141
country_id: 3175395
description:
Dec 14 01:45:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.63.132.141, lip=66.85.158.91, TLS, session=<V9pCCdtFW9K5P4SN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-14 01:45:50 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:37029: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:47:26 host2 sshd[2076824]: Disconnected from invalid user sonarr 83.229.122.23 port 48418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-14 01:47:01 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (anted) [37.150.8.174]:44476: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:47:23 host2 sshd[2076707]: Disconnected from invalid user yzh 165.154.200.14 port 47888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-14 01:48:57 dovecot_plain authenticator failed for (noidic) [5.11.143.72]:49986: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 01:49:08 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (noncruct) [174.166.153.20]:59508: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:48:28 host2 sshd[2077746]: Disconnected from invalid user proxyuser 36.255.66.28 port 55344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:48:53 host2 sshd[2078070]: Disconnected from invalid user ubuntu 165.154.200.14 port 39374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-14 01:50:02 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:40611: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-14 01:49:44 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:40044: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 14 01:49:48 host2 sshd[2078912]: Disconnected from invalid user admin 45.78.224.217 port 41188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:49:53 host2 sshd[2078977]: Disconnected from invalid user es_user 83.229.122.23 port 59492 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-12-14 01:50:34 1vUW6U-00000008j5N-0Er6 <= wordpress@venee.lk U=veneelk P=local S=36240 id=8dG1b2Qbq5zBsJRE4h0dBQEUDSUwKnynDIyyyngE@coatrent.venee.lk T="Failed login by IP 139.59.224.138 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:51:05 host2 sshd[2080418]: Disconnected from invalid user wp 83.229.122.23 port 56412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-14 01:50:44 dovecot_login authenticator failed for (cm-84.215.110.96.get.no) [84.215.110.96]:33172: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-14 01:51:06 dovecot_login authenticator failed for (nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:54320: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:51:39 host2 sshd[2080882]: Disconnected from invalid user www-data 83.229.122.23 port 51922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 14 01:51:44 host2 sshd[2080961]: Disconnected from invalid user www-data 198.245.55.32 port 40616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:51:49 host2 sshd[2081020]: Disconnected from invalid user rajesh 36.255.66.28 port 42810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.202
country_id: 1643084
description:
Dec 14 01:53:12 host2 sshd[2082193]: Disconnected from invalid user webadmin 103.67.78.202 port 52016 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 14 01:53:22 host2 sshd[2082281]: Disconnected from invalid user bpadmin 198.245.55.32 port 39428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 01:52:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<WmfDI9tFSIE+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 14 01:52:49 host2 sshd[2081893]: Disconnected from invalid user ubuntu 198.245.55.32 port 43410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.202
country_id: 1643084
description:
Dec 14 01:53:54 host2 sshd[2082580]: Disconnected from invalid user afa 103.67.78.202 port 53522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.213
country_id: 6252001
description:
Dec 14 01:53:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=198.235.24.213, lip=66.85.158.91, TLS, session=<YERUKNtFiPzG6xjV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 01:54:25 host2 sshd[2083211]: Disconnected from invalid user admin 2.57.121.112 port 22841 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:53:30 host2 sshd[2082330]: Disconnected from invalid user rajesh 83.229.122.23 port 40418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 14 01:53:35 host2 sshd[2082366]: Disconnected from invalid user ftpuser 45.78.224.217 port 40624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:53:41 host2 sshd[2082468]: Disconnected from invalid user admin 36.255.66.28 port 45766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 14 01:53:52 host2 sshd[2082571]: Disconnected from invalid user mailtest 198.245.55.32 port 38408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:54:54 host2 sshd[2083517]: Disconnected from invalid user bpadmin 36.255.66.28 port 54750 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:55:27 host2 sshd[2083933]: Disconnected from invalid user mailtest 36.255.66.28 port 34148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.202
country_id: 1643084
description:
Dec 14 01:55:44 host2 sshd[2084149]: Disconnected from invalid user ceshi 103.67.78.202 port 35636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.202
country_id: 1643084
description:
Dec 14 01:57:31 host2 sshd[2085274]: Disconnected from invalid user admin 103.67.78.202 port 52098 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.83
country_id: 6252001
description:
Dec 14 01:58:48 host2 pure-ftpd[2086121]: (?@198.235.24.83) [INFO] New connection from 198.235.24.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-14 01:59:52 dovecot_login authenticator failed for ([182.95.182.130]) [182.95.182.130]:38358: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-14 02:00:08 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:45237: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-14 02:02:23 dovecot_plain authenticator failed for (overs) [102.53.15.17]:48171: 535 Incorrect authentication data (set_id=service@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-14 02:01:41 dovecot_plain authenticator failed for (urgoiddle) [5.11.140.219]:37282: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 14 02:03:15 host2 sshd[2089293]: Disconnected from invalid user abcd 165.154.97.28 port 35820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-14 02:03:48 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:36656: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-14 02:04:03 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:50466: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.226
country_id: 192950
description:
Dec 14 02:04:21 host2 sshd[2090305]: Disconnected from invalid user me 102.220.23.226 port 38214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Dec 14 02:03:43 host2 sshd[2089839]: Disconnected from invalid user git 187.174.238.116 port 42136 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.174.238.116
country_id: 3996063
description:
Dec 14 02:04:52 host2 sshd[2090650]: Disconnected from invalid user lisi 187.174.238.116 port 38480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 02:04:28 host2 sshd[2090385]: Disconnected from invalid user admin 2.57.121.112 port 22455 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 14 02:06:30 host2 sshd[2092147]: Disconnected from invalid user admin 182.93.7.194 port 62034 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.48
country_id: 6252001
description:
Dec 14 02:07:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.48, lip=66.85.158.91, TLS, session=<tJ8AV9tFdPKTuYQw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.234
country_id: 6252001
description:
Dec 14 02:07:25 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.234, lip=66.85.158.91, TLS, session=<oMp9WNtFeodHBobq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.226
country_id: 192950
description:
Dec 14 02:07:49 host2 sshd[2093472]: Disconnected from invalid user vpn 102.220.23.226 port 51328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Dec 14 02:07:58 host2 sshd[2093610]: Disconnected from invalid user student 78.187.21.105 port 46538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-14 02:08:27 dovecot_login authenticator failed for 94-255-255-26.cust.bredband2.com [94.255.255.26]:34612: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.226
country_id: 192950
description:
Dec 14 02:08:28 host2 sshd[2094080]: Disconnected from invalid user tunnel 102.220.23.226 port 37012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 14 02:08:54 host2 sshd[2094616]: Disconnected from invalid user zjh 182.93.7.194 port 42960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec 14 02:09:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Ty0xX9tFVNaTuYRC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-12-14 02:08:30 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:42454: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-14 02:08:38 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:37757: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-12-14 02:08:51 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:56069: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Dec 14 02:09:33 host2 sshd[2095286]: Disconnected from invalid user slurm 78.187.21.105 port 58238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-14 02:09:36 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:62613: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-14 02:09:49 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:55991: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-12-14 02:10:59 1vUWQF-00000008nTd-0BTI <= wordpress@venee.lk U=veneelk P=local S=36243 id=zIEs8pHzTmUsbRIjGRwZycW3kfnjjWLfLqppsg50s@coatrent.venee.lk T="Failed login by IP 139.59.224.138 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-14 02:10:33 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:35340: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 14 02:10:46 host2 sshd[2096631]: Disconnected from invalid user gitlab-runner 165.154.97.28 port 48844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.187.21.105
country_id: 298795
description:
Dec 14 02:11:11 host2 sshd[2097045]: Disconnected from invalid user zjh 78.187.21.105 port 38448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-14 02:11:15 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:48278: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 14 02:11:24 host2 sshd[2097229]: Disconnected from invalid user s3 182.93.7.194 port 44196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 14 02:11:45 host2 sshd[2097526]: Disconnected from invalid user deposito 165.154.97.28 port 48308 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 78.187.21.105
country_id: 298795
description:
Dec 14 02:11:46 host2 sshd[2097535]: Received disconnect from 78.187.21.105 port 42820:11: Bye Bye [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 02:12:39 host2 sshd[2098394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.22
country_id: 6252001
description:
2025-12-14 02:14:14 dovecot_login authenticator failed for ([98.181.44.22]) [98.181.44.22]:60672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-14 02:14:57 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:55106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-12-14 02:15:07 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:35416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 14 02:15:36 host2 sshd[2100436]: Disconnected from invalid user test 165.154.97.28 port 49786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.20
country_id: 1733045
description:
2025-12-14 02:15:52 dovecot_login authenticator failed for ([49.124.151.20]) [49.124.151.20]:44952: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 02:16:30 host2 sshd[2100883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:17:12 host2 sshd[2101233]: Disconnected from invalid user wanda 107.174.67.188 port 54204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 14 02:19:06 host2 sshd[2102255]: Disconnected from invalid user tunnel 182.93.7.194 port 46114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:19:13 host2 sshd[2102313]: Disconnected from invalid user email 107.174.67.188 port 47220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 14 02:18:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<i+5hgdtFls9og7HN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 14 02:20:21 host2 sshd[2103100]: Disconnected from invalid user dockeradmin 43.245.97.82 port 54790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:21:11 host2 sshd[2103581]: Disconnected from invalid user git2 107.174.67.188 port 36294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:22:11 host2 sshd[2104140]: Disconnected from invalid user mike 107.174.67.188 port 32964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:24:13 host2 sshd[2105436]: Disconnected from invalid user sammy 107.174.67.188 port 59274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-14 02:24:20 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:50398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Dec 14 02:24:25 host2 sshd[2105533]: Disconnected from invalid user jenkins 202.8.127.134 port 47266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 14 02:23:53 host2 sshd[2105127]: Disconnected from invalid user zhangbin 43.245.97.82 port 60926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 14 02:24:29 host2 sshd[2105555]: Disconnected from invalid user bank 43.245.97.82 port 44826 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.81.42
country_id: 2542007
description:
2025-12-14 02:24:54 dovecot_login authenticator failed for ([105.73.81.42]) [105.73.81.42]:52303: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 14 02:25:39 host2 sshd[2106398]: Disconnected from invalid user dima 43.245.97.82 port 40874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Dec 14 02:26:06 host2 sshd[2106644]: Disconnected from invalid user user 202.8.127.134 port 46624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-14 02:26:11 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (solosin) [174.58.87.108]:55578: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 14 02:27:10 host2 sshd[2107229]: Disconnected from invalid user ubuntu 103.179.56.78 port 42412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-14 02:28:25 dovecot_login authenticator failed for ([177.239.160.152]) [177.239.160.152]:42470: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.8.127.134
country_id: 1269750
description:
Dec 14 02:28:34 host2 sshd[2108214]: Disconnected from invalid user zhaomin 202.8.127.134 port 39162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-14 02:28:44 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (trils) [24.23.125.83]:33070: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2025-12-14 02:28:46 dovecot_login authenticator failed for ([87.200.94.102]) [87.200.94.102]:39974: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 14 02:28:50 host2 sshd[2108450]: Disconnected from invalid user mobile 103.179.56.78 port 44506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 02:31:28 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53818: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 14 02:31:17 host2 sshd[2110180]: Disconnected from invalid user frontend 103.179.56.78 port 37744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-14 02:31:34 dovecot_plain authenticator failed for (theruns) [65.20.164.137]:55224: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-14 02:33:16 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:62301: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-14 02:32:58 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:39115: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-14 02:33:37 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:34082: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-14 02:34:20 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:53732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-14 02:34:44 dovecot_login authenticator failed for 109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:59386: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2025-12-14 02:38:50 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:47883: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-14 02:39:09 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:56092: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 02:41:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<V8PU0NtFdM0+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.88
country_id: 6252001
description:
Dec 14 02:41:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.88, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Zj1h0ttFLd7N0h9Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-14 02:43:20 dovecot_plain authenticator failed for (notics) [96.85.104.2]:33114: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 02:44:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EWob3dtFytunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 02:46:54 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (chury) [51.195.117.220]:23611: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-14 02:47:36 dovecot_plain authenticator failed for (catax) [65.20.250.163]:53626: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-14 02:49:05 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:38074: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 02:49:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<QT1E7ttFKNU+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.169
country_id: 1733045
description:
2025-12-14 02:49:23 dovecot_login authenticator failed for ([49.124.154.169]) [49.124.154.169]:39134: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 14 02:50:25 host2 sshd[2123694]: Disconnected from invalid user administrator 89.126.208.241 port 40634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.97.111
country_id: 3469034
description:
Dec 14 02:52:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=186.224.97.111, lip=66.85.158.91, TLS, session=<tNvQ99tFUuS64GFv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-14 02:53:07 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:39652: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.113
country_id: 1733045
description:
2025-12-14 02:53:14 dovecot_login authenticator failed for ([49.124.147.113]) [49.124.147.113]:58432: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-14 02:52:35 dovecot_login authenticator failed for (dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:56920: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.126
country_id: 3175395
description:
Dec 14 02:52:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.126, lip=66.85.158.91, TLS, session=<nKX/+NtFFYK5D6l+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-14 02:52:47 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:56460: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-14 02:52:51 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:52324: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-14 02:52:54 dovecot_login authenticator failed for (cm-84.211.11.216.get.no) [84.211.11.216]:43593: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-14 02:53:52 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (flaters) [73.224.171.101]:46082: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 14 02:54:24 host2 sshd[2126481]: Disconnected from invalid user user01 89.126.208.241 port 48614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 14 02:55:41 host2 sshd[2127527]: Disconnected from invalid user github 89.126.208.241 port 45210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 02:57:37 host2 sshd[2128641]: Disconnected from invalid user deploy 58.98.199.45 port 56482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.222
country_id: 6252001
description:
2025-12-14 02:58:07 dovecot_login authenticator failed for wsip-184-191-242-222.fv.ks.cox.net [184.191.242.222]:44672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-14 02:59:08 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:60149: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.70.118
country_id: 1168579
description:
2025-12-14 02:58:45 dovecot_login authenticator failed for ([115.42.70.118]) [115.42.70.118]:38760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 02:58:56 host2 sshd[2129463]: Disconnected from invalid user upload 58.98.199.45 port 47366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.66
country_id: 1733045
description:
2025-12-14 03:00:06 dovecot_login authenticator failed for ([49.125.201.66]) [49.125.201.66]:48080: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 03:01:25 host2 sshd[2131138]: Disconnected from invalid user devops 58.98.199.45 port 56144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Dec 14 03:04:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<7+//I9xFGqWnXpI8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-14 03:03:52 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:39438: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-14 03:04:17 dovecot_login authenticator failed for ([125.16.246.121]) [182.95.63.50]:57864: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-14 03:04:35 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:59681: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.50
country_id: 1269750
description:
2025-12-14 03:04:51 dovecot_login authenticator failed for ([128.185.212.50]) [128.185.212.50]:58598: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 03:05:04 host2 sshd[2133698]: Disconnected from invalid user astra 58.98.199.45 port 50353 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 03:06:12 host2 sshd[2134393]: Disconnected from invalid user user 58.98.199.45 port 34181 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.20
country_id: 953987
description:
Dec 14 03:08:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.64.32.20, lip=66.85.158.91, TLS, session=<AvtiMdxFl79mQCAU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-14 03:08:37 dovecot_plain authenticator failed for (uniter) [109.226.14.93]:35520: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.139
country_id: 798544
description:
Dec 14 03:08:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=178.216.31.139, lip=66.85.158.91, TLS, session=<ERiRMtxFR4Sy2B+L>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 67.217.228.97
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 67.217.228.97: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-14 03:10:47 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (unnia) [217.215.74.195]:58328: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.248
country_id: 1733045
description:
2025-12-14 03:14:36 dovecot_login authenticator failed for ([49.124.152.248]) [49.124.152.248]:36046: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-14 03:14:50 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:53724: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.48.148.89
country_id: 357994
description:
2025-12-14 03:17:21 dovecot_plain authenticator failed for (6MB1PQ8V7O8RZW8) [197.48.148.89]:60878: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.108
country_id: 3175395
description:
Dec 14 03:19:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.15.170.108, lip=66.85.158.91, TLS, session=<I2l7V9xFH+O5D6ps>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.193.236
country_id: 3865483
description:
Dec 14 03:19:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.96.193.236, lip=66.85.158.91, TLS, session=<dtqgWNxFwY26YMHs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.65
country_id: 2510769
description:
Dec 14 03:21:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=139.28.190.65, lip=66.85.158.91, TLS, session=<2xCdX9xFHK2LHL5B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.243.38.183
country_id: 3469034
description:
Dec 14 03:21:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=191.243.38.183, lip=66.85.158.91, TLS, session=<xBQLYdxFFee/8ya3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.154
country_id: 1733045
description:
2025-12-14 03:23:16 dovecot_login authenticator failed for ([49.124.155.154]) [49.124.155.154]:55662: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-14 03:23:20 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:34119: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-14 03:23:38 dovecot_login authenticator failed for ([182.95.20.115]) [182.95.229.142]:38450: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-14 03:23:47 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:34674: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-14 03:24:50 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:43000: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-14 03:25:15 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:50986: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 03:25:36 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (chnish) [51.195.117.220]:39741: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-14 03:26:37 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:57389: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-12-14 03:27:07 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:9157: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-12-14 03:27:44 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:48415: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-14 03:29:10 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:35432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2025-12-14 03:29:25 dovecot_login authenticator failed for (nsg-corporate-250.250.187.122.airtel.in) [122.187.250.250]:35954: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2025-12-14 03:29:49 dovecot_login authenticator failed for ([103.79.237.54]) [103.79.237.54]:55166: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-14 03:30:02 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:56042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 14 03:31:18 host2 sshd[2153031]: Disconnected from invalid user ftpuser 165.227.3.79 port 41313 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 03:32:10 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (metrilizi) [51.195.117.220]:59147: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:33:07 host2 sshd[2154153]: Disconnected from invalid user tomas 98.213.142.168 port 42192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 14 03:32:50 host2 sshd[2153972]: Disconnected from invalid user fivem 103.160.212.122 port 44762 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 14 03:33:48 host2 sshd[2154604]: Disconnected from invalid user administrador 165.227.3.79 port 42838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Dec 14 03:34:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<HaJgjtxFoGWnXpI1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.73
country_id: 6252001
description:
Dec 14 03:34:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.73, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0JjDjtxFIsOTuYRJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.104.32
country_id: 3175395
description:
Dec 14 03:33:42 host2 sshd[2154535]: Disconnected from invalid user deploy 151.19.104.32 port 50192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 2921044
description:
Dec 14 03:33:46 host2 sshd[2154572]: Disconnected from invalid user fivem 144.31.126.21 port 56822 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 14 03:34:18 host2 sshd[2154864]: Received disconnect from 165.227.3.79 port 48809:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.104.32
country_id: 3175395
description:
Dec 14 03:34:33 host2 sshd[2154983]: Disconnected from invalid user test 151.19.104.32 port 50151 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.52
country_id: 1605651
description:
Dec 14 03:34:14 host2 sshd[2154807]: Disconnected from invalid user es1 110.78.149.52 port 47880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.52
country_id: 1605651
description:
Dec 14 03:35:40 host2 sshd[2155931]: Disconnected from invalid user abc 110.78.149.52 port 40042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.78.237
country_id: 1282988
description:
Dec 14 03:35:44 host2 sshd[2155962]: Disconnected from invalid user igor 202.70.78.237 port 17648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:35:47 host2 sshd[2156022]: Disconnected from invalid user ubuntu 98.213.142.168 port 46348 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 03:35:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<eyMPldxFOs0+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.104.32
country_id: 3175395
description:
Dec 14 03:36:36 host2 sshd[2156513]: Disconnected from invalid user testuser 151.19.104.32 port 50030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 14 03:36:46 host2 sshd[2156597]: Disconnected from invalid user developer1 34.91.0.68 port 54076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:36:49 host2 sshd[2156644]: Disconnected from invalid user fivem 98.213.142.168 port 51406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.24
country_id: 1733045
description:
2025-12-14 03:36:52 dovecot_login authenticator failed for ([49.124.153.24]) [49.124.153.24]:53350: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.78.149.52
country_id: 1605651
description:
Dec 14 03:36:18 host2 sshd[2156342]: Disconnected from invalid user xq 110.78.149.52 port 48054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.111
country_id: 6252001
description:
2025-12-14 03:36:12 dovecot_login authenticator failed for wsip-184-191-250-111.fv.ks.cox.net [184.191.250.111]:52107: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 2921044
description:
Dec 14 03:37:30 host2 sshd[2157195]: Disconnected from invalid user student3 144.31.126.21 port 54094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-14 03:37:46 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:53398: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:37:51 host2 sshd[2157455]: Disconnected from invalid user testuser 98.213.142.168 port 49684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 14 03:38:51 host2 sshd[2158335]: Disconnected from invalid user asdf 34.91.0.68 port 37338 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 144.31.126.21
country_id: 2921044
description:
Dec 14 03:39:02 host2 sshd[2158436]: Received disconnect from 144.31.126.21 port 54466:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-14 03:38:50 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:58168: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.52
country_id: 1605651
description:
Dec 14 03:38:19 host2 sshd[2157793]: Disconnected from invalid user serv 110.78.149.52 port 34746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:38:22 host2 sshd[2157831]: Disconnected from invalid user administrator 98.213.142.168 port 39480 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 03:39:14 host2 sshd[2158655]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-14 03:39:24 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:47175: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 03:40:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<FSs+pdxF1r4+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-14 03:42:28 dovecot_login authenticator failed for ([182.79.136.105]) [122.187.60.126]:52462: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 14 03:42:37 host2 sshd[2160773]: Disconnected from invalid user wan 34.91.0.68 port 51510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-14 03:42:47 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:45459: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 14 03:43:37 host2 sshd[2161505]: Disconnected from invalid user frappe 34.91.0.68 port 51524 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-14 03:43:46 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (gredgic) [98.227.25.115]:58056: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 14 03:44:32 host2 pure-ftpd[2162289]: (?@66.132.153.116) [INFO] New connection from 66.132.153.116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 14 03:44:45 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, session=<YYmhtNxFnnFChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-14 03:44:47 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (distion) [73.68.220.15]:45994: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-12-14 03:47:34 dovecot_login authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:36174: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 03:47:50 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (suphea) [51.195.117.220]:46780: 535 Incorrect authentication data (set_id=test@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-14 03:48:02 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:60354: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-14 03:47:18 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:54203: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2025-12-14 03:47:32 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:8215: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-14 03:48:14 dovecot_login authenticator failed for (cm-84.213.189.183.get.no) [84.213.189.183]:53653: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-14 03:48:35 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (gostage) [71.235.225.181]:59974: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-14 03:49:48 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (tiouse) [98.204.134.124]:46608: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.74
country_id: 933860
description:
Dec 14 03:51:47 host2 sshd[2168628]: Disconnected from invalid user user 168.167.228.74 port 33123 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-14 03:53:05 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:52479: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-14 03:52:26 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:50536: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Dec 14 03:52:28 host2 sshd[2169087]: Disconnected from invalid user filippo 168.167.228.74 port 33124 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-14 03:52:55 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:57136: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-14 03:53:25 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:43844: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-14 03:53:46 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (albetritte) [68.83.181.181]:38410: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.206.145
country_id: 2921044
description:
Dec 14 03:53:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=161.35.206.145, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<aXjW1NxFebChI86R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.29.119
country_id: 2921044
description:
Dec 14 03:54:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.29.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<i+Lv1txFEPqd5h13>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.34
country_id: 6252001
description:
2025-12-14 03:57:54 dovecot_login authenticator failed for wsip-184-191-250-34.fv.ks.cox.net [184.191.250.34]:45115: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-14 03:58:22 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:58558: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 03:58:36 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (otermite) [73.208.81.125]:37686: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 03:59:13 host2 sshd[2174295]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-14 04:02:00 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:48013: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 04:03:02 host2 sshd[2177335]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.229
country_id: 6252001
description:
2025-12-14 04:02:12 dovecot_login authenticator failed for wsip-184-191-242-229.fv.ks.cox.net [184.191.242.229]:54958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-14 04:04:37 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (hacklar) [73.195.211.98]:44160: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.207.63.102
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.207.63.102 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.224.69.7
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.224.69.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.92.140.213
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 143.92.140.213 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.106.89.244
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.106.89.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.191.76.34
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 190.191.76.34 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.190.22.129
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 101.190.22.129 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.169.252.72
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.169.252.72 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-14 04:06:46 dovecot_login authenticator failed for ([182.79.87.18]) [182.79.87.18]:43812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-12-14 04:06:22 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:56668: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-14 04:06:31 dovecot_plain authenticator failed for (fulgrewed) [5.11.141.74]:57692: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-14 04:06:42 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (ophiete) [174.161.27.82]:60720: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-14 04:10:11 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (reedist) [68.46.148.180]:49738: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-12-14 04:10:47 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:56663: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.37.48.116
country_id: 3865483
description:
2025-12-14 04:10:48 dovecot_plain authenticator failed for ([31.57.166.48]) [179.37.48.116]:53648: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-14 04:11:02 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:35656: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.55.159.90
country_id: 3469034
description:
2025-12-14 04:11:01 dovecot_plain authenticator failed for ([31.57.166.48]) [177.55.159.90]:34129: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-12-14 04:11:11 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:38034: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.179.131
country_id: 3996063
description:
2025-12-14 04:11:12 dovecot_plain authenticator failed for ([31.57.166.48]) [98.97.179.131]:6343: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-14 04:11:26 dovecot_login authenticator failed for (nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:33064: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-14 04:12:51 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:57463: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.17
country_id: 6252001
description:
2025-12-14 04:12:25 dovecot_login authenticator failed for ([98.181.44.17]) [98.181.44.17]:56833: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-14 04:14:20 dovecot_login authenticator failed for (7g75xw) [69.5.189.21]:54635: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 04:15:12 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (forhary) [73.208.81.125]:57240: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-14 04:16:13 dovecot_login authenticator failed for (9CBuIsZEAG) [69.5.189.21]:63506: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-14 04:16:17 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (proost) [73.129.57.71]:57570: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-14 04:16:37 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3789: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.32
country_id: 1733045
description:
2025-12-14 04:16:58 dovecot_login authenticator failed for ([49.124.151.32]) [49.124.151.32]:54128: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.128
country_id: 6252001
description:
2025-12-14 04:17:47 dovecot_login authenticator failed for wsip-184-191-250-128.fv.ks.cox.net [184.191.250.128]:37211: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-14 04:17:58 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:59041: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 14 04:19:42 host2 sshd[2193984]: Disconnected from invalid user it 36.64.68.99 port 54136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-14 04:20:59 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:38542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.81.42
country_id: 2542007
description:
2025-12-14 04:20:48 dovecot_login authenticator failed for ([105.73.81.42]) [105.73.81.42]:33941: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 14 04:22:41 host2 sshd[2196262]: Disconnected from invalid user dev 196.204.240.61 port 55564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 14 04:23:52 host2 sshd[2197298]: Disconnected from invalid user nexus 196.204.240.61 port 38302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 14 04:24:02 host2 sshd[2197428]: Disconnected from invalid user factorio 36.64.68.99 port 49672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 1861060
description:
Dec 14 04:24:17 host2 sshd[2197729]: Disconnected from invalid user admin 203.189.233.12 port 52794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 1861060
description:
Dec 14 04:25:21 host2 sshd[2199233]: Disconnected from invalid user dev 203.189.233.12 port 55894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.189.233.12
country_id: 1861060
description:
Dec 14 04:25:53 host2 sshd[2199714]: Disconnected from invalid user wp 203.189.233.12 port 51696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 14 04:26:04 host2 sshd[2199994]: Disconnected from invalid user newftpuser 36.64.68.99 port 39746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 1861060
description:
Dec 14 04:26:24 host2 sshd[2200471]: Disconnected from invalid user proxyuser 203.189.233.12 port 44212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-14 04:27:07 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:33643: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 14 04:27:23 host2 sshd[2201448]: Disconnected from invalid user admin1 36.64.68.99 port 49812 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.44
country_id: 1733045
description:
2025-12-14 04:27:24 dovecot_login authenticator failed for ([49.124.153.44]) [49.124.153.44]:34532: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 196.204.240.61
country_id: 357994
description:
Dec 14 04:28:53 host2 sshd[2203160]: Received disconnect from 196.204.240.61 port 59014:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 14 04:28:53 host2 sshd[2203160]: Disconnected from invalid user home 196.204.240.61 port 59014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-14 04:30:49 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:43542: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-14 04:30:30 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:40153: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 04:30:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<f8IwWd1Ffos+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.131.111.33
country_id: 290291
description:
2025-12-14 04:31:52 dovecot_plain authenticator failed for ([31.57.166.48]) [37.131.111.33]:31375: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 04:31:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<o4oiXd1FkqA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.111.175.141
country_id: 2635167
description:
2025-12-14 04:31:58 dovecot_plain authenticator failed for ([31.57.166.48]) [185.111.175.141]:62478: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.108.141
country_id: 2017370
description:
2025-12-14 04:32:00 dovecot_plain authenticator failed for ([31.57.166.48]) [146.158.108.141]:48742: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.23.55.24
country_id: 6252001
description:
2025-12-14 04:31:48 dovecot_plain authenticator failed for 184-23-55-24.fiber.dynamic.sonic.net ([31.57.166.48]) [184.23.55.24]:57044: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.255.77.51
country_id: 3469034
description:
2025-12-14 04:31:50 dovecot_plain authenticator failed for ([31.57.166.48]) [138.255.77.51]:21314: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.36.212
country_id: 3469034
description:
2025-12-14 04:32:02 dovecot_plain authenticator failed for ([31.57.166.48]) [45.226.36.212]:10757: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.62.177.128
country_id: 6252001
description:
2025-12-14 04:31:48 dovecot_plain authenticator failed for c-73-62-177-128.hsd1.mn.comcast.net ([31.57.166.48]) [73.62.177.128]:41506: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.253.131.168
country_id: 6252001
description:
2025-12-14 04:32:03 dovecot_plain authenticator failed for ([31.57.166.48]) [67.253.131.168]:46738: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.20.166.128
country_id: 3865483
description:
2025-12-14 04:32:10 dovecot_plain authenticator failed for ([31.57.166.48]) [181.20.166.128]:38459: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.224.184.136
country_id: 3865483
description:
2025-12-14 04:32:14 dovecot_plain authenticator failed for ([31.57.166.48]) [181.224.184.136]:52098: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 04:32:15 host2 sshd[2206743]: Disconnected from invalid user user 2.57.121.25 port 44672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec 14 04:33:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.91, session=<OAcAYt1Fsv8t4/6b>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.33.49
country_id: 2921044
description:
Dec 14 04:33:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=104.248.33.49, lip=66.85.158.91, session=<ZEBMZN1FQRlo+CEx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.29.119
country_id: 2921044
description:
Dec 14 04:33:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.29.119, lip=66.85.158.91, session=<W6RRZN1FvsKd5h13>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-14 04:35:59 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [136.232.73.130]:40434: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 04:36:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<YkPha91FnpynrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-14 04:35:10 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:32816: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-14 04:35:25 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:40118: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-14 04:35:45 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:55864: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-14 04:36:20 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:52496: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-14 04:36:46 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:50648: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.12
country_id: 6252001
description:
Dec 14 04:37:14 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.12, lip=66.85.158.91, session=<IulHcN1FLJKsaYAM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-14 04:40:47 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:43449: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.157
country_id: 3996063
description:
2025-12-14 04:41:00 dovecot_login authenticator failed for (187.161.222.157-clientes-izzi.mx) [187.161.222.157]:37954: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-14 04:41:15 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:47305: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-14 04:41:21 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:54575: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-14 04:41:50 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:60166: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-14 04:42:18 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:56711: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 04:42:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<wZHYg91FZOI+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 04:44:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<9pW1id1Fqtw+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-14 04:46:30 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:54248: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-12-14 04:50:46 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:51194: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-14 04:51:31 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:35024: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.216
country_id: 6252001
description:
Dec 14 04:51:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.216, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<umrdo91FptXN0h/Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.142.46.185
country_id: 3017382
description:
Dec 14 04:53:29 host2 sshd[2224824]: Disconnected from invalid user admin 88.142.46.185 port 53456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.111
country_id: 3469034
description:
Dec 14 04:53:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=191.240.36.111, lip=66.85.158.91, TLS, session=<XC5+qd1FlNC/8CRv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.198.62
country_id: 3865483
description:
Dec 14 04:53:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=181.225.198.62, lip=66.85.158.91, TLS, session=<gQi5qt1FscW14cY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.81
country_id: 3996063
description:
2025-12-14 04:54:20 dovecot_login authenticator failed for ([177.236.144.81]) [177.236.144.81]:45371: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-14 04:54:41 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:38086: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.142.46.185
country_id: 3017382
description:
Dec 14 04:54:59 host2 sshd[2226528]: Disconnected from invalid user ankit 88.142.46.185 port 34122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.142.46.185
country_id: 3017382
description:
Dec 14 04:56:30 host2 sshd[2227983]: Disconnected from invalid user sa 88.142.46.185 port 43026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.142.46.185
country_id: 3017382
description:
Dec 14 04:57:32 host2 sshd[2228570]: Disconnected from invalid user deploy 88.142.46.185 port 39548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2025-12-14 04:58:52 dovecot_plain authenticator failed for c-73-21-28-14.hsd1.ga.comcast.net (lorgizes) [73.21.28.14]:35148: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-14 04:58:56 dovecot_plain authenticator failed for (pired) [94.201.22.158]:34804: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-14 04:59:41 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:50066: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-14 05:00:01 dovecot_plain authenticator failed for (difies) [102.53.15.180]:56750: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-14 05:00:05 dovecot_login authenticator failed for ([122.184.124.46]) [122.184.124.46]:49824: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2025-12-14 04:59:19 dovecot_login authenticator failed for ([49.124.151.71]) [49.124.151.71]:34258: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.211
country_id: 1733045
description:
2025-12-14 05:00:42 dovecot_login authenticator failed for ([49.124.152.211]) [49.124.152.211]:57806: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-14 05:02:02 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:49443: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2025-12-14 05:02:20 dovecot_plain authenticator failed for cm-72-241-202-104.buckeyecom.net (banty) [72.241.202.104]:44761: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-14 05:02:19 dovecot_login authenticator failed for ([85.19.195.12]) [85.19.195.12]:35666: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 05:03:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<CMxXz91FkJc+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.196.214
country_id: 3144096
description:
2025-12-14 05:05:02 dovecot_login authenticator failed for (cm-178.232.196.214.get.no) [178.232.196.214]:36170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Dec 14 05:05:04 host2 sshd[2237386]: Disconnected from invalid user test1 43.163.123.45 port 52458 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-14 05:05:29 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:55068: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-14 05:05:59 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:39066: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 05:05:25 host2 sshd[2237710]: Disconnected from invalid user admin 2.57.121.112 port 45990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-14 05:06:16 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:57278: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Dec 14 05:07:22 host2 sshd[2239150]: Disconnected from invalid user stp 43.163.123.45 port 45528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 14 05:07:56 host2 sshd[2239469]: Disconnected from invalid user test 160.242.96.43 port 58224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.191
country_id: 2750405
description:
2025-12-14 05:08:51 dovecot_login authenticator failed for (oOyiFXX5ey) [178.16.54.191]:51334: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.191
country_id: 2750405
description:
2025-12-14 05:09:21 dovecot_login authenticator failed for (XlHb4B7) [178.16.54.191]:52211: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.133
country_id: 2300660
description:
Dec 14 05:09:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=41.139.47.133, lip=66.85.158.91, TLS, session=<7Ch14t1FRLwpiy+F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.223.250.133
country_id: 2395170
description:
Dec 14 05:09:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=41.223.250.133, lip=66.85.158.91, TLS, session=<UW7E491F39Up3/qF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 14 05:10:04 host2 sshd[2241029]: Disconnected from invalid user certbot 160.242.96.43 port 46378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 05:10:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<v2mm591FaJw+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 14 05:10:45 host2 sshd[2241807]: Disconnected from invalid user mike 160.242.96.43 port 57616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-12-14 05:10:51 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:52238: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-14 05:10:20 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:50752: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Dec 14 05:10:21 host2 sshd[2241510]: Disconnected from invalid user guest 43.163.123.45 port 50994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.191
country_id: 2750405
description:
2025-12-14 05:12:05 dovecot_login authenticator failed for (ncrLd3w) [178.16.54.191]:56444: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.101
country_id: 6252001
description:
Dec 14 05:14:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.101, lip=66.85.158.92, session=<XUUG9d1F6JQs3Lll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-14 05:15:37 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:45270: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.75
country_id: 6252001
description:
Dec 14 05:15:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=98.80.4.75, lip=66.85.158.92, TLS handshaking: Connection closed, session=<54h0+t1FmsViUARL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-14 05:15:59 dovecot_login authenticator failed for ([102.38.3.179]) [102.38.3.179]:42672: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-14 05:16:20 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (pyron) [73.197.194.98]:49100: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 05:18:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<0aicAt5F6NCB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.236
country_id: 1733045
description:
2025-12-14 05:19:25 dovecot_login authenticator failed for ([183.171.53.236]) [183.171.53.236]:48844: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-14 05:19:39 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:41405: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.221
country_id: 3469034
description:
Dec 14 05:19:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=187.120.76.221, lip=66.85.158.91, TLS, session=<Xln7B95F9qG7eEzd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.22.151.143
country_id: 2802361
description:
Dec 14 05:19:24 host2 pure-ftpd[2248412]: (?@34.22.151.143) [INFO] New connection from 34.22.151.143


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.133
country_id: 3175395
description:
Dec 14 05:20:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.124.182.133, lip=66.85.158.91, TLS, session=<4dwjCd5Fcs25fLaF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.250.27.151
country_id: 3077311
description:
Dec 14 05:22:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=80.250.27.151, lip=66.85.158.91, TLS, session=<cHfnD95FYNNQ+huX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.152
country_id: 3865483
description:
Dec 14 05:22:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=190.122.133.152, lip=66.85.158.91, TLS, session=<InAuEd5FO+a+eoWY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 05:24:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<1PXPF95Fjpc+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-14 05:23:55 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:54936: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-12-14 05:24:06 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:40668: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.115
country_id: 1733045
description:
2025-12-14 05:24:15 dovecot_login authenticator failed for ([49.124.147.115]) [49.124.147.115]:55904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-14 05:24:24 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:52073: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-14 05:25:14 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:33606: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-14 05:25:30 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:39449: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.59
country_id: 1733045
description:
2025-12-14 05:27:48 dovecot_login authenticator failed for ([49.124.153.59]) [49.124.153.59]:42916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-14 05:28:00 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:58414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 05:27:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<wJMGI95FIoU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-12-14 05:27:16 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:56061: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-12-14 05:27:27 dovecot_login authenticator failed for ([61.246.205.1]) [125.19.218.2]:53240: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-12-14 05:28:23 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:52892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-12-14 05:29:54 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:48335: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.113
country_id: 2542007
description:
2025-12-14 05:30:27 dovecot_login authenticator failed for ([105.73.203.113]) [105.73.203.113]:60455: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-14 05:30:52 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:52822: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-14 05:30:52 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:52478: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-14 05:31:05 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:45090: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-14 05:31:28 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:40898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-14 05:33:09 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54798: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-14 05:33:23 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:41518: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 05:33:55 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (prazedwirs) [96.230.65.90]:51380: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-14 05:38:41 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:47889: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.148
country_id: 6252001
description:
2025-12-14 05:39:01 dovecot_login authenticator failed for ([70.174.167.148]) [70.174.167.148]:55192: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.20
country_id: 6252001
description:
2025-12-14 05:39:45 dovecot_login authenticator failed for ([98.181.44.20]) [98.181.44.20]:46428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-14 05:39:47 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (hurigifies) [174.58.87.108]:40104: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-14 05:40:01 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:39079: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-14 05:43:03 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:61978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-12-14 05:42:41 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:41714: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-14 05:43:38 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:54382: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-12-14 05:43:58 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:50269: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 05:45:23 host2 sshd[2267619]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2025-12-14 05:48:46 dovecot_login authenticator failed for ([49.124.151.71]) [49.124.151.71]:36078: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-12-14 05:48:58 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:54939: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-14 05:49:03 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:59706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-14 05:48:22 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:47838: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-14 05:48:43 dovecot_login authenticator failed for ([122.184.136.185]) [182.95.181.22]:39312: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 05:48:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<T6Hlb95FNOE+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 05:49:13 host2 sshd[2270159]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 14 05:50:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=</sh2d95Fvt/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2025-12-14 05:54:10 dovecot_login authenticator failed for ([125.19.159.186]) [125.19.159.186]:55966: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-14 05:54:40 dovecot_login authenticator failed for ([14.195.19.75]) [14.195.19.75]:38942: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-14 05:54:46 dovecot_login authenticator failed for (cm-84.211.6.119.get.no) [84.211.6.119]:52365: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-14 05:54:57 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:43160: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-14 05:58:47 dovecot_login authenticator failed for (cm-84.214.63.110.get.no) [84.214.63.110]:55489: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-14 05:59:06 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (glexosper) [174.169.224.27]:38012: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-14 05:58:15 dovecot_login authenticator failed for (cm-178.232.221.194.get.no) [178.232.221.194]:56594: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 06:03:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<MZikpN5FDsM+PIdg>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 208.103.231.222
country_id: 6251999
description:
Dec 14 06:03:35 host2 sshd[2280237]: Disconnecting authenticating user root 208.103.231.222 port 47704: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 208.103.231.222
country_id: 6251999
description:
Dec 14 06:03:35 host2 sshd[2280237]: error: maximum authentication attempts exceeded for root from 208.103.231.222 port 47704 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-14 06:04:38 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:57730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-14 06:04:52 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:60377: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-14 06:07:11 dovecot_plain authenticator failed for (swity) [96.85.104.2]:34930: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 06:07:15 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (undrous) [51.195.117.220]:20130: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-14 06:07:54 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:39596: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-14 06:08:25 dovecot_plain authenticator failed for (petrostos) [187.161.198.68]:57553: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-14 06:08:34 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:46606: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 06:09:29 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (nuodowy) [73.208.81.125]:58154: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-14 06:09:45 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:54360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-14 06:10:14 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:55855: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 14 06:11:55 host2 sshd[2286095]: Disconnected from invalid user stud1 103.100.208.88 port 55053 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 14 06:12:07 host2 sshd[2286235]: Disconnected from invalid user eacadm 45.197.145.10 port 33842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.144.177.200
country_id: 6252001
description:
Dec 14 06:12:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.144.177.200, lip=66.85.158.92, TLS: Connection closed, session=<VlU5xN5FxsASkLHI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-12-14 06:12:59 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:50293: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-14 06:13:15 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:57641: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 14 06:13:22 host2 sshd[2287212]: Disconnected from invalid user abhi 103.100.208.88 port 40094 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.246.109
country_id: 6252001
description:
Dec 14 06:13:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.234.246.109, lip=66.85.158.91, session=<90kuyN5F1Lys6vZt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.234.246.109
country_id: 6252001
description:
Dec 14 06:13:28 host2 pure-ftpd[2287277]: (?@172.234.246.109) [INFO] New connection from 172.234.246.109


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 14 06:14:29 host2 sshd[2288034]: Disconnected from invalid user pm2 45.197.145.10 port 44560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-14 06:14:30 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:43655: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-12-14 06:14:16 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:60344: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 14 06:15:10 host2 sshd[2288585]: Disconnected from invalid user admin 45.197.145.10 port 57102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 14 06:17:13 host2 sshd[2290083]: Disconnected from invalid user java 103.100.208.88 port 49706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 06:18:33 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61057: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-14 06:18:47 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:53128: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-12-14 06:19:00 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:60130: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-12-14 06:19:48 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:51346: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-14 06:20:00 dovecot_login authenticator failed for (mail3.hurst.co.uk) [77.89.143.122]:34034: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 14 06:22:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<FRm36N5FUKrCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-14 06:22:12 dovecot_plain authenticator failed for (wowailos) [81.0.54.119]:56902: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 06:25:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=</iKD895FLrw+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 06:27:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<86oY+t5FSoM+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 06:27:29 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (pered) [51.195.117.220]:52256: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Dec 14 06:27:33 host2 sshd[2298189]: Disconnected from invalid user xiangyu 154.221.27.234 port 34189 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2025-12-14 06:27:46 dovecot_login authenticator failed for ([128.185.194.190]) [128.185.194.190]:51150: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 06:27:58 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57478: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-14 06:28:51 dovecot_login authenticator failed for ([125.20.223.161]) [152.52.236.2]:41318: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-14 06:29:39 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:44586: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.27.234
country_id: 1819730
description:
Dec 14 06:29:54 host2 sshd[2299509]: Disconnected from invalid user old 154.221.27.234 port 51554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Dec 14 06:30:41 host2 sshd[2300255]: Disconnected from invalid user mongouser 154.221.27.234 port 57953 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 06:31:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<M6XZCN9FrIynrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-14 06:31:42 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (chnapub) [76.16.7.82]:37976: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-12-14 06:33:05 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:50626: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-14 06:32:43 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:47235: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.251.189.233
country_id: 6252001
description:
Dec 14 06:34:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.251.189.233, lip=66.85.158.91, TLS: Connection closed, session=<ujrsEt9FSOMs+73p>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.12
country_id: 798549
description:
Dec 14 06:34:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=85.217.140.12, lip=66.85.158.91, TLS: Connection closed, session=<x10TFN9F/NZV2YwM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 14 06:34:48 host2 sshd[2302486]: Disconnected from invalid user test2 103.113.105.228 port 43858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-14 06:36:21 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:34956: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-14 06:36:38 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:42972: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-12-14 06:37:55 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:59930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 14 06:37:15 host2 sshd[2304004]: Disconnected from invalid user jenny 103.113.105.228 port 51177 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-14 06:37:39 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:59920: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-14 06:37:44 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:40674: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-14 06:38:12 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:35540: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2025-12-14 06:39:44 dovecot_login authenticator failed for ([103.111.109.194]) [103.111.109.194]:32864: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 06:42:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<o3+WMN9FQrI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-14 06:43:38 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:43186: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-14 06:44:07 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:55850: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-14 06:44:09 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:40638: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-14 06:44:14 dovecot_plain authenticator failed for (opoids) [199.192.123.12]:39838: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-14 06:44:26 dovecot_login authenticator failed for ([122.185.184.134]) [182.95.226.82]:38016: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-14 06:44:12 dovecot_plain authenticator failed for (comale) [5.11.141.74]:36278: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 06:53:46 host2 sshd[2314677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.126
country_id: 3175395
description:
Dec 14 06:53:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.197.8.126, lip=66.85.158.91, TLS, session=<gaL4Vd9FKqi5xQh+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.44.136.205
country_id: 1269750
description:
2025-12-14 06:53:35 dovecot_login authenticator failed for ([103.44.136.205]) [103.44.136.205]:44901: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 2.136.115.209
country_id: 2510769
description:
Dec 14 06:53:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=2.136.115.209, lip=66.85.158.91, TLS, session=<lIwPV99Fv+wCiHPR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-14 06:53:58 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:57284: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-14 06:54:27 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (exterteast) [66.177.30.53]:52972: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-14 06:57:48 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:38101: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-14 06:57:59 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:44226: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-14 06:57:27 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:42290: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-14 06:57:28 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (asterm) [98.227.25.115]:35986: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-14 06:57:39 dovecot_login authenticator failed for ([182.95.197.193]) [182.79.87.18]:56420: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-14 06:59:15 dovecot_plain authenticator failed for (shipolo) [102.53.15.180]:33858: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 07:01:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<W8yQc99FzrGB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2025-12-14 07:02:21 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:47982: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 07:02:25 host2 sshd[2319327]: Disconnected from invalid user user 2.57.121.25 port 14100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-14 07:02:33 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:58136: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-12-14 07:02:40 dovecot_login authenticator failed for ([207.188.158.216]) [207.188.158.216]:59946: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-14 07:02:13 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:6354: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-14 07:03:34 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:49167: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 14 07:03:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS: Connection closed, session=<aYUwfN9FGJZChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-14 07:04:16 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:55667: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-14 07:06:00 dovecot_plain authenticator failed for (talies) [65.20.184.80]:45884: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 14 07:06:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS: Connection closed, session=<CAjKhN9FQhxChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.60.248.162
country_id: 1819730
description:
Dec 14 07:07:59 host2 sshd[2322437]: Disconnected from invalid user ubuntu 217.60.248.162 port 34656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-14 07:08:45 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:58263: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 07:09:04 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:63334: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-14 07:08:23 dovecot_login authenticator failed for ([125.20.223.161]) [152.52.236.2]:35588: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.223.194.42
country_id: 3469034
description:
Dec 14 07:09:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.223.194.42, lip=66.85.158.91, TLS, session=<f9mcjt9FNZ+x38Iq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.44.136.205
country_id: 1269750
description:
2025-12-14 07:09:22 dovecot_login authenticator failed for ([103.44.136.205]) [103.44.136.205]:60697: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.117
country_id: 3865483
description:
Dec 14 07:09:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=179.0.250.117, lip=66.85.158.91, TLS, session=<uHzVj99FFYizAPp1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-14 07:10:15 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (fenaters) [73.195.211.98]:38720: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-14 07:11:31 dovecot_plain authenticator failed for (devel) [65.20.149.93]:32779: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 07:12:10 host2 sshd[2325064]: Disconnected from invalid user admin 2.57.121.112 port 51114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-14 07:16:51 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (ansia) [68.40.189.43]:32818: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-14 07:17:22 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (inorsemal) [24.23.125.83]:57636: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.110
country_id: 1733045
description:
2025-12-14 07:18:47 dovecot_login authenticator failed for ([49.124.147.110]) [49.124.147.110]:48930: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-14 07:19:08 dovecot_plain authenticator failed for (lairess) [65.20.160.107]:40186: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-14 07:19:07 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:43379: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.253
country_id: 953987
description:
Dec 14 07:19:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.129.53.253, lip=66.85.158.91, TLS, session=<359ItN9FN85mgTX9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.253
country_id: 3469034
description:
Dec 14 07:20:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.189.205.253, lip=66.85.158.91, TLS, session=<DmKatd9F84Gzvc39>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.111
country_id: 3865483
description:
Dec 14 07:22:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.252.111, lip=66.85.158.91, TLS, session=<RT5UvN9FrNmzAPxv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-14 07:23:01 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:54671: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.161.232.82
country_id: 1269750
description:
Dec 14 07:22:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=103.161.232.82, lip=66.85.158.91, TLS, session=<kfy4vd9FdI1noehS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-14 07:22:37 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:38056: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-14 07:23:47 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (nolly) [98.192.74.183]:43490: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-14 07:24:06 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:44500: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 07:24:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<qNojxd9Ffp8+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-14 07:24:21 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:49472: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 07:24:27 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (later) [174.166.153.20]:53080: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-14 07:25:46 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:39344: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-12-14 07:25:55 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:55114: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-12-14 07:25:58 dovecot_plain authenticator failed for (bulumencus) [2.74.194.86]:49591: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.96
country_id: 6252001
description:
Dec 14 07:27:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.96, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5byV0t9FO8tBMQFg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-14 07:27:59 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:59902: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.94
country_id: 6252001
description:
Dec 14 07:28:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.94, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DAmp099FRg5BMQFe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-14 07:28:19 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:35324: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-14 07:28:22 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-14 07:28:27 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (antmalles) [73.68.220.15]:60980: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-12-14 07:28:56 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:37508: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.173
country_id: 1733045
description:
2025-12-14 07:29:26 dovecot_login authenticator failed for ([49.124.152.173]) [49.124.152.173]:52104: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-14 07:31:58 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (alkwanty) [73.68.220.15]:51936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 14 07:33:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<0RBd599FirJog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2025-12-14 07:33:49 dovecot_login authenticator failed for (2-55-126-88.orange.net.il) [2.55.126.88]:39379: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-12-14 07:34:18 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:58789: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-12-14 07:34:27 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:56310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-14 07:34:39 dovecot_login authenticator failed for (221-169-97-62.cust.smartcall.no) [62.97.169.221]:50918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-14 07:34:53 dovecot_plain authenticator failed for (faling) [187.161.198.68]:32966: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.139
country_id: 6252001
description:
2025-12-14 07:37:41 dovecot_login authenticator failed for wsip-184-191-250-139.fv.ks.cox.net [184.191.250.139]:48127: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-14 07:37:54 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:38827: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-14 07:42:02 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (sestes) [78.68.37.25]:33427: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-14 07:42:34 dovecot_plain authenticator failed for (excruing) [65.20.205.197]:48645: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-14 07:43:24 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:40910: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-14 07:43:54 dovecot_login authenticator failed for (nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:47762: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-12-14 07:47:03 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:49688: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-14 07:47:34 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:45722: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 14 07:50:40 host2 sshd[2349746]: Disconnected from invalid user rancid 64.227.102.57 port 36366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-14 07:51:45 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:56661: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-12-14 07:51:56 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:54422: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 14 07:51:18 host2 sshd[2350159]: Disconnected from invalid user hamed 64.227.102.57 port 44482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 14 07:51:26 host2 sshd[2350221]: Disconnected from invalid user milan 137.184.30.179 port 33632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.24
country_id: 6252001
description:
2025-12-14 07:51:31 dovecot_login authenticator failed for ([72.214.133.24]) [72.214.133.24]:57556: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.244.65.106
country_id: 3595528
description:
2025-12-14 07:51:46 dovecot_plain authenticator failed for (E1261D68V5UP6) [74.244.65.106]:29973: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 14 07:53:00 host2 sshd[2351446]: Disconnected from invalid user jake 64.227.102.57 port 41622 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 158.94.210.79 - 2096 "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-14 07:53:04 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:53611: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-12-14 07:52:14 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:35858: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-14 07:53:19 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:51925: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 14 07:55:11 host2 sshd[2353529]: Disconnected from invalid user david 137.184.30.179 port 36014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 14 07:54:15 host2 sshd[2352469]: Disconnected from invalid user hamed 137.184.30.179 port 51674 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 14 07:54:38 host2 sshd[2353046]: Received disconnect from 137.184.30.179 port 42440:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 14 07:56:05 host2 sshd[2354097]: Disconnected from invalid user forge 201.76.120.30 port 35120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 14 07:56:30 host2 sshd[2354409]: Disconnected from invalid user arthur 64.227.102.57 port 58744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-12-14 07:57:26 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:64193: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-12-14 07:57:32 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:62184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-14 07:57:50 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:53771: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-14 07:58:20 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:43614: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 07:59:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<0V7PQ+BFAM2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-14 07:59:51 dovecot_login authenticator failed for ([84.213.188.130]) [84.213.188.130]:59049: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 14 07:59:18 host2 sshd[2356365]: Disconnected from invalid user user1 201.76.120.30 port 41034 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2025-12-14 07:59:29 dovecot_login authenticator failed for ([49.124.152.234]) [49.124.152.234]:48014: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


