# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 14 17:47:39 host2 sshd[2773205]: Disconnected from invalid user narges 42.200.66.164 port 48926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.198.84.44
country_id: 6252001
description:
2025-12-14 17:51:05 dovecot_plain authenticator failed for 67-198-84-44.dyn.grandenetworks.net ([89.116.164.85]) [67.198.84.44]:43805: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.144.186.165
country_id: 1655842
description:
2025-12-14 17:50:43 dovecot_plain authenticator failed for ([89.116.164.85]) [202.144.186.165]:42511: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.188.234.223
country_id: 3469034
description:
2025-12-14 17:50:53 dovecot_plain authenticator failed for ([89.116.164.85]) [200.188.234.223]:54113: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-12-14 17:54:20 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:45522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-12-14 17:54:30 dovecot_plain authenticator failed for (diess) [85.29.149.211]:48670: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-14 17:54:36 dovecot_login authenticator failed for ([84.211.13.69]) [84.211.13.69]:47616: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 17:54:42 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50103: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-14 17:55:56 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:48228: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 14 17:55:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<h7GSl+hF7NWLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.224
country_id: 6252001
description:
2025-12-14 17:56:15 dovecot_login authenticator failed for wsip-184-191-242-224.fv.ks.cox.net [184.191.242.224]:33498: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-14 17:58:25 dovecot_plain authenticator failed for (abilus) [5.11.141.74]:43346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-12-14 17:59:59 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:60738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-14 18:00:14 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:46702: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.116.189.189
country_id: 953987
description:
2025-12-14 18:00:34 dovecot_plain authenticator failed for ([89.116.164.85]) [41.116.189.189]:51348: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-14 18:00:42 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (ottism) [98.193.112.85]:39472: 535 Incorrect authentication data (set_id=help@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.46.8.131
country_id: 1643084
description:
2025-12-14 18:00:49 dovecot_plain authenticator failed for ([89.116.164.85]) [103.46.8.131]:60024: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.91.177.217
country_id: 6254930
description:
2025-12-14 18:01:03 dovecot_plain authenticator failed for ([89.116.164.85]) [77.91.177.217]:49288: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.121.39
country_id: 2264397
description:
2025-12-14 18:02:01 dovecot_plain authenticator failed for a109-51-121-39.cpe.netcabo.pt ([89.116.164.85]) [109.51.121.39]:33577: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.118.133
country_id: 1168579
description:
2025-12-14 18:02:03 dovecot_plain authenticator failed for ([89.116.164.85]) [59.103.118.133]:57006: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.38.84
country_id: 3895114
description:
2025-12-14 18:02:08 dovecot_plain authenticator failed for ([89.116.164.85]) [190.114.38.84]:2309: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-14 18:01:43 dovecot_plain authenticator failed for (sauth) [65.20.184.80]:58471: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.160.142
country_id: 1694008
description:
2025-12-14 18:02:31 dovecot_plain authenticator failed for ([89.116.164.85]) [103.167.160.142]:40056: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.97.252.190
country_id: 3625428
description:
2025-12-14 18:02:33 dovecot_plain authenticator failed for ([89.116.164.85]) [190.97.252.190]:56563: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.41.105.7
country_id: 1327865
description:
2025-12-14 18:02:33 dovecot_plain authenticator failed for ([89.116.164.85]) [45.41.105.7]:19416: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.126.10.254
country_id: 3895114
description:
2025-12-14 18:02:14 dovecot_plain authenticator failed for ([89.116.164.85]) [191.126.10.254]:20109: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.38.84
country_id: 3895114
description:
2025-12-14 18:02:15 dovecot_login authenticator failed for ([89.116.164.85]) [190.114.38.84]:2309: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.33.69.14
country_id: 3469034
description:
2025-12-14 18:02:17 dovecot_plain authenticator failed for ([89.116.164.85]) [177.33.69.14]:35258: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.72.28.142
country_id: 3469034
description:
2025-12-14 18:02:21 dovecot_plain authenticator failed for 189-72-28-142.user3p.v-tal.net.br ([89.116.164.85]) [189.72.28.142]:44924: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 14 18:03:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<Y92Bs+hFQtpog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-14 18:04:35 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:33633: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-14 18:05:03 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:56390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-14 18:05:10 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:51806: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.6.42
country_id: 2542007
description:
2025-12-14 18:06:03 dovecot_plain authenticator failed for ([89.116.164.85]) [105.72.6.42]:46096: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.16
country_id: 6252001
description:
2025-12-14 18:05:34 dovecot_login authenticator failed for ([98.181.44.16]) [98.181.44.16]:48042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.141.72.165
country_id: 3469034
description:
2025-12-14 18:05:50 dovecot_plain authenticator failed for cgnat-165.online.caxias.br ([89.116.164.85]) [192.141.72.165]:15537: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.20.157.14
country_id: 3865483
description:
2025-12-14 18:06:19 dovecot_plain authenticator failed for ([89.116.164.85]) [181.20.157.14]:37810: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.201.224
country_id: 1269750
description:
2025-12-14 18:06:35 dovecot_login authenticator failed for ([103.250.160.76]) [59.96.201.224]:51730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.32.121
country_id: 390903
description:
2025-12-14 18:06:46 dovecot_login authenticator failed for (149-210-32-121.mobile.nym.cosmote.net) [149.210.32.121]:47873: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 14 18:09:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<YvwqyOhFmARChJmL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 14 18:10:50 host2 sshd[2789944]: Disconnected from invalid user develop 185.216.116.13 port 60456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-12-14 18:10:31 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:33171: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-14 18:11:31 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:56242: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-14 18:11:43 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:52790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 14 18:12:08 host2 sshd[2790819]: Disconnected from invalid user scheduler 185.216.116.13 port 55592 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-14 18:11:17 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:52554: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.2.16.39
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.2.16.39 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.181.2.190
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.181.2.190 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.232.22.112
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.232.22.112 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.139.89.152
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.139.89.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.185.15.51
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.185.15.51 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:12:32 host2 sshd[2791092]: Disconnected from invalid user idempiere 152.32.215.203 port 50728 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.135.236.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 207.135.236.151 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.13.52
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.0.13.52 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-14 18:12:48 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:59680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.70
country_id: 1733045
description:
2025-12-14 18:13:13 dovecot_login authenticator failed for ([49.125.201.70]) [49.125.201.70]:33346: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-14 18:13:31 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:52583: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:13:47 host2 sshd[2791861]: Disconnected from invalid user hik 152.32.215.203 port 33376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 18:14:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Y0RQ2uhFro8+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:14:25 host2 sshd[2792211]: Disconnected from invalid user zhy 179.127.26.32 port 42464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:15:11 host2 sshd[2793036]: Disconnected from invalid user ubuntu 179.127.26.32 port 40674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-14 18:15:48 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:43562: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:16:41 host2 sshd[2794132]: Disconnected from invalid user yang 179.127.26.32 port 49168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-14 18:17:14 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:46870: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.130
country_id: 298795
description:
Dec 14 18:17:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@v-deploy.com>, method=PLAIN, rip=149.34.211.130, lip=66.85.158.91, TLS, session=<7m/w5ehFjOaVItOC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:18:15 host2 sshd[2795090]: Disconnected from invalid user sammy 152.32.215.203 port 50568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 14 18:18:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<Wwpb5+hF5IvJqAle>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-14 18:20:55 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:54359: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-14 18:20:44 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:56864: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 18:22:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<9EOq+OhFFNqB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.151
country_id: 1269750
description:
Dec 14 18:24:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=103.164.246.151, lip=66.85.158.91, TLS, session=<zwWa/ehFVeBnpPaX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-14 18:24:36 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:59052: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-14 18:24:47 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:32568: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.93
country_id: 690791
description:
Dec 14 18:24:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=37.221.134.93, lip=66.85.158.91, TLS, session=<HUnd/uhFspgl3YZd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.199.231.110
country_id: 1282988
description:
2025-12-14 18:25:35 dovecot_plain authenticator failed for ([89.116.164.85]) [113.199.231.110]:15598: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.29.201.193
country_id: 3865483
description:
2025-12-14 18:25:49 dovecot_plain authenticator failed for ([89.116.164.85]) [181.29.201.193]:44393: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 16.98.109.97
country_id: 6252001
description:
2025-12-14 18:26:01 dovecot_plain authenticator failed for ([89.116.164.85]) [16.98.109.97]:28024: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-14 18:29:07 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:45461: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-14 18:29:49 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:33550: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-14 18:29:33 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:57132: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.232.162.147
country_id: 3469034
description:
2025-12-14 18:30:51 dovecot_plain authenticator failed for 168-232-162-147.static.sumicity.net.br ([89.116.164.85]) [168.232.162.147]:15186: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.236.62.19
country_id: 3469034
description:
2025-12-14 18:31:04 dovecot_plain authenticator failed for 186-236-62-19.viabol.com.br ([89.116.164.85]) [186.236.62.19]:34597: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.170.21
country_id: 3996063
description:
2025-12-14 18:30:11 dovecot_login authenticator failed for ([177.236.170.21]) [177.236.170.21]:38973: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.191
country_id: 6252001
description:
Dec 14 18:30:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.8.191, lip=66.85.158.91, session=<mtWpE+lFzNsUqwi/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.236.62.19
country_id: 3469034
description:
2025-12-14 18:31:11 dovecot_login authenticator failed for 186-236-62-19.viabol.com.br ([89.116.164.85]) [186.236.62.19]:34597: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.201.154.255
country_id: 3469034
description:
2025-12-14 18:31:17 dovecot_plain authenticator failed for ([89.116.164.85]) [128.201.154.255]:20354: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-14 18:31:18 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:27431: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 18:31:32 host2 sshd[2804623]: Disconnected from invalid user admin 2.57.121.112 port 52701 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.19.227
country_id: 953987
description:
2025-12-14 18:32:54 dovecot_plain authenticator failed for ([89.116.164.85]) [102.32.19.227]:51946: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.227.186
country_id: 3865483
description:
2025-12-14 18:33:07 dovecot_plain authenticator failed for ([89.116.164.85]) [45.65.227.186]:54267: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.227.186
country_id: 3865483
description:
2025-12-14 18:33:14 dovecot_login authenticator failed for ([89.116.164.85]) [45.65.227.186]:54267: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec 14 18:33:17 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, session=<L6k8HulFEhKnXpIy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.67.34.82
country_id: 3469034
description:
2025-12-14 18:33:23 dovecot_plain authenticator failed for ([89.116.164.85]) [177.67.34.82]:52742: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-14 18:35:54 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:57500: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-14 18:36:04 dovecot_plain authenticator failed for (judous) [38.248.111.238]:45731: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-14 18:36:07 dovecot_plain authenticator failed for (unicalle) [50.231.243.28]:52132: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-14 18:36:12 dovecot_plain authenticator failed for (nothagral) [102.53.15.180]:47626: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-14 18:36:14 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:43253: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 129.212.232.248
country_id: 1880251
description:
Dec 14 18:36:51 host2 pure-ftpd[2808217]: (?@129.212.232.248) [INFO] New connection from 129.212.232.248


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.135
country_id: 6252001
description:
Dec 14 18:37:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.154.135, lip=66.85.158.91, TLS: Connection closed, session=<NT7lLOlFcMHHLZqH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:42:13 host2 sshd[2811982]: Disconnected from invalid user User 213.142.151.19 port 41848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-14 18:45:58 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:59764: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-14 18:46:12 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:51614: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:47:02 host2 sshd[2815928]: Disconnected from invalid user valera 213.142.151.19 port 40726 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.134.119.200
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.134.119.200 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:48:16 host2 sshd[2816761]: Disconnected from invalid user connor 213.142.151.19 port 39608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 18:49:20 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57814: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-14 18:49:40 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:40547: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:50:09 host2 sshd[2818252]: Disconnected from invalid user vncuser 213.142.151.19 port 38630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.236.255.16
country_id: 6252001
description:
2025-12-14 18:51:28 dovecot_plain authenticator failed for c-71-236-255-16.hsd1.or.comcast.net ([89.116.164.85]) [71.236.255.16]:52102: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.152.14.222
country_id: 146669
description:
2025-12-14 18:51:40 dovecot_plain authenticator failed for cpe-985163.ip.primehome.com ([89.116.164.85]) [62.152.14.222]:44602: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.21.49.3
country_id: 3865483
description:
2025-12-14 18:51:53 dovecot_plain authenticator failed for ([89.116.164.85]) [181.21.49.3]:56124: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.69.251.106
country_id: 597427
description:
2025-12-14 18:54:47 dovecot_login authenticator failed for (md-188-69-251-106.omni.lt) [188.69.251.106]:41262: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-14 18:54:53 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:50927: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-12-14 18:54:28 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:59057: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-14 18:55:26 dovecot_login authenticator failed for (cm-84.210.149.45.get.no) [84.210.149.45]:46826: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-14 18:56:14 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:44024: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.136.191.244
country_id: 2542007
description:
2025-12-14 18:58:38 dovecot_plain authenticator failed for ([89.116.164.85]) [105.136.191.244]:45123: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.195.22.145
country_id: 1694008
description:
2025-12-14 18:58:54 dovecot_plain authenticator failed for ([89.116.164.85]) [180.195.22.145]:51606: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 18:59:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<0uGKe+lF7tU+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 14 18:59:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.44, lip=66.85.158.91, session=<LJPffOlFLOg+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-14 19:00:45 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:58322: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.138
country_id: 6252001
description:
2025-12-14 19:01:04 dovecot_login authenticator failed for wsip-184-191-250-138.fv.ks.cox.net [184.191.250.138]:55323: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-14 19:01:21 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54193: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-14 19:01:41 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:60854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-14 19:01:56 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:34090: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-14 19:02:08 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:55526: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-14 19:05:47 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:52544: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-12-14 19:06:17 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:38581: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 19:08:22 host2 sshd[2830723]: Disconnected from invalid user violet 62.60.131.157 port 27734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 19:08:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<YcqtnOlF4qA+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:09:17 host2 sshd[2831381]: Disconnected from invalid user ociispth 162.240.39.179 port 59186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-14 19:10:45 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:34282: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:10:53 host2 sshd[2832857]: Disconnected from invalid user admin 162.240.39.179 port 59518 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 19:11:52 host2 sshd[2833495]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.84.186
country_id: 294640
description:
2025-12-14 19:11:12 dovecot_login authenticator failed for (2-54-84-186.orange.net.il) [2.54.84.186]:34930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:11:25 host2 sshd[2833231]: Disconnected from invalid user dev 162.240.39.179 port 43690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 19:12:08 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (ulint) [73.208.81.125]:41374: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.163.186
country_id: 298795
description:
2025-12-14 19:12:11 dovecot_plain authenticator failed for ([89.116.164.85]) [81.214.163.186]:42816: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:13:36 host2 sshd[2834929]: Disconnected from invalid user runner 192.81.208.35 port 43920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-14 19:13:53 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:37102: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-14 19:14:03 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:50296: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-14 19:14:24 dovecot_login authenticator failed for ([196.190.43.139]) [196.190.41.137]:10596: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:14:39 host2 sshd[2835740]: Disconnected from invalid user admin1 162.240.39.179 port 33420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.51
country_id: 1733045
description:
2025-12-14 19:14:49 dovecot_login authenticator failed for ([49.124.153.51]) [49.124.153.51]:41794: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-14 19:15:02 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:35914: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:15:03 host2 sshd[2836151]: Disconnected from invalid user mrodelo 103.56.30.33 port 47816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:15:14 host2 sshd[2836381]: Disconnected from invalid user me 192.81.208.35 port 55748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.155
country_id: 6252001
description:
Dec 14 19:15:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.155, lip=66.85.158.92, session=<Z7ZRtelFYr2H7X2b>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:15:45 host2 sshd[2836787]: Disconnected from invalid user storage 192.81.208.35 port 40276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 19:16:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<d7mDuelFLp2nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-14 19:16:23 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:39840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:16:29 host2 sshd[2837423]: Disconnected from invalid user runner 103.56.30.33 port 21480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-14 19:16:39 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:54686: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:17:57 host2 sshd[2838443]: Disconnected from invalid user me 103.56.30.33 port 41582 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:18:30 host2 sshd[2838833]: Received disconnect from 192.81.208.35 port 52294:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.49.242.200
country_id: 2510769
description:
2025-12-14 19:19:56 dovecot_login authenticator failed for 200.red-83-49-242.dynamicip.rima-tde.net [83.49.242.200]:43158: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-14 19:20:04 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:41873: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:20:11 host2 sshd[2840416]: Disconnected from invalid user test 102.210.149.121 port 47046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:20:13 host2 sshd[2840335]: Disconnected from invalid user mrodelo 45.78.202.90 port 45720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-14 19:20:24 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:54512: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-12-14 19:20:31 dovecot_login authenticator failed for ([195.158.14.232]) [195.158.14.232]:34042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-14 19:20:45 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (monion) [76.106.163.189]:51492: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:21:07 host2 sshd[2841308]: Disconnected from invalid user admin1 192.81.208.35 port 41510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-14 19:22:21 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:49002: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.55
country_id: 1733045
description:
2025-12-14 19:21:22 dovecot_login authenticator failed for ([49.124.151.55]) [49.124.151.55]:40248: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-14 19:21:36 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:57953: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:22:24 host2 sshd[2842396]: Disconnected from invalid user automation 45.78.202.90 port 39000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:22:26 host2 sshd[2842437]: Disconnected from invalid user ubuntu 102.210.149.121 port 47942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:22:51 host2 sshd[2842694]: Disconnected from invalid user mary 43.166.245.172 port 54784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-14 19:23:06 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:42326: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:24:11 host2 sshd[2843824]: Disconnected from invalid user ubuntu 102.210.149.121 port 48138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:23:38 host2 sshd[2843367]: Disconnected from invalid user k 205.185.126.121 port 54172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:24:53 host2 sshd[2844316]: Disconnected from invalid user es 205.185.126.121 port 51028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:25:27 host2 sshd[2844830]: Disconnected from invalid user Test 205.185.126.121 port 35338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-14 19:25:51 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:37474: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:26:06 host2 sshd[2845333]: Disconnected from invalid user daniela 38.77.234.93 port 38640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-14 19:26:13 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:49302: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:26:40 host2 sshd[2845607]: Disconnected from invalid user admin1234 205.185.126.121 port 60422 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.191.182.211
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.191.182.211 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.241.68.24
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 88.241.68.24 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-14 19:26:41 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:38734: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.104.101
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.203.104.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.181.208.155
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.181.208.155 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-14 19:26:53 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:50050: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.39.208
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.4.39.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:27:14 host2 sshd[2845912]: Disconnected from invalid user user1 38.77.234.93 port 56286 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.3.228.182
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.3.228.182 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.89.70.139
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 202.89.70.139 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 19:28:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<TF8q4ulFvr0+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:27:27 host2 sshd[2846063]: Disconnected from invalid user k 43.166.245.172 port 17152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:27:47 host2 sshd[2846243]: Disconnected from invalid user ubuntu 38.77.234.93 port 59500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:29:17 host2 sshd[2846942]: Disconnected from invalid user storage 45.78.202.90 port 46406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.115.165
country_id: 3865483
description:
2025-12-14 19:28:24 dovecot_plain authenticator failed for ([89.116.164.85]) [190.173.115.165]:46625: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.245.208
country_id: 3865483
description:
2025-12-14 19:28:38 dovecot_plain authenticator failed for ([89.116.164.85]) [186.23.245.208]:46496: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:28:43 host2 sshd[2846694]: Disconnected from invalid user admin1234 43.166.245.172 port 11776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.21.189.208
country_id: 3017382
description:
2025-12-14 19:28:51 dovecot_plain authenticator failed for aorleans-652-1-3-208.w90-21.abo.wanadoo.fr ([89.116.164.85]) [90.21.189.208]:45686: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 14 19:29:50 host2 sshd[2847248]: Disconnected from invalid user mohammad 192.76.153.90 port 34616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:29:58 host2 sshd[2847312]: Disconnected from invalid user server 68.183.82.237 port 34182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:30:39 host2 sshd[2847868]: Disconnected from invalid user mcadmin 68.183.82.237 port 50958 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:31:19 host2 sshd[2848216]: Disconnected from invalid user ubuntu 68.183.82.237 port 55282 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-14 19:31:36 dovecot_plain authenticator failed for (dryballs) [109.226.14.93]:46888: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 14 19:32:06 host2 sshd[2848680]: Disconnected from invalid user noreply 192.76.153.90 port 34934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:32:39 host2 sshd[2848906]: Disconnected from invalid user admin1234 68.183.82.237 port 44058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.194.235.86
country_id: 290557
description:
Dec 14 19:32:47 host2 sshd[2848955]: Disconnected from invalid user admin1234 5.194.235.86 port 55944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:32:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AOxr8+lFBt6i2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:33:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<yJkX9+lF/PCi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:34:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<kR5++elFeOGi2JVE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:34:42 host2 sshd[2849795]: Disconnected from invalid user build 45.226.53.7 port 56398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:35:29 host2 sshd[2850390]: Disconnected from invalid user testuser 45.226.53.7 port 44764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.9
country_id: 3469034
description:
Dec 14 19:36:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.71.89.9, lip=66.85.158.91, TLS, session=<Pyys/elF6pOxR1kJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-14 19:36:12 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:48992: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-14 19:36:26 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:46560: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.176
country_id: 1269750
description:
Dec 14 19:36:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts>, method=PLAIN, rip=103.18.166.176, lip=66.85.158.91, TLS, session=<ndnw/ulFK71nEqaw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 19:38:38 host2 sshd[2852551]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 19:39:20 host2 sshd[2852981]: Disconnected from invalid user user 2.57.121.25 port 35908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:38:31 host2 sshd[2852480]: Disconnected from invalid user ubuntu 45.226.53.7 port 55326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.8.125.130
country_id: 3469034
description:
2025-12-14 19:40:18 dovecot_login authenticator failed for ([189.8.125.130]) [189.8.125.130]:47627: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.210.164
country_id: 2921044
description:
Dec 14 19:39:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.154.210.164, lip=66.85.158.91, TLS, session=<K4YzDOpFBo3PmtKk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-12-14 19:40:40 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:45994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:42:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS, session=<oF1EFOpFhPmi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:42:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS, session=<uSVRFupFLvOi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 14 19:44:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<20HCHOpFLKtAPpzU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.38.102.187
country_id: 130758
description:
2025-12-14 19:44:53 dovecot_plain authenticator failed for (doman) [89.38.102.187]:48126: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-14 19:45:13 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:52928: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.0.23.20
country_id: 192950
description:
2025-12-14 19:46:18 dovecot_plain authenticator failed for ([89.116.164.85]) [102.0.23.20]:35220: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-14 19:46:20 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:51214: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-14 19:45:29 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:40160: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.32.123.9
country_id: 3469034
description:
2025-12-14 19:45:35 dovecot_login authenticator failed for (187-032-123-009.static.ctbctelecom.com.br) [187.32.123.9]:3732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-14 19:45:45 dovecot_login authenticator failed for ([182.95.2.9]) [182.78.67.22]:38658: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.168.38
country_id: 3469034
description:
2025-12-14 19:45:52 dovecot_plain authenticator failed for ([89.116.164.85]) [131.255.168.38]:50634: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.92.158.97
country_id: 3017382
description:
2025-12-14 19:46:04 dovecot_plain authenticator failed for 89-92-158-97.hfc.dyn.abo.bbox.fr ([89.116.164.85]) [89.92.158.97]:64094: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.0.23.20
country_id: 192950
description:
2025-12-14 19:46:25 dovecot_login authenticator failed for ([89.116.164.85]) [102.0.23.20]:35220: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.92
country_id: 3469034
description:
Dec 14 19:47:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=170.80.41.92, lip=66.85.158.91, TLS, session=<UkYMJepFTo2qUClc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.226
country_id: 3865483
description:
Dec 14 19:47:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.252.226, lip=66.85.158.91, TLS, session=<ecxLJupF2uezAPzi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-14 19:51:01 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:51976: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-14 19:51:22 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:35067: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-14 19:51:53 dovecot_login authenticator failed for (189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:59629: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-14 19:52:17 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:37075: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 93.123.109.115
country_id: 732800
description:
Dec 14 19:55:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=93.123.109.115, lip=66.85.158.91, TLS: Connection closed, session=<TuluQ+pFDs5de21z>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.31.178.148
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.31.178.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.165.30.251
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.165.30.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.200.33.40
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 87.200.33.40 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:17 host2 sshd[2865719]: error: maximum authentication attempts exceeded for root from 68.58.204.249 port 45268 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.43.129
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.164.43.129 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.155.240.207
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.155.240.207 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.189
country_id: 6252001
description:
Dec 14 19:56:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cGtMRupF1OMUQcG9>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:17 host2 sshd[2865719]: Disconnecting authenticating user root 68.58.204.249 port 45268: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.154.166.17
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.154.166.17 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.152.164
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.244.152.164 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.141.13.45
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 175.141.13.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:22 host2 sshd[2865795]: error: maximum authentication attempts exceeded for invalid user admin from 68.58.204.249 port 46302 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.5.117
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.168.5.117 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.49.16.163
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.49.16.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.118.170.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.118.170.89 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.53.2.142
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.53.2.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:23 host2 sshd[2865805]: Disconnecting invalid user admin 68.58.204.249 port 46310: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.67.230.52
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.67.230.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.178.247.14
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.178.247.14 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.86.164.242
country_id: 3625428
description:
2025-12-14 19:58:25 dovecot_plain authenticator failed for ([89.116.164.85]) [82.86.164.242]:16864: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.152.42.84
country_id: 192950
description:
2025-12-14 19:58:38 dovecot_plain authenticator failed for ([89.116.164.85]) [154.152.42.84]:54372: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.92.143.52
country_id: 1733045
description:
2025-12-14 19:58:54 dovecot_plain authenticator failed for ([89.116.164.85]) [219.92.143.52]:55820: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.225.186.148
country_id: 6252001
description:
2025-12-14 20:00:19 dovecot_plain authenticator failed for 108-225-186-148.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [108.225.186.148]:52080: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.225.186.148
country_id: 6252001
description:
2025-12-14 20:00:25 dovecot_login authenticator failed for 108-225-186-148.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [108.225.186.148]:52080: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.32.33.157
country_id: 6252001
description:
2025-12-14 20:00:30 dovecot_plain authenticator failed for ([89.116.164.85]) [76.32.33.157]:5188: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 20:00:35 host2 sshd[2868800]: Disconnected from invalid user  62.60.131.157 port 28518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.33.138.26
country_id: 3469034
description:
2025-12-14 20:00:44 dovecot_plain authenticator failed for ([89.116.164.85]) [177.33.138.26]:14950: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-14 20:01:22 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:55732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-12-14 20:01:41 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:56394: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.199.115
country_id: 1733045
description:
2025-12-14 20:02:18 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.199.115]:28110: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 20:03:10 host2 sshd[2871042]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.42.141.241
country_id: 3895114
description:
2025-12-14 20:02:52 dovecot_plain authenticator failed for ([89.116.164.85]) [181.42.141.241]:16893: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.199.115
country_id: 1733045
description:
2025-12-14 20:02:25 dovecot_login authenticator failed for ([89.116.164.85]) [115.135.199.115]:28110: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.234.245.49
country_id: 2635167
description:
2025-12-14 20:02:29 dovecot_plain authenticator failed for haye-25-b2-v4wan-169431-cust5424.vm28.cable.virginm.net ([89.116.164.85]) [92.234.245.49]:53716: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.196.1
country_id: 1733045
description:
2025-12-14 20:02:28 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.196.1]:2737: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.166.137.22
country_id: 3508796
description:
2025-12-14 20:02:40 dovecot_plain authenticator failed for ([89.116.164.85]) [190.166.137.22]:54901: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.237.202
country_id: 3865483
description:
2025-12-14 20:02:42 dovecot_plain authenticator failed for ([89.116.164.85]) [186.23.237.202]:57916: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-14 20:04:46 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:36300: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.30.98
country_id: 1733045
description:
2025-12-14 20:04:55 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.30.98]:24219: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-14 20:05:02 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:53316: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.172.73
country_id: 953987
description:
2025-12-14 20:05:07 dovecot_plain authenticator failed for ([89.116.164.85]) [197.184.172.73]:19397: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.24.21
country_id: 3439705
description:
2025-12-14 20:05:20 dovecot_plain authenticator failed for r186-53-24-21.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.24.21]:59630: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.23.198
country_id: 6252001
description:
Dec 14 20:04:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.29.23.198, lip=66.85.158.91, TLS, session=<QN4TZOpFgucUHRfG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.24.21
country_id: 3439705
description:
2025-12-14 20:05:27 dovecot_login authenticator failed for r186-53-24-21.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.24.21]:59630: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-14 20:05:54 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:51430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.94.115.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.94.115.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.48.157.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 173.48.157.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.120.196.93
country_id: 3437598
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.120.196.93 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.83.139.243
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.83.139.243 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.158.229.150
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.158.229.150 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.30.14.88
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 193.30.14.88 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.161.159.248
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 91.161.159.248 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.30.185
country_id: 1269750
description:
Dec 14 20:07:14 host2 sshd[2875362]: Disconnected from invalid user postgres 128.199.30.185 port 51986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.30.185
country_id: 1269750
description:
Dec 14 20:07:57 host2 sshd[2875977]: Disconnected from invalid user deployer 128.199.30.185 port 39474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.190
country_id: 3175395
description:
Dec 14 20:09:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.63.132.190, lip=66.85.158.91, TLS, session=<NplOdOpF9KS5P4S+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.30.185
country_id: 1269750
description:
Dec 14 20:09:18 host2 sshd[2877326]: Disconnected from invalid user eversec 128.199.30.185 port 60456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.231
country_id: 3469034
description:
Dec 14 20:08:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=186.209.247.231, lip=66.85.158.91, TLS, session=<2vaScupFVoK60ffn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 20:09:41 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (lepochs) [174.166.153.20]:36280: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.234
country_id: 3996063
description:
2025-12-14 20:10:09 dovecot_login authenticator failed for (201.173.216.234-clientes-izzi.mx) [201.173.216.234]:46301: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-14 20:10:15 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:57646: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.30.185
country_id: 1269750
description:
Dec 14 20:11:18 host2 sshd[2879364]: Disconnected from invalid user sean 128.199.30.185 port 37270 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-14 20:10:27 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:54264: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-14 20:10:43 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:33104: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-14 20:11:33 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:47765: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.215.43.3
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.215.43.3 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.106.30.245
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.106.30.245 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-14 20:16:05 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:47572: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.89.21
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.100.89.21 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.195.96.32
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.195.96.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.198.165
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.100.198.165 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.168.196.77
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.168.196.77 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.10.23.183
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.10.23.183 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.47.126.25
country_id: 3865483
description:
2025-12-14 20:16:20 dovecot_plain authenticator failed for ([89.116.164.85]) [181.47.126.25]:31564: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.107.246
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.41.107.246 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.47.126.25
country_id: 3865483
description:
2025-12-14 20:16:27 dovecot_login authenticator failed for ([89.116.164.85]) [181.47.126.25]:31564: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.159.74.64
country_id: 3469034
description:
2025-12-14 20:16:33 dovecot_plain authenticator failed for 201-159-74-64-dynamic.poxley.com.br ([89.116.164.85]) [201.159.74.64]:60378: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.33.118
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.43.33.118 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.78.29.216
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.78.29.216 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.205.2.15
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.205.2.15 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-14 20:17:09 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:49174: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-14 20:16:28 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:52248: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.255.179.119
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 138.255.179.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.172.68.215
country_id: 3351879
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.172.68.215 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.149.191.59
country_id: 6290252
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.149.191.59 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.177.252.2
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.177.252.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Dec 14 20:16:37 host2 sshd[2883459]: Disconnected from invalid user oracle 138.204.127.54 port 59360 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.19.86
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.19.86 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.20.22.218
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.20.22.218 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.228.234.149
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.228.234.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.18.197
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 186.22.18.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.112.216.139
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.112.216.139 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.106.38.150
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.106.38.150 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 14 20:18:03 host2 sshd[2884498]: Disconnected from invalid user runner 45.120.216.232 port 34694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.95.63.253
country_id: 3469034
description:
2025-12-14 20:18:08 dovecot_plain authenticator failed for ([89.116.164.85]) [179.95.63.253]:48956: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.33.226.237
country_id: 6251999
description:
2025-12-14 20:17:42 dovecot_plain authenticator failed for pool-173-33-226-237.cpe.net.cable.rogers.com ([89.116.164.85]) [173.33.226.237]:48693: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.140.24.63
country_id: 1522867
description:
2025-12-14 20:17:54 dovecot_plain authenticator failed for ([89.116.164.85]) [45.140.24.63]:26254: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.112.221.85
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.112.221.85 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.128.219.222
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.128.219.222 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.25.175
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.63.25.175 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.178.206.88
country_id: 2635167
description:
2025-12-14 20:19:16 dovecot_plain authenticator failed for host86-178-206-88.range86-178.btcentralplus.com ([89.116.164.85]) [86.178.206.88]:48206: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.36.37
country_id: 3469034
description:
2025-12-14 20:18:53 dovecot_plain authenticator failed for ([89.116.164.85]) [189.6.36.37]:35431: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.41.179
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.38.41.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.149.91.147
country_id: 3996063
description:
2025-12-14 20:19:05 dovecot_plain authenticator failed for ([89.116.164.85]) [187.149.91.147]:53300: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.244.91
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 62.201.244.91 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.25.20.13
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.25.20.13 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 14 20:19:21 host2 sshd[2885680]: Disconnected from invalid user deploy 45.120.216.232 port 59678 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.100.59
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.147.100.59 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.178.206.88
country_id: 2635167
description:
2025-12-14 20:19:23 dovecot_login authenticator failed for host86-178-206-88.range86-178.btcentralplus.com ([89.116.164.85]) [86.178.206.88]:48206: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 14 20:19:58 host2 sshd[2886098]: Disconnected from invalid user web1 45.120.216.232 port 43936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 14 20:20:20 host2 sshd[2886548]: Disconnected from invalid user username 172.173.117.246 port 41496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 14 20:20:37 host2 sshd[2886753]: Disconnected from invalid user admin 45.120.216.232 port 56428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 14 20:20:57 host2 sshd[2886988]: Disconnected from invalid user admin 198.98.56.205 port 42370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 14 20:20:33 host2 sshd[2886720]: Disconnected from invalid user admin 45.172.152.74 port 39586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 14 20:21:50 host2 sshd[2887712]: Disconnected from invalid user eric 45.172.152.74 port 51168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-14 20:21:51 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:56510: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Dec 14 20:21:53 host2 sshd[2887736]: Disconnected from invalid user brandon 138.204.127.54 port 52333 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 14 20:22:04 host2 sshd[2887916]: Disconnected from invalid user admin 198.98.56.205 port 33726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.157
country_id: 3865483
description:
Dec 14 20:21:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.249.157, lip=66.85.158.91, TLS, session=<IY4EoOpFAYCzAPmd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.41
country_id: 798544
description:
Dec 14 20:21:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.236.172.41, lip=66.85.158.91, TLS, session=<Xs9noepFK5hb7Kwp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 14 20:23:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<H+qjpupFlIM+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 14 20:23:08 host2 sshd[2888681]: Disconnected from invalid user report 198.98.56.205 port 59344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-14 20:22:29 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:51590: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 14 20:22:26 host2 sshd[2888156]: Disconnected from invalid user admin 172.173.117.246 port 37336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 20:23:28 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (prophing) [174.166.153.20]:55750: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Dec 14 20:23:56 host2 sshd[2889286]: Disconnected from invalid user zhangfeng 190.119.63.98 port 45051 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 14 20:24:11 host2 sshd[2889533]: Disconnected from invalid user user1 198.98.56.205 port 40068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.165
country_id: 3658394
description:
2025-12-14 20:25:12 dovecot_plain authenticator failed for ([89.116.164.85]) [181.199.46.165]:47007: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 14 20:24:32 host2 sshd[2889792]: Disconnected from invalid user admin 172.173.117.246 port 43276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.28.147.93
country_id: 3469034
description:
2025-12-14 20:24:38 dovecot_plain authenticator failed for ([89.116.164.85]) [189.28.147.93]:49734: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.119.63.98
country_id: 3932488
description:
Dec 14 20:24:41 host2 sshd[2889901]: Disconnected from invalid user gbasedbt 190.119.63.98 port 40363 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.125.151.10
country_id: 1694008
description:
2025-12-14 20:24:56 dovecot_plain authenticator failed for ([89.116.164.85]) [103.125.151.10]:42288: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.214.5
country_id: 1733045
description:
2025-12-14 20:25:02 dovecot_plain authenticator failed for ([89.116.164.85]) [113.211.214.5]:37272: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 14 20:24:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<BShBrOpF6LA+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.42.95.26
country_id: 1269750
description:
2025-12-14 20:24:40 dovecot_plain authenticator failed for ([89.116.164.85]) [49.42.95.26]:40310: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-14 20:26:05 dovecot_login authenticator failed for (177-174-16-81.user.vivozap.com.br) [177.174.16.55]:47782: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.78.85.229
country_id: 798549
description:
2025-12-14 20:26:09 dovecot_plain authenticator failed for ([89.116.164.85]) [82.78.85.229]:44484: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-14 20:26:17 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:55635: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Dec 14 20:25:28 host2 sshd[2890726]: Disconnected from invalid user bob 190.119.63.98 port 54182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.188.115.193
country_id: 2378080
description:
2025-12-14 20:25:43 dovecot_plain authenticator failed for ([89.116.164.85]) [41.188.115.193]:17729: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.78.86
country_id: 99237
description:
2025-12-14 20:25:56 dovecot_plain authenticator failed for ([89.116.164.85]) [185.187.78.86]:48135: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Dec 14 20:27:07 host2 sshd[2892020]: Disconnected from invalid user damien 190.119.63.98 port 27804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.93.3.185
country_id: 3469034
description:
2025-12-14 20:28:50 dovecot_plain authenticator failed for ([89.116.164.85]) [179.93.3.185]:57949: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.178.203.5
country_id: 3865483
description:
2025-12-14 20:29:05 dovecot_plain authenticator failed for ([89.116.164.85]) [201.178.203.5]:54012: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-14 20:29:53 dovecot_login authenticator failed for ([128.185.201.138]) [128.185.201.138]:57316: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-14 20:30:05 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:58367: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 14 20:31:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<wFOFxOpF0Mw+PIdd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.232.123.136
country_id: 3469034
description:
2025-12-14 20:31:31 dovecot_plain authenticator failed for ([89.116.164.85]) [168.232.123.136]:24973: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Dec 14 20:31:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS: Connection closed, session=<47RixepFFsanXpI2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.226.108.136
country_id: 3865483
description:
2025-12-14 20:31:44 dovecot_plain authenticator failed for host136.190-226-108.telecom.net.ar ([89.116.164.85]) [190.226.108.136]:41657: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.176.236.2
country_id: 3865483
description:
2025-12-14 20:31:58 dovecot_plain authenticator failed for ([89.116.164.85]) [190.176.236.2]:40086: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 14 20:31:59 host2 pure-ftpd[2896232]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 14 20:32:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<b6uKyepFbMbCw3NV>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.61.117.214
country_id: 587116
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.61.117.214 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.129.44.235
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 150.129.44.235 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.183.204.112
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.183.204.112 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.74.74.42
country_id: 1220409
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.74.74.42 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.96.127.131
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.96.127.131 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-14 20:34:41 dovecot_login authenticator failed for (201.172.89.74-clientes-izzi.mx) [201.172.89.74]:41487: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.106.73.119
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.106.73.119 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-14 20:35:12 dovecot_login authenticator failed for ([182.79.136.105]) [122.187.60.126]:58710: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.194.158.110
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.194.158.110 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-14 20:35:29 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:41407: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-14 20:35:43 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (antripsh) [24.23.125.83]:40388: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-14 20:35:47 dovecot_plain authenticator failed for (antelaed) [64.72.74.162]:38968: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-14 20:36:04 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:56012: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 20:36:54 host2 sshd[2900556]: Disconnected from invalid user admin 2.57.121.112 port 49762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-14 20:36:24 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:42249: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 14 20:38:06 host2 sshd[2901500]: Disconnected from invalid user finance 179.33.186.151 port 20670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.70.200.42
country_id: 6252001
description:
2025-12-14 20:37:25 dovecot_plain authenticator failed for ([89.116.164.85]) [99.70.200.42]:49809: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.138.56.154
country_id: 3996063
description:
2025-12-14 20:37:37 dovecot_plain authenticator failed for ([89.116.164.85]) [189.138.56.154]:45994: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 14 20:37:39 host2 sshd[2901125]: Disconnected from invalid user auditor 195.178.191.5 port 50928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 14 20:40:25 host2 sshd[2903836]: Disconnected from invalid user nino 104.244.74.84 port 43220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-12-14 20:40:42 dovecot_login authenticator failed for ([203.145.142.243]) [203.145.142.243]:41342: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.0.130.240
country_id: 953987
description:
2025-12-14 20:42:06 dovecot_plain authenticator failed for 169-0-130-240.ip.ahisp.co.za ([89.116.164.85]) [169.0.130.240]:39227: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.123.91
country_id: 99237
description:
2025-12-14 20:41:39 dovecot_plain authenticator failed for ([89.116.164.85]) [212.237.123.91]:15712: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-14 20:41:46 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:60686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-14 20:41:27 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:50184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-14 20:41:39 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:45373: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 14 20:41:42 host2 sshd[2904945]: Disconnected from invalid user zomboid 104.244.74.84 port 38880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.80.29.110
country_id: 3686110
description:
2025-12-14 20:41:51 dovecot_plain authenticator failed for ([89.116.164.85]) [186.80.29.110]:15468: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 14 20:41:58 host2 sshd[2905186]: Received disconnect from 195.178.191.5 port 60466:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-14 20:41:22 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:44246: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-14 20:41:25 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:48666: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 14 20:42:23 host2 sshd[2905496]: Disconnected from invalid user hadoop 195.178.191.5 port 55954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.24
country_id: 6252001
description:
2025-12-14 20:44:25 dovecot_login authenticator failed for ([72.214.133.24]) [72.214.133.24]:55310: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.159
country_id: 6252001
description:
2025-12-14 20:44:36 dovecot_login authenticator failed for ([98.185.120.159]) [98.185.120.159]:43540: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 14 20:44:52 host2 sshd[2907451]: Disconnected from invalid user openbravo 104.244.74.84 port 42112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 14 20:46:16 host2 sshd[2908822]: Disconnected from invalid user es 104.244.74.84 port 37756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.171.2
country_id: 3923057
description:
2025-12-14 20:47:48 dovecot_plain authenticator failed for ([89.116.164.85]) [181.115.171.2]:1447: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.246.61
country_id: 630336
description:
2025-12-14 20:48:02 dovecot_plain authenticator failed for ([89.116.164.85]) [178.172.246.61]:60760: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.117.183.180
country_id: 3865483
description:
2025-12-14 20:47:35 dovecot_plain authenticator failed for host180.200-117-183.telecom.net.ar ([89.116.164.85]) [200.117.183.180]:38898: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 20:47:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<nlh+/upF0qg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-14 20:48:49 dovecot_plain authenticator failed for (emisping) [65.20.133.208]:51390: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-14 20:49:35 dovecot_plain authenticator failed for (uplamah) [91.73.188.251]:51337: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-14 20:49:37 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:56142: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2025-12-14 20:49:59 dovecot_login authenticator failed for ([49.124.152.247]) [49.124.152.247]:35918: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.214.60.28
country_id: 630336
description:
2025-12-14 20:50:41 dovecot_plain authenticator failed for ([89.116.164.85]) [37.214.60.28]:2631: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.128.123
country_id: 1269750
description:
2025-12-14 20:51:00 dovecot_plain authenticator failed for ([89.116.164.85]) [49.43.128.123]:35944: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-14 20:51:03 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:44279: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.222.238.47
country_id: 298795
description:
2025-12-14 20:51:14 dovecot_plain authenticator failed for ([89.116.164.85]) [82.222.238.47]:52104: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-14 20:51:31 dovecot_login authenticator failed for ([182.95.63.10]) [182.95.63.10]:59266: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 14 20:55:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<+W4bG+tFKuM+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-14 20:55:46 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:57305: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.16.66.80
country_id: 3865483
description:
2025-12-14 20:56:46 dovecot_plain authenticator failed for ([89.116.164.85]) [181.16.66.80]:52768: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.232.131.175
country_id: 3932488
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.232.131.175 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.241
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 181.46.164.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.221.173.30
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.221.173.30 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.12.168.204
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.12.168.204 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.20.225.138
country_id: 3923057
description:
2025-12-14 20:56:31 dovecot_plain authenticator failed for ([89.116.164.85]) [160.20.225.138]:36554: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.68.233
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.205.68.233 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.43.41
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.19.43.41 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.24.21.84
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.24.21.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.63.140
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.100.63.140 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2025-12-14 20:58:16 dovecot_login authenticator failed for ([202.22.204.23]) [202.22.204.23]:46747: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 20:59:14 host2 sshd[2921984]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-14 20:58:31 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:58482: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 20:58:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Rb7aJutFzoQ+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.235.7.161
country_id: 3077311
description:
Dec 14 20:59:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=109.235.7.161, lip=66.85.158.91, TLS, session=<CUJrJutFCu5t6weh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.16.25
country_id: 2300660
description:
Dec 14 20:59:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.16.25, lip=66.85.158.91, TLS, session=<tFSGJ+tF9IApixAZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 14 20:59:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<9iclKutFMM0+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-12-14 21:00:04 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:34303: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-14 21:00:13 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:34114: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-14 21:00:20 dovecot_login authenticator failed for ([182.95.58.130]) [182.95.58.130]:39550: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-12-14 21:00:24 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:34228: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-14 21:01:12 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (lefleta) [71.62.34.216]:46036: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-14 21:01:20 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:40956: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.223
country_id: 3469034
description:
Dec 14 21:01:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.89.136.223, lip=66.85.158.91, TLS, session=<cXCILutFS7K+WYjf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.200
country_id: 1269750
description:
Dec 14 21:01:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=103.18.166.200, lip=66.85.158.91, TLS, session=<PmDyL+tFNOJnEqbI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-14 21:01:51 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:43022: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-12-14 21:03:22 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:36397: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-14 21:04:09 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:38053: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 14 21:04:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<FdLCO+tFVMw+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 14 21:04:59 host2 sshd[2927582]: Disconnected from invalid user msf 141.95.162.162 port 44562 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.203.128
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.232.203.128 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.193.240.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.193.240.28 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.180.218.202
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.180.218.202 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.230.205.95
country_id: 3932488
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.230.205.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.0.114.49
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 143.0.114.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 14 21:06:20 host2 sshd[2929533]: Disconnected from invalid user backend 158.69.213.129 port 44410 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.5
country_id: 798549
description:
Dec 14 21:05:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LntUPutFfJFV2YwF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.41.34.26
country_id: 298795
description:
2025-12-14 21:06:01 dovecot_plain authenticator failed for ([89.116.164.85]) [176.41.34.26]:41674: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.190
country_id: 3469034
description:
Dec 14 21:05:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.249.190, lip=66.85.158.91, TLS, session=<ZNkBPetFhIS60fm+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-14 21:06:08 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:42108: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.24.51.217
country_id: 3469034
description:
2025-12-14 21:05:40 dovecot_plain authenticator failed for ([89.116.164.85]) [177.24.51.217]:53916: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.88
country_id: 3865483
description:
Dec 14 21:05:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=179.0.250.88, lip=66.85.158.91, TLS, session=<3lRHPutFauazAPpY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 14 21:05:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<mq8UQOtFYKM+PIdl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.116.43.84
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.116.43.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.9.210.159
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 203.9.210.159 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Dec 14 21:06:30 host2 sshd[2929657]: Disconnected from invalid user alex 206.189.130.118 port 47682 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 14 21:06:40 host2 sshd[2929803]: Disconnected from invalid user admin 141.95.162.162 port 42936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 14 21:06:51 host2 sshd[2929944]: Disconnected from invalid user amin 102.176.81.29 port 52448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2025-12-14 21:06:52 dovecot_login authenticator failed for ([117.205.2.9]) [117.205.2.9]:49808: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-12-14 21:06:28 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:39469: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 14 21:07:25 host2 sshd[2930498]: Disconnected from invalid user baran 158.69.213.129 port 47858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-14 21:07:30 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:46021: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 14 21:07:37 host2 sshd[2930645]: Disconnected from invalid user misp 102.176.81.29 port 38834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 14 21:07:42 host2 sshd[2930722]: Disconnected from invalid user alex 141.95.162.162 port 56522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 14 21:09:04 host2 sshd[2932062]: Disconnected from invalid user sri 102.176.81.29 port 39810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-14 21:08:24 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:49984: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 14 21:08:28 host2 sshd[2931483]: Disconnected from invalid user malik 158.69.213.129 port 52740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.44
country_id: 6252001
description:
2025-12-14 21:08:33 dovecot_login authenticator failed for ([70.174.168.44]) [70.174.168.44]:53212: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 14 21:10:05 host2 sshd[2933162]: Disconnected from invalid user user 158.69.213.129 port 42960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 21:09:45 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (unfunturod) [96.230.65.90]:42780: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 21:09:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<vJajTetFRNpDzRqg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 14 21:10:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<YC0hUetFYIo+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.177.169.196
country_id: 6252001
description:
Dec 14 21:10:57 host2 sshd[2934103]: Disconnected from invalid user siteadmin 52.177.169.196 port 37868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-14 21:11:15 dovecot_plain authenticator failed for (evelly) [102.53.15.17]:52039: 535 Incorrect authentication data (set_id=test@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 21:11:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<IR4hVOtF7otDzRqg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 14 21:11:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<whYKVOtFHJM+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 14 21:12:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<+VcEVutFatc+PIdh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.177.169.196
country_id: 6252001
description:
Dec 14 21:12:56 host2 sshd[2935814]: Disconnected from invalid user xw 52.177.169.196 port 52354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 14 21:13:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<8UeXWutFaIQ+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.86.32.61
country_id: 3686110
description:
2025-12-14 21:14:02 dovecot_plain authenticator failed for ([89.116.164.85]) [186.86.32.61]:11497: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.36.110
country_id: 3469034
description:
2025-12-14 21:14:13 dovecot_plain authenticator failed for ([89.116.164.85]) [170.83.36.110]:7681: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.142.245
country_id: 3469034
description:
2025-12-14 21:14:26 dovecot_plain authenticator failed for 131-0-142-245.virtualnetminas.com.br ([89.116.164.85]) [131.0.142.245]:12286: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 14 21:14:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<qFHJX+tFnOY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-12-14 21:16:14 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:38415: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.153.232.98
country_id: 298795
description:
2025-12-14 21:16:23 dovecot_plain authenticator failed for ([89.116.164.85]) [85.153.232.98]:36251: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-14 21:16:28 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:61629: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.218.145.184
country_id: 6252001
description:
2025-12-14 21:16:36 dovecot_plain authenticator failed for 184.sub-97-218-145.myvzw.com ([89.116.164.85]) [97.218.145.184]:41506: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.11.169.201
country_id: 3469034
description:
2025-12-14 21:17:50 dovecot_plain authenticator failed for ([89.116.164.85]) [177.11.169.201]:10136: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.37.150.181
country_id: 3469034
description:
2025-12-14 21:18:02 dovecot_plain authenticator failed for ([89.116.164.85]) [177.37.150.181]:15182: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.57.17
country_id: 3469034
description:
2025-12-14 21:18:14 dovecot_plain authenticator failed for ([89.116.164.85]) [45.181.57.17]:37058: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.64.64.155
country_id: 3865483
description:
2025-12-14 21:18:15 dovecot_plain authenticator failed for ([89.116.164.85]) [186.64.64.155]:43524: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.15.77
country_id: 6252001
description:
2025-12-14 21:18:39 dovecot_plain authenticator failed for ([89.116.164.85]) [98.97.15.77]:42282: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 21:19:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<KHECb+tFxp1S38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.108.225.5
country_id: 3865483
description:
2025-12-14 21:18:27 dovecot_plain authenticator failed for host5.186-108-225.telecom.net.ar ([89.116.164.85]) [186.108.225.5]:40044: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 21:18:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<NViCbetFl6Ez0msW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.155.227.86
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.155.227.86 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.84.114.76
country_id: 1655842
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.84.114.76 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.116.250.163
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.116.250.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.130.238.23
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 177.130.238.23 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-14 21:20:08 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:48622: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.254.70.16
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 151.254.70.16 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.4.142.96
country_id: 798544
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 83.4.142.96 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.87.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.87.133 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-12-14 21:20:35 dovecot_login authenticator failed for ([125.19.93.105]) [182.95.50.154]:46564: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.5
country_id: 2635167
description:
Dec 14 21:21:24 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.5, lip=66.85.158.92, TLS, session=<l715d+tFJ6lX7LAF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.173.90.119
country_id: 298795
description:
2025-12-14 21:22:28 dovecot_plain authenticator failed for ([89.116.164.85]) [78.173.90.119]:27448: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.92.103.11
country_id: 719819
description:
2025-12-14 21:22:41 dovecot_plain authenticator failed for 4e5c670b.dsl.pool.telekom.hu ([89.116.164.85]) [78.92.103.11]:48130: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.79.185.34
country_id: 3469034
description:
2025-12-14 21:22:54 dovecot_plain authenticator failed for ([89.116.164.85]) [189.79.185.34]:54361: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 14 21:23:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<c9AHgOtF3tU+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 21:24:11 host2 sshd[2946590]: Disconnected from invalid user user 2.57.121.25 port 34042 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 14 21:24:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<u1hjgetFYqI+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-14 21:24:50 dovecot_login authenticator failed for ([46.212.35.53]) [46.212.35.53]:38704: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-14 21:25:01 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:39286: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 14 21:25:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<8K8XhetF+oM+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-14 21:25:20 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:44934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-14 21:24:42 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:47888: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-14 21:25:59 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:51232: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 21:26:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<vIbwh+tF2Mwv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-14 21:26:13 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (ulass) [78.68.37.25]:58162: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-14 21:26:18 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:45311: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 14 21:25:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<GVzkhutFbs4+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-14 21:26:30 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:48080: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 21:27:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ndLci+tFtr8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 21:27:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<rHMDjOtFBK8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 21:28:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<N7hMketFaK5o7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.41.201
country_id: 1819730
description:
Dec 14 21:29:01 host2 pure-ftpd[2950650]: (?@165.154.41.201) [INFO] New connection from 165.154.41.201


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.8
country_id: 798549
description:
Dec 14 21:29:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.8, lip=66.85.158.91, session=<tj5Jk+tFOelV2YwI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 21:28:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<root@essenceceylontea.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<g1b2kOtFUrQrpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 21:29:24 host2 sshd[2951009]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.8
country_id: 798549
description:
Dec 14 21:29:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.8, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pqtElOtFOuhV2YwI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.49.47.148
country_id: 6252001
description:
[2025-12-14 21:31:21 +0530] info [cpaneld] 76.49.47.148 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Dec 14 21:30:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.9, lip=66.85.158.91, TLS: Connection closed, session=<fNz+l+tFubJV2ZUJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 21:31:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<6SzFmetFjZYz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-14 21:31:13 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:44184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 21:31:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<yo+BnOtFBOHIaZyl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.230.194.229
country_id: 3996063
description:
[2025-12-14 21:31:24 +0530] info [cpaneld] 148.230.194.229 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.87.31.78
country_id: 3865483
description:
[2025-12-14 21:31:26 +0530] info [whostmgrd] 149.87.31.78 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.82.105.182
country_id: 3469034
description:
[2025-12-14 21:31:27 +0530] info [cpaneld] 170.82.105.182 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.230.103.126
country_id: 3469034
description:
[2025-12-14 21:31:29 +0530] info [cpaneld] 45.230.103.126 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 21:32:19 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (guiteadmod) [96.230.65.90]:37728: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.58.238.98
country_id: 3439705
description:
[2025-12-14 21:31:23 +0530] info [cpaneld] 167.58.238.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.0.12.249
country_id: 3469034
description:
[2025-12-14 21:31:30 +0530] info [cpaneld] 200.0.12.249 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-14 21:31:45 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:34268: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.40
country_id: 6252001
description:
2025-12-14 21:32:04 dovecot_login authenticator failed for ([98.181.46.40]) [98.181.46.40]:41194: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-14 21:32:48 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:50059: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 21:33:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<D4BZoutFoqOYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 14 21:34:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<lvBopOtFaKM+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-12-14 21:34:15 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (axing) [90.0.156.128]:39518: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-14 21:35:11 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:41672: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.176.50
country_id: 1861060
description:
2025-12-14 21:34:45 dovecot_login authenticator failed for p388051-obmd01.tokyo.ocn.ne.jp [60.45.176.50]:54518: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-14 21:35:12 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:32960: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-14 21:35:44 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:33002: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 21:36:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<EcYOrutFbhxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 21:38:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PizdsutF2oAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2025-12-14 21:38:49 dovecot_login authenticator failed for ([45.130.148.217]) [45.130.148.217]:44586: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.36
country_id: 6252001
description:
2025-12-14 21:39:08 dovecot_login authenticator failed for ([98.181.46.36]) [98.181.46.36]:56159: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 21:39:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<Rl8It+tFttVS38qm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.203
country_id: 6252001
description:
Dec 14 21:38:39 host2 pure-ftpd[2959685]: (?@135.237.126.203) [INFO] New connection from 135.237.126.203


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 21:39:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<plBeuOtFOuPIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-14 21:39:23 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:53260: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 21:40:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=</bKUvOtFRLaYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 21:40:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<WZrnvOtFLNkrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.35
country_id: 6252001
description:
2025-12-14 21:41:26 dovecot_login authenticator failed for ([98.181.46.35]) [98.181.46.35]:60087: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-14 21:41:52 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:35326: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.167.123.65
country_id: 390903
description:
2025-12-14 21:42:11 dovecot_plain authenticator failed for ppp079167123065.access.hol.gr ([89.116.164.85]) [79.167.123.65]:47872: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.42
country_id: 1643084
description:
Dec 14 21:42:22 host2 sshd[2963090]: Disconnected from invalid user game 103.171.85.42 port 37122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.196.36.128
country_id: 3469034
description:
2025-12-14 21:42:36 dovecot_login authenticator failed for ([89.116.164.85]) [200.196.36.128]:40117: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 21:42:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<BvdUw+tFppJDzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.233.82.245
country_id: 3932488
description:
2025-12-14 21:42:50 dovecot_login authenticator failed for ([89.116.164.85]) [190.233.82.245]:53580: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 14 21:43:15 host2 sshd[2963712]: Disconnected from invalid user ardi 35.145.253.68 port 47208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 14 21:44:02 host2 sshd[2964197]: Disconnected from invalid user game 118.194.250.47 port 46000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 14 21:44:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<gdddyetFbNE+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 14 21:43:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<cIQvxutFVL4+PIdh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 21:44:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<hkNSyutFNLlDzRqg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.28.214.49
country_id: 6251999
description:
Dec 14 21:44:49 host2 sshd[2964755]: Disconnected from invalid user es 104.28.214.49 port 10785 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.54.181.6
country_id: 298795
description:
2025-12-14 21:45:10 dovecot_plain authenticator failed for ([89.116.164.85]) [94.54.181.6]:53202: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 14 21:45:37 host2 sshd[2965441]: Disconnected from invalid user userb 35.145.253.68 port 47995 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.6.57.210
country_id: 3932488
description:
2025-12-14 21:45:23 dovecot_plain authenticator failed for ([89.116.164.85]) [179.6.57.210]:42914: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 14 21:45:31 host2 sshd[2965363]: Disconnected from invalid user test123 167.71.204.253 port 38650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-14 21:45:55 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:36732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.224.208.180
country_id: 3865483
description:
2025-12-14 21:45:37 dovecot_plain authenticator failed for host180.190-224-208.telecom.net.ar ([89.116.164.85]) [190.224.208.180]:39948: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-12-14 21:45:41 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:53288: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.214.49
country_id: 6251999
description:
Dec 14 21:46:30 host2 sshd[2966255]: Disconnected from invalid user ardi 104.28.214.49 port 10807 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-14 21:47:01 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:38568: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 14 21:46:46 host2 sshd[2966441]: Disconnected from invalid user sonar 35.145.253.68 port 47419 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.42
country_id: 1643084
description:
Dec 14 21:46:50 host2 sshd[2966525]: Disconnected from invalid user avahi 103.171.85.42 port 59844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 14 21:46:57 host2 sshd[2966674]: Disconnected from invalid user baran 118.194.250.47 port 54432 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 21:47:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<QMGu0utFJJanR+bm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Dec 14 21:47:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ugyu0+tFKjVAPsU+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.44.117.75
country_id: 3865483
description:
2025-12-14 21:48:14 dovecot_plain authenticator failed for ([89.116.164.85]) [181.44.117.75]:41654: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 14 21:48:19 host2 sshd[2967801]: Disconnected from invalid user test123 118.194.250.47 port 42124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 21:47:27 host2 sshd[2967089]: Disconnected from invalid user admin 62.60.131.157 port 23841 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Dec 14 21:47:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cATI1OtFZGxAPsU+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-14 21:47:31 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:49092: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Dec 14 21:47:46 host2 sshd[2967327]: Disconnected from invalid user avahi 101.36.107.103 port 52076 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.163.250.116
country_id: 6252001
description:
2025-12-14 21:48:02 dovecot_plain authenticator failed for 99-163-250-116.lightspeed.iplsin.sbcglobal.net ([89.116.164.85]) [99.163.250.116]:58164: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 14 21:49:02 host2 sshd[2968440]: Disconnected from invalid user facai 118.194.250.47 port 47888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 21:49:05 host2 sshd[2968521]: Disconnected from invalid user user 2.57.121.25 port 53285 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 21:50:08 host2 sshd[2969813]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.21.115
country_id: 241170
description:
Dec 14 21:50:11 host2 sshd[2969414]: Disconnected from invalid user avahi 154.222.21.115 port 56464 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-14 21:50:36 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:59942: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 14 21:51:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<2MSP4etFGq8+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 21:51:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<p7dr4utFUJ5S38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2025-12-14 21:51:02 dovecot_login authenticator failed for (host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:40716: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-12-14 21:50:26 dovecot_login authenticator failed for ([120.157.80.73]) [120.157.80.73]:51924: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-14 21:50:50 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:48040: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 21:51:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<4Vxt4etFiI8z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.42
country_id: 1643084
description:
Dec 14 21:51:02 host2 sshd[2971192]: Disconnected from invalid user ubuntu 103.171.85.42 port 53920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-14 21:52:19 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:46392: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 21:51:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<MHFw4utF1uE+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 14 21:51:27 host2 sshd[2971587]: Disconnected from invalid user baran 167.71.204.253 port 49148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 21:52:56 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52378: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.44.136.205
country_id: 1269750
description:
2025-12-14 21:56:48 dovecot_login authenticator failed for ([103.44.136.205]) [103.44.136.205]:49768: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2025-12-14 21:57:19 dovecot_login authenticator failed for ([49.124.148.2]) [49.124.148.2]:52732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.42
country_id: 1643084
description:
Dec 14 21:56:27 host2 sshd[2980617]: Disconnected from invalid user ghost 103.171.85.42 port 36792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.150
country_id: 6252001
description:
2025-12-14 21:58:07 dovecot_login authenticator failed for ([70.174.167.150]) [70.174.167.150]:56415: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 14 21:58:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Z4RK++tFANo+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 14 21:58:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<47Is++tFMNA+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.71
country_id: 6252001
description:
Dec 14 21:57:21 host2 sshd[2986202]: Disconnected from invalid user cluster 107.173.10.71 port 43996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-12-14 21:57:49 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:60812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.209.225.104
country_id: 2921044
description:
Dec 14 21:58:55 host2 sshd[2991061]: Disconnected from invalid user fts 134.209.225.104 port 36078 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 14 21:59:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WgszAexFdJU+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 14 22:00:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<uxX/AexFFsk+PIdd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Dec 14 21:59:26 host2 sshd[2991503]: Disconnected from invalid user administrator 134.209.225.104 port 36834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.71
country_id: 6252001
description:
Dec 14 21:59:36 host2 sshd[2991647]: Disconnected from invalid user x 107.173.10.71 port 44176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 14 22:01:45 host2 sshd[2993911]: Disconnected from invalid user thor 201.249.192.30 port 18214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 22:01:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rSwiCOxF6OYv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 14 22:02:31 host2 sshd[2994582]: Disconnected from invalid user kafka 201.249.192.30 port 19676 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 22:03:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<h+LpDOxFtNov+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.67
country_id: 6252001
description:
Dec 14 22:03:14 host2 pure-ftpd[2995422]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 14 22:03:17 host2 sshd[2995418]: Disconnected from invalid user dev 201.249.192.30 port 10156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-14 22:03:49 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (overous) [89.67.37.2]:34816: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-14 22:04:11 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:55544: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2025-12-14 22:04:49 dovecot_login authenticator failed for ([49.124.155.189]) [49.124.155.189]:57466: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 22:04:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=</e1OEuxFcpwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 22:05:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ht7AFuxFa5oz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 22:06:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<FifHF+xFgAVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 22:06:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<T/ijGOxF8ovIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 22:07:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<ivXkGuxFiI+B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.47.243.18
country_id: 3469034
description:
2025-12-14 22:07:12 dovecot_plain authenticator failed for ([89.116.164.85]) [177.47.243.18]:28113: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.98.76
country_id: 1880251
description:
2025-12-14 22:06:43 dovecot_login authenticator failed for ([124.246.98.76]) [124.246.98.76]:48226: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-14 22:06:45 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:39932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-14 22:06:55 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:50458: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.193.21.28
country_id: 6252001
description:
2025-12-14 22:06:59 dovecot_plain authenticator failed for c-71-193-21-28.hsd1.ca.comcast.net ([89.116.164.85]) [71.193.21.28]:47386: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2025-12-14 22:07:04 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:51368: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 22:08:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<RExFHuxFKog+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.169.219.56
country_id: 3469034
description:
2025-12-14 22:07:25 dovecot_plain authenticator failed for ([89.116.164.85]) [45.169.219.56]:31488: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 14 22:07:34 host2 sshd[2999912]: Disconnected from invalid user adnan 201.249.192.30 port 34949 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 14 22:07:45 host2 sshd[3000068]: Disconnected from invalid user chrome 172.191.239.155 port 57978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 22:09:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<+9F7JOxFopErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 22:10:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<bl4kJuxF6NKYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 22:10:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<VsjMJ+xFktA+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.230
country_id: 6252001
description:
Dec 14 22:10:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=147.185.132.230, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6woRKOxFbsaTuYTm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-14 22:10:53 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:57690: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-14 22:11:05 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:33163: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 14 22:11:10 host2 sshd[3003975]: Disconnected from invalid user usuario2 172.191.239.155 port 39166 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Dec 14 22:10:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.92, session=<J3YBJ+xFBAm4affE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 14 22:10:34 host2 sshd[3003273]: Disconnected from invalid user admin2 172.191.239.155 port 56668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.56.192.189
country_id: 99237
description:
2025-12-14 22:13:16 dovecot_login authenticator failed for ([89.116.164.85]) [185.56.192.189]:27326: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 22:14:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<q1CzNexFvrNo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-14 22:15:29 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (brefy) [75.74.211.27]:37234: 535 Incorrect authentication data (set_id=orders@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 22:15:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<I90LOexFLNpS38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-14 22:15:42 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:40832: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.69.147
country_id: 3374766
description:
2025-12-14 22:15:53 dovecot_login authenticator failed for ([154.203.69.147]) [154.203.69.147]:35489: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-14 22:15:53 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:45214: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 22:16:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<5AcGPOxFhJAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-14 22:16:30 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:36380: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-14 22:16:37 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:57670: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
country_id: 294640
description:
2025-12-14 22:16:50 dovecot_login authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:53478: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-14 22:17:07 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:55280: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 22:17:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<KbzkPuxFwJvIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 22:17:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Gl7hQOxFzteYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 14 22:18:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<9ndYQ+xFjsvBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 22:19:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<Zj6ORuxFlttDzRqg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.230
country_id: 6252001
description:
Dec 14 22:19:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.230, lip=66.85.158.92, TLS, session=<8a9vR+xFdPqTuYTm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.84.120
country_id: 6252001
description:
Dec 14 22:21:07 host2 pure-ftpd[3017667]: (?@198.199.84.120) [INFO] New connection from 198.199.84.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-14 22:21:13 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:59150: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 22:21:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<cmuRTexFusxDzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-14 22:21:54 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:49312: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-14 22:22:12 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:47918: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.165
country_id: 2993457
description:
Dec 14 22:23:32 host2 pure-ftpd[3020932]: (?@194.165.16.165) [INFO] New connection from 194.165.16.165


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-14 22:24:58 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (janthuk) [73.224.171.101]:48896: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 22:27:02 host2 sshd[3026068]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.232.58.205
country_id: 3996063
description:
2025-12-14 22:26:15 dovecot_plain authenticator failed for ([89.116.164.85]) [187.232.58.205]:54438: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.191.46.247
country_id: 3625428
description:
2025-12-14 22:26:34 dovecot_plain authenticator failed for ([89.116.164.85]) [38.191.46.247]:57262: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 22:27:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<7n43ZexFuKFS38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 22:28:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<GNXoZexFq6Uz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.38
country_id: 3175395
description:
Dec 14 22:30:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.38, lip=66.85.158.91, TLS, session=<7RFVbOxFlc+5xQkm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.97
country_id: 3175395
description:
Dec 14 22:29:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=217.26.179.97, lip=66.85.158.91, TLS, session=<zAQ6a+xFhMvZGrNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-12-14 22:32:00 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:56786: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-14 22:31:42 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (moreval) [67.173.58.47]:53510: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.211.219.73
country_id: 3175395
description:
2025-12-14 22:31:48 dovecot_login authenticator failed for host-62-211-219-73.pool62211.interbusiness.it ([185.196.221.176]) [62.211.219.73]:50546: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 14 22:33:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<xt7Od+xFPIw+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 14 22:33:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<mp28euxF4Kc+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.41
country_id: 6252001
description:
2025-12-14 22:35:38 dovecot_login authenticator failed for ([98.181.46.41]) [98.181.46.41]:34203: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-14 22:36:28 dovecot_plain authenticator failed for (caffies) [199.192.123.12]:49816: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-14 22:36:31 dovecot_login authenticator failed for (cm-84.213.189.159.get.no) [84.213.189.159]:53515: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.73
country_id: 6252001
description:
Dec 14 22:37:17 host2 pure-ftpd[3042563]: (?@198.235.24.73) [INFO] New connection from 198.235.24.73


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 14 22:37:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<GZoqh+xFSO0+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-14 22:37:35 dovecot_plain authenticator failed for (cullin) [5.31.23.133]:54232: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-14 22:37:50 dovecot_plain authenticator failed for (marge) [105.114.21.51]:40480: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2025-12-14 22:37:58 dovecot_login authenticator failed for ([49.124.151.14]) [49.124.151.14]:53104: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-14 22:39:10 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:33512: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 22:39:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<93mEjexF1JYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 14 22:39:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<CL1oj+xFboY+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-14 22:40:55 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:41345: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2025-12-14 22:41:05 dovecot_login authenticator failed for ([49.124.154.172]) [49.124.154.172]:38170: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 22:40:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<RmBAkuxFMIov+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-14 22:40:44 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:56322: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-12-14 22:41:20 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:57073: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-12-14 22:41:32 dovecot_login authenticator failed for (static-200-85-150173.vnet.bo) [200.85.150.173]:59756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-14 22:42:00 dovecot_login authenticator failed for (191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:54158: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.13.211.254
country_id: 3865483
description:
2025-12-14 22:42:08 dovecot_plain authenticator failed for ([89.116.164.85]) [186.13.211.254]:51667: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-14 22:42:08 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:32892: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.87.217.252
country_id: 3865483
description:
2025-12-14 22:42:41 dovecot_plain authenticator failed for ([89.116.164.85]) [181.87.217.252]:56566: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 22:43:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<bwhhm+xF+LAz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 22:43:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1cZzm+xFSKcvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.13.211.254
country_id: 3865483
description:
2025-12-14 22:42:17 dovecot_login authenticator failed for ([89.116.164.85]) [186.13.211.254]:51667: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.208.245.210
country_id: 3469034
description:
2025-12-14 22:42:20 dovecot_plain authenticator failed for ([89.116.164.85]) [143.208.245.210]:50207: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.179
country_id: 1733045
description:
2025-12-14 22:42:20 dovecot_login authenticator failed for ([49.124.159.179]) [49.124.159.179]:35192: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-14 22:42:29 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:32830: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 22:44:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<bCHnnuxFaCBo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-14 22:47:06 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:41986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 14 22:47:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<9MoIquxFUrE+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 22:47:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<nZDvquxFDKLIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.173.59.73
country_id: 1605651
description:
2025-12-14 22:47:31 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.173.59.73]:34533: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-14 22:47:45 dovecot_plain authenticator failed for (progenter) [5.31.23.133]:53944: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-14 22:47:50 dovecot_plain authenticator failed for (psupswism) [65.20.143.159]:43926: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 22:47:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<fPi5quxFINiYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2025-12-14 22:48:30 dovecot_login authenticator failed for ([152.52.220.126]) [152.52.220.126]:46802: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-14 22:48:51 dovecot_login authenticator failed for (54-170-97-62.cust.smartcall.no) [62.97.170.54]:58918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 14 22:52:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<ZlORu+xFxJg+PIdh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-14 22:51:31 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:60190: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 22:52:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<89LMvuxFQqGnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 22:52:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ORgavOxFPC5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 22:52:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<12aGvOxFQOBS38qm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 14 22:53:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS: Connection closed, session=<rc/Uv+xFxn5ChJmA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 22:54:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<0SDixOxF8sYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 22:54:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<kG9PxexFeLaYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 22:54:20 host2 sshd[3067992]: Disconnected from invalid user user 2.57.121.25 port 28793 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 22:56:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<OvioyexFfrhDzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-14 22:56:53 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:57230: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 22:57:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<40UA0OxFRNjIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-14 22:57:57 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:35898: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 22:57:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<Ob3G0OxFVt5DzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-14 22:57:32 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:55871: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 14 22:57:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<dsf2z+xF5o4+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Dec 14 22:57:46 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.222, lip=66.85.158.92, session=<VqAY0OxFAI6s7OTe>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.195.150
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 152.42.195.150 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-14 22:58:34 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:59874: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 14 23:00:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<t1oX2exFnMs+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 23:00:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<kkm82exFOKw+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-14 23:01:47 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:37811: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-14 23:02:07 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:50009: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.10.94.237
country_id: 3865483
description:
2025-12-14 23:02:25 dovecot_plain authenticator failed for host237.181-10-94.telecom.net.ar ([89.116.164.85]) [181.10.94.237]:35757: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.155.209.112
country_id: 2264397
description:
2025-12-14 23:02:39 dovecot_plain authenticator failed for a89-155-209-112.cpe.netcabo.pt ([89.116.164.85]) [89.155.209.112]:45888: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.197.89.89
country_id: 6252001
description:
2025-12-14 23:02:50 dovecot_plain authenticator failed for 108-197-89-89.lightspeed.mdldtx.sbcglobal.net ([89.116.164.85]) [108.197.89.89]:34452: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 23:03:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vEJR5exF4I8rpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 23:04:11 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:64575: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-14 23:04:28 dovecot_login authenticator failed for ([180.94.75.42]) [180.94.75.42]:46613: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.46
country_id: 6252001
description:
Dec 14 23:04:53 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.46, lip=66.85.158.92, session=<Ig2Z6exF6uOsaAsu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 23:05:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<YmPi6exFPKlS38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 23:05:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<KNMw6+xFTOOnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 23:05:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Fw3h6+xFSb8z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-14 23:06:05 dovecot_plain authenticator failed for (bered) [12.150.243.22]:19752: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-14 23:06:36 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:51014: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-12-14 23:06:46 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:59150: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.248
country_id: 6252001
description:
2025-12-14 23:06:58 dovecot_login authenticator failed for ([98.185.121.248]) [98.185.121.248]:35851: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.130.79
country_id: 2077456
description:
2025-12-14 23:07:08 dovecot_login authenticator failed for (61-69-130-79.static.tpgi.com.au) [61.69.130.79]:36882: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 14 23:07:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<xWGj8exFgqQ+PIdr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.52.50.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 174.52.50.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.53.231.221
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.53.231.221 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.136.26.28
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 110.136.26.28 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-12-14 23:08:05 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:33143: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.239.91.169
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.239.91.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.241.13
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.232.241.13 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.203.126.119
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 94.203.126.119 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.99.220.117
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 92.99.220.117 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-14 23:08:50 dovecot_login authenticator failed for (54-170-97-62.cust.smartcall.no) [62.97.170.54]:45416: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.236.122.222
country_id: 6252001
description:
Dec 14 23:09:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 21 secs): user=<>, rip=18.236.122.222, lip=66.85.158.92, TLS: Connection closed, session=<gFa++OxFMLYS7Hre>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 14 23:09:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<nis4+exFdJk+PIdd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.204
country_id: 6252001
description:
Dec 14 23:11:09 host2 pure-ftpd[3092475]: (?@198.235.24.204) [INFO] New connection from 198.235.24.204


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 14 23:11:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<bFhOAu1FBNQ+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-14 23:12:51 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:59174: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-14 23:13:05 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:55612: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 14 23:13:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Oz28CO1FvKY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-14 23:13:39 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:49878: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.147.94.97
country_id: 6290252
description:
2025-12-14 23:14:02 dovecot_plain authenticator failed for ([89.116.164.85]) [89.147.94.97]:47690: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-14 23:13:25 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:55380: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.223.101.104
country_id: 298795
description:
2025-12-14 23:14:28 dovecot_plain authenticator failed for ([89.116.164.85]) [31.223.101.104]:44973: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.110.12.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.110.12.79 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.81.184.155
country_id: 3865483
description:
2025-12-14 23:15:11 dovecot_plain authenticator failed for ([89.116.164.85]) [191.81.184.155]:38866: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.19.141.210
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.19.141.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.225.55.182
country_id: 6252001
description:
2025-12-14 23:14:14 dovecot_plain authenticator failed for 182.sub-97-225-55.myvzw.com ([89.116.164.85]) [97.225.55.182]:33578: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.174.52.182
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.174.52.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.89.12.36
country_id: 3469034
description:
2025-12-14 23:15:44 dovecot_plain authenticator failed for 189-89-12-36.jupiterprovedor.com.br ([89.116.164.85]) [189.89.12.36]:36912: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.82.183
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 191.5.82.183 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.183.106
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.8.183.106 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.81.0.133
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.81.0.133 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.255.217
country_id: 3469034
description:
2025-12-14 23:15:27 dovecot_plain authenticator failed for ([89.116.164.85]) [45.191.255.217]:53795: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.174.109.206
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.174.109.206 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.81.184.155
country_id: 3865483
description:
2025-12-14 23:15:18 dovecot_login authenticator failed for ([89.116.164.85]) [191.81.184.155]:38866: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 14 23:16:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS: Connection closed, session=<eJObE+1FLpdChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.6.6.179
country_id: 3865483
description:
2025-12-14 23:16:53 dovecot_plain authenticator failed for ([89.116.164.85]) [45.6.6.179]:52214: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 23:17:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<FCP0FO1FRrUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.244.153.112
country_id: 99237
description:
2025-12-14 23:16:23 dovecot_plain authenticator failed for ([89.116.164.85]) [185.244.153.112]:38141: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.44.64
country_id: 3865483
description:
2025-12-14 23:16:37 dovecot_plain authenticator failed for ([89.116.164.85]) [45.181.44.64]:44117: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.159.152
country_id: 6252001
description:
Dec 14 23:18:19 host2 sshd[3102066]: Disconnected from invalid user fernando 43.135.159.152 port 49756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 23:18:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<7fDXGe1FwKgv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.1.63
country_id: 1168579
description:
2025-12-14 23:18:51 dovecot_plain authenticator failed for ([89.116.164.85]) [154.192.1.63]:58454: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-14 23:18:56 dovecot_plain authenticator failed for (podly) [12.150.243.22]:30649: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.167.22.89
country_id: 102358
description:
2025-12-14 23:19:06 dovecot_plain authenticator failed for ([89.116.164.85]) [31.167.22.89]:50298: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.167.22.89
country_id: 102358
description:
2025-12-14 23:19:13 dovecot_login authenticator failed for ([89.116.164.85]) [31.167.22.89]:50298: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.247.120.232
country_id: 3686110
description:
2025-12-14 23:19:24 dovecot_plain authenticator failed for ([89.116.164.85]) [77.247.120.232]:44442: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 23:19:37 host2 sshd[3103819]: Disconnected from invalid user user 2.57.121.25 port 51702 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-14 23:20:09 dovecot_plain authenticator failed for (poringoisa) [102.53.15.56]:49582: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.135.159.152
country_id: 6252001
description:
Dec 14 23:20:45 host2 sshd[3105495]: Disconnected from invalid user weblogic 43.135.159.152 port 55214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 23:20:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<sZrWIu1FO84z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.245.123.158
country_id: 3469034
description:
2025-12-14 23:21:29 dovecot_plain authenticator failed for ([89.116.164.85]) [170.245.123.158]:49890: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.14.20.239
country_id: 798549
description:
Dec 14 23:21:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=31.14.20.239, lip=66.85.158.91, TLS, session=<jJ3rJO1FvuIfDhTv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-14 23:21:15 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:55902: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.141
country_id: 99237
description:
Dec 14 23:21:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=65.20.213.141, lip=66.85.158.91, TLS, session=<28qpI+1FcsVBFNWN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 23:21:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<tHk8Ju1FRAgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 23:21:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<LyugJu1FhuVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.38.109.237
country_id: 3865483
description:
2025-12-14 23:22:05 dovecot_plain authenticator failed for ([89.116.164.85]) [179.38.109.237]:35150: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-14 23:22:08 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:39032: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-14 23:21:42 dovecot_login authenticator failed for (nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:56702: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.53.230.195
country_id: 6252001
description:
2025-12-14 23:21:41 dovecot_plain authenticator failed for 75-53-230-195.lightspeed.hstntx.sbcglobal.net ([89.116.164.85]) [75.53.230.195]:38622: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 23:21:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Nzn1Je1FdOQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.38.109.237
country_id: 3865483
description:
2025-12-14 23:22:16 dovecot_login authenticator failed for ([89.116.164.85]) [179.38.109.237]:35150: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-14 23:22:25 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:32784: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.159.152
country_id: 6252001
description:
Dec 14 23:22:35 host2 sshd[3107974]: Disconnected from invalid user ansible 43.135.159.152 port 52162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-14 23:22:42 dovecot_login authenticator failed for ([149.54.62.62]) [149.54.62.62]:35433: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-14 23:23:01 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:50174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-14 23:23:45 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (super) [24.15.216.41]:38856: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 23:24:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<uF62MO1FhuSYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 23:24:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<i5DhMO1FtOQ+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-12-14 23:25:41 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:52822: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-14 23:25:59 dovecot_login authenticator failed for ([209.202.195.148]) [209.202.195.148]:45690: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.144.90.38
country_id: 6252001
description:
Dec 14 23:26:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=18.144.90.38, lip=66.85.158.91, TLS: Connection closed, session=<94i4Nu1FwJASkFom>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-12-14 23:26:44 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:42440: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-14 23:26:44 dovecot_plain authenticator failed for (preing) [88.207.210.23]:59711: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-12-14 23:26:49 dovecot_plain authenticator failed for (hurist) [109.226.27.227]:53389: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.204.9.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.204.9.239 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.37.130.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.37.130.203 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.130.134.68
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.130.134.68 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-14 23:28:10 dovecot_login authenticator failed for 40-54-166-83.dyn.estpak.ee [83.166.54.40]:43645: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.59.210.227
country_id: 1522867
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.59.210.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.63.33
country_id: 6252001
description:
2025-12-14 23:27:20 dovecot_login authenticator failed for ([98.181.63.33]) [98.181.63.33]:35078: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.239.67.117
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.239.67.117 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.32.241.229
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 181.32.241.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.217.39
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.81.217.39 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-14 23:28:24 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:34938: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-14 23:28:43 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:41200: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 23:28:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<mTr0Pu1FzozIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-14 23:29:10 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:40472: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-12-14 23:29:30 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:51706: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 23:30:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<h1lqQ+1FmOVS38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 23:30:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<olygRO1FWmdo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-12-14 23:31:29 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:58620: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.196.177
country_id: 6252001
description:
Dec 14 23:31:38 host2 sshd[3120380]: Disconnected from invalid user vpsuser 172.172.196.177 port 52730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-14 23:31:42 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:41738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-14 23:31:44 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:51276: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.224.93.98
country_id: 3865483
description:
2025-12-14 23:32:53 dovecot_plain authenticator failed for host98.190-224-93.telecom.net.ar ([89.116.164.85]) [190.224.93.98]:46098: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.65.93.156
country_id: 3469034
description:
2025-12-14 23:33:06 dovecot_plain authenticator failed for ([89.116.164.85]) [186.65.93.156]:45944: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 23:32:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<KcN6S+1F2IOYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2025-12-14 23:32:27 dovecot_login authenticator failed for ([128.185.194.190]) [128.185.194.190]:41006: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-14 23:32:44 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:46234: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2025-12-14 23:34:09 dovecot_login authenticator failed for (host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:38388: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.65.93.156
country_id: 3469034
description:
2025-12-14 23:33:13 dovecot_login authenticator failed for ([89.116.164.85]) [186.65.93.156]:45944: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.1.161.191
country_id: 3469034
description:
2025-12-14 23:33:20 dovecot_plain authenticator failed for 177-1-161-191.user3p.v-tal.net.br ([89.116.164.85]) [177.1.161.191]:55576: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 23:33:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<qrGhUO1F7uhDzRqg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 23:33:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<pA08T+1FxOCnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 23:33:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<aQozUO1FsOUvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-14 23:33:44 dovecot_login authenticator failed for (187-50-226-182.customer.tdatabrasil.net.br) [187.50.226.182]:41408: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-14 23:33:15 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:35698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 23:33:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<59L8Tu1FDosrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-12-14 23:33:18 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:45597: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.196.177
country_id: 6252001
description:
Dec 14 23:34:37 host2 sshd[3124171]: Disconnected from invalid user deploy 172.172.196.177 port 34226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.203.232.62
country_id: 6252001
description:
2025-12-14 23:34:52 dovecot_plain authenticator failed for ([89.116.164.85]) [47.203.232.62]:59616: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 14 23:34:53 host2 sshd[3124448]: Disconnected from invalid user admin 162.19.224.161 port 33540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.17.68
country_id: 3996063
description:
2025-12-14 23:34:57 dovecot_plain authenticator failed for fixed-187-189-17-68.totalplay.net ([89.116.164.85]) [187.189.17.68]:5884: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.128.11.163
country_id: 3175395
description:
2025-12-14 23:35:05 dovecot_plain authenticator failed for ([89.116.164.85]) [216.128.11.163]:64994: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 14 23:34:22 host2 sshd[3123903]: Disconnected from invalid user tool 162.19.224.161 port 34996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 14 23:34:26 host2 sshd[3124000]: Disconnected from invalid user certbot 12.156.67.18 port 41570 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.114.145.233
country_id: 587116
description:
2025-12-14 23:35:18 dovecot_plain authenticator failed for ([89.116.164.85]) [37.114.145.233]:2744: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 14 23:35:32 host2 sshd[3125433]: Disconnected from invalid user admin 12.156.67.18 port 39784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 23:35:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<frLFV+1Fbr1DzRqg>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 67.205.26.160
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[67.205.26.160] [Remote Port]=[48494] [Authentication Database]=[mail] [Username]=[support@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Mon Dec 15 18:05:42 2025 UTC/Mon Dec 15 23:35:42 2025 LOCAL])


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 14 23:36:05 host2 sshd[3126157]: Disconnected from invalid user sanjay 12.156.67.18 port 50518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.128.11.163
country_id: 3175395
description:
2025-12-14 23:35:12 dovecot_login authenticator failed for ([89.116.164.85]) [216.128.11.163]:64994: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.164
country_id: 3658394
description:
2025-12-14 23:35:13 dovecot_plain authenticator failed for ([89.116.164.85]) [181.199.46.164]:39887: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.37.8.95
country_id: 3865483
description:
2025-12-14 23:35:26 dovecot_plain authenticator failed for ([89.116.164.85]) [179.37.8.95]:55756: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 14 23:35:29 host2 sshd[3125333]: Disconnected from invalid user clock 132.248.55.4 port 30150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.196.177
country_id: 6252001
description:
Dec 14 23:35:45 host2 sshd[3125664]: Disconnected from invalid user web 172.172.196.177 port 39652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.176
country_id: 1880251
description:
Dec 14 23:36:36 host2 sshd[3126871]: Disconnected from invalid user web 45.78.205.176 port 49300 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.193
country_id: 6252001
description:
Dec 14 23:37:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.193, lip=66.85.158.91, TLS handshaking: Connection closed, session=<crvvXO1Fj1VAPpzB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.196.177
country_id: 6252001
description:
Dec 14 23:36:21 host2 sshd[3126584]: Disconnected from invalid user caja 172.172.196.177 port 45516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 14 23:36:23 host2 sshd[3126607]: Disconnected from invalid user esuser 162.19.224.161 port 41000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.89
country_id: 3996063
description:
2025-12-14 23:37:19 dovecot_login authenticator failed for (201.173.216.89-clientes-izzi.mx) [201.173.216.89]:53424: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Dec 14 23:37:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.192, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xrrnXe1FlHdAPpzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-14 23:37:31 dovecot_login authenticator failed for ([149.54.15.90]) [149.54.15.90]:46292: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 14 23:37:43 host2 sshd[3128383]: Disconnected from invalid user zzz 132.248.55.4 port 21572 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 23:38:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<1W9BY+1F+r7IaZyl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 14 23:39:54 host2 sshd[3131597]: Disconnected from invalid user tesla 45.61.187.220 port 43828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.78.89
country_id: 99237
description:
2025-12-14 23:39:58 dovecot_plain authenticator failed for ([89.116.164.85]) [185.187.78.89]:3080: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Dec 14 23:40:15 host2 sshd[3132172]: Disconnected from invalid user nicole 128.1.38.64 port 45986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.176
country_id: 1880251
description:
Dec 14 23:40:22 host2 sshd[3132338]: Disconnected from invalid user web 45.78.205.176 port 38896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.191.248.96
country_id: 3469034
description:
2025-12-14 23:40:27 dovecot_plain authenticator failed for ([89.116.164.85]) [179.191.248.96]:13306: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.156.89.246
country_id: 2542007
description:
2025-12-14 23:40:12 dovecot_plain authenticator failed for ([89.116.164.85]) [105.156.89.246]:56142: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.75.50.25
country_id: 1220409
description:
2025-12-14 23:41:18 dovecot_plain authenticator failed for ([89.116.164.85]) [109.75.50.25]:52674: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Dec 14 23:41:26 host2 sshd[3133683]: Disconnected from invalid user jboss 79.59.175.196 port 39290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.132.99.4
country_id: 3439705
description:
2025-12-14 23:41:29 dovecot_plain authenticator failed for r190-132-99-4.dialup.mobile.ancel.net.uy ([89.116.164.85]) [190.132.99.4]:18579: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.154
country_id: 6251999
description:
Dec 14 23:41:53 host2 sshd[3134252]: Disconnected from invalid user rohit 66.154.125.154 port 60262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 23:42:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<rbUxce1Fzq1S38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 14 23:42:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<IwBsce1FZuA+PIcq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.176
country_id: 1880251
description:
Dec 14 23:42:47 host2 sshd[3135321]: Disconnected from invalid user esuser 45.78.205.176 port 36640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Dec 14 23:43:53 host2 sshd[3136823]: Disconnected from invalid user ftpuser 79.59.175.196 port 39274 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 14 23:43:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<SviScu1FYtI+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.154
country_id: 6251999
description:
Dec 14 23:43:33 host2 sshd[3136396]: Disconnected from invalid user kafka 66.154.125.154 port 42222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.93
country_id: 1880251
description:
Dec 14 23:43:37 host2 sshd[3136454]: Disconnected from invalid user b 45.78.221.93 port 37794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 23:43:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<0Pbnc+1FI94z0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.125.154
country_id: 6251999
description:
Dec 14 23:44:39 host2 sshd[3137946]: Disconnected from invalid user deploy 66.154.125.154 port 39600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 14 23:46:09 host2 sshd[3140760]: Disconnected from invalid user amin 45.61.187.220 port 40050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.176
country_id: 1880251
description:
Dec 14 23:45:12 host2 sshd[3139012]: Disconnected from invalid user gandalf 45.78.205.176 port 44280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 23:45:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<TjLue+1Fut2nR+bm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 14 23:45:31 host2 sshd[3139740]: Disconnected from invalid user jeff 45.61.187.220 port 56406 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 23:45:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Jmm7e+1Fzq0rpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.200.64.116
country_id: 6252001
description:
2025-12-14 23:45:53 dovecot_plain authenticator failed for ([89.116.164.85]) [47.200.64.116]:53482: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.66.242.154
country_id: 953987
description:
2025-12-14 23:46:07 dovecot_plain authenticator failed for ([89.116.164.85]) [197.66.242.154]:41906: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2025-12-14 23:46:16 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:41622: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-14 23:46:19 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (lyban) [73.13.220.220]:48390: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.218.200.159
country_id: 6251999
description:
2025-12-14 23:46:19 dovecot_plain authenticator failed for d172-218-200-159.bchsia.telus.net ([89.116.164.85]) [172.218.200.159]:59623: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-14 23:46:41 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:37986: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.28.122
country_id: 1643084
description:
Dec 14 23:46:52 host2 sshd[3141687]: Disconnected from invalid user Test 36.88.28.122 port 59618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.66.242.154
country_id: 953987
description:
2025-12-14 23:46:14 dovecot_login authenticator failed for ([89.116.164.85]) [197.66.242.154]:41906: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2025-12-14 23:47:33 dovecot_login authenticator failed for 236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:34107: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.28.122
country_id: 1643084
description:
Dec 14 23:47:38 host2 sshd[3142596]: Disconnected from invalid user west 36.88.28.122 port 57922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-14 23:47:41 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (equar) [89.67.37.2]:56227: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Dec 14 23:47:54 host2 sshd[3143004]: Disconnected from invalid user admin 79.59.175.196 port 53374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-14 23:48:07 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:36232: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.213.94.5
country_id: 6252001
description:
2025-12-14 23:48:42 dovecot_plain authenticator failed for c-98-213-94-5.hsd1.in.comcast.net ([89.116.164.85]) [98.213.94.5]:33926: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.109.113.199
country_id: 3469034
description:
2025-12-14 23:48:53 dovecot_plain authenticator failed for ([89.116.164.85]) [179.109.113.199]:15968: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.222.194.127
country_id: 3865483
description:
2025-12-14 23:49:05 dovecot_plain authenticator failed for ([89.116.164.85]) [148.222.194.127]:34058: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Dec 14 23:50:05 host2 sshd[3146161]: Disconnected from invalid user systems 128.1.38.64 port 47632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.222.194.127
country_id: 3865483
description:
2025-12-14 23:49:12 dovecot_login authenticator failed for ([89.116.164.85]) [148.222.194.127]:34058: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 14 23:49:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<xbqNiO1FsLTCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-14 23:49:33 dovecot_login authenticator failed for (nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:51408: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.164
country_id: 1269750
description:
2025-12-14 23:49:46 dovecot_login authenticator failed for ([182.79.218.164]) [182.79.218.164]:59793: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.88.28.122
country_id: 1643084
description:
Dec 14 23:50:57 host2 sshd[3147389]: Disconnected from invalid user b 36.88.28.122 port 40426 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 14 23:50:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<BX0Jju1F0rw+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.84.172
country_id: 1861060
description:
Dec 14 23:52:06 host2 sshd[3149069]: Disconnected from invalid user jane 150.95.84.172 port 33648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-14 23:51:30 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:47071: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2025-12-14 23:52:05 dovecot_login authenticator failed for ([125.18.244.137]) [182.78.64.10]:44518: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.110.170.213
country_id: 290557
description:
2025-12-14 23:52:56 dovecot_plain authenticator failed for bba-83-110-170-213.alshamil.net.ae ([89.116.164.85]) [83.110.170.213]:53836: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.205.23
country_id: 99237
description:
2025-12-14 23:53:07 dovecot_plain authenticator failed for ([89.116.164.85]) [185.187.205.23]:38570: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 14 23:52:12 host2 sshd[3149209]: Disconnected from invalid user vlad 103.136.43.74 port 35718 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-14 23:52:31 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (dorkeed) [76.106.163.189]:50434: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.116.37.208
country_id: 3895114
description:
2025-12-14 23:52:38 dovecot_plain authenticator failed for ([89.116.164.85]) [191.116.37.208]:49292: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.63.255
country_id: 1210997
description:
2025-12-14 23:53:26 dovecot_plain authenticator failed for ([89.116.164.85]) [103.182.63.255]:58820: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.68.164.28
country_id: 3996063
description:
2025-12-14 23:53:38 dovecot_plain authenticator failed for ([89.116.164.85]) [200.68.164.28]:16955: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.117.151.2
country_id: 1527747
description:
2025-12-14 23:53:52 dovecot_plain authenticator failed for ([89.116.164.85]) [185.117.151.2]:61224: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Dec 14 23:54:07 host2 sshd[3151565]: Disconnected from invalid user ubuntu 128.1.38.64 port 36800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.205.23
country_id: 99237
description:
2025-12-14 23:53:14 dovecot_login authenticator failed for ([89.116.164.85]) [185.187.205.23]:38570: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 14 23:54:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<lbWcmu1F2qk+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.248
country_id: 6252001
description:
Dec 14 23:54:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.248, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kdSMnO1FLcrN0h/4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-14 23:55:17 dovecot_plain authenticator failed for (majatin) [176.113.155.132]:36837: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 23:55:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<fdJGnu1F3NQv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 14 23:55:39 host2 sshd[3153620]: Disconnected from invalid user abcd 103.136.43.74 port 35828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.84.172
country_id: 1861060
description:
Dec 14 23:55:42 host2 sshd[3153644]: Disconnected from invalid user alireza 150.95.84.172 port 51308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-12-14 23:56:30 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:57399: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-12-14 23:56:33 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:34044: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.251.0.216
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.251.0.216] [Remote Port]=[51292] [Authentication Database]=[mail] [Username]=[no-reply@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Mon Dec 15 18:26:47 2025 UTC/Mon Dec 15 23:56:47 2025 LOCAL])


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 14 23:56:15 host2 sshd[3154415]: Disconnected from invalid user ftpuser 103.136.43.74 port 57334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-14 23:56:16 dovecot_login authenticator failed for ([125.23.243.66]) [125.23.41.122]:35068: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 23:56:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3Ecyo+1FXMgv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 14 23:57:28 host2 sshd[3155808]: Disconnected from invalid user administrator 103.136.43.74 port 55228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 14 23:57:31 host2 sshd[3155863]: Disconnected from invalid user seekcy 5.182.26.99 port 60434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-14 23:57:49 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:57781: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 14 23:58:06 host2 sshd[3156578]: Disconnected from invalid user admin 5.182.26.99 port 46844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.84.172
country_id: 1861060
description:
Dec 14 23:57:14 host2 sshd[3155518]: Disconnected from invalid user sol 150.95.84.172 port 51320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-14 23:57:17 dovecot_login authenticator failed for (nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:45032: 535 Incorrect authentication data (set_id=contact)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.210.107.22
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.210.107.22] [Remote Port]=[60742] [Authentication Database]=[mail] [Username]=[info@essenceceylontea.com] (10/10 failures) (blocked until [Mon Dec 15 18:28:57 2025 UTC/Mon Dec 15 23:58:57 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-14 23:58:22 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:54058: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.0.6.28
country_id: 192950
description:
2025-12-14 23:58:36 dovecot_plain authenticator failed for ([89.116.164.85]) [102.0.6.28]:55936: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 23:58:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<C6nwqu1FRu0z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.173.249.94
country_id: 6252001
description:
2025-12-14 23:58:46 dovecot_plain authenticator failed for mobile-166-173-249-94.mycingular.net ([89.116.164.85]) [166.173.249.94]:14574: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2025-12-14 23:59:04 dovecot_login authenticator failed for ([113.203.205.37]) [113.203.205.37]:38260: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.239.9.194
country_id: 3469034
description:
2025-12-14 23:58:22 dovecot_plain authenticator failed for ([89.116.164.85]) [170.239.9.194]:53291: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.84.172
country_id: 1861060
description:
Dec 14 23:58:41 host2 sshd[3157182]: Disconnected from invalid user user 150.95.84.172 port 39784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Dec 14 23:59:15 host2 sshd[3157901]: Disconnected from invalid user app 128.1.38.64 port 57700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 14 23:59:16 host2 sshd[3157933]: Disconnected from invalid user kamera 5.182.26.99 port 53816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 00:00:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<hCeHru1FThBo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.93
country_id: 1880251
description:
Dec 15 00:00:42 host2 sshd[3159860]: Disconnected from invalid user jeff 45.78.221.93 port 38686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 00:01:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<KhArsu1FCp0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 15 00:01:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<50fosu1F3os+PIdh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 00:01:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<of3btO1FZJY+PIdm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec 15 00:01:46 host2 pure-ftpd[3161376]: (?@66.132.153.130) [INFO] New connection from 66.132.153.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-15 00:01:58 dovecot_plain authenticator failed for (enters) [5.11.141.74]:57482: 535 Incorrect authentication data (set_id=test@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-15 00:01:59 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (schonodin) [73.208.81.125]:40648: 535 Incorrect authentication data (set_id=test@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-15 00:02:32 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:58991: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-12-15 00:03:05 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:50198: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-15 00:03:05 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:50584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 00:02:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<MT8Mt+1F+MOYNcU1>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.212
country_id: 2635167
description:
Dec 15 00:04:02 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.212, lip=66.85.158.92, TLS, session=<BYMhve1FceK594nU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.117
country_id: 6252001
description:
Dec 15 00:03:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.117, lip=66.85.158.92, session=<WiGXu+1FgUFAPsV1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-15 00:03:41 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:50196: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec 15 00:03:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.92, TLS: Connection closed, session=<ONhUvO1FHr9APsVr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.164.60.208
country_id: 1733045
description:
2025-12-15 00:05:02 dovecot_plain authenticator failed for ([89.116.164.85]) [115.164.60.208]:38630: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-15 00:05:05 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (nones) [73.145.107.251]:48268: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.109.82
country_id: 99237
description:
2025-12-15 00:05:16 dovecot_plain authenticator failed for ([89.116.164.85]) [185.181.109.82]:50725: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.93
country_id: 1880251
description:
Dec 15 00:05:18 host2 sshd[3166096]: Disconnected from invalid user asus 45.78.221.93 port 52066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.14.51.246
country_id: 6252001
description:
2025-12-15 00:05:29 dovecot_plain authenticator failed for 104-14-51-246.lightspeed.irvnca.sbcglobal.net ([89.116.164.85]) [104.14.51.246]:53834: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.119.147
country_id: 3469034
description:
2025-12-15 00:07:32 dovecot_plain authenticator failed for 45-226-119-147.static.sumicity.net.br ([89.116.164.85]) [45.226.119.147]:6640: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.153.37.110
country_id: 6252001
description:
2025-12-15 00:07:44 dovecot_plain authenticator failed for ([89.116.164.85]) [47.153.37.110]:33392: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 00:08:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<1Masy+1FFutS38qm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.222.117.243
country_id: 6252001
description:
Dec 15 00:07:25 host2 sshd[3168926]: Disconnected from invalid user wanghao 35.222.117.243 port 52322 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 15 00:08:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<tRDhze1FeoDIaZyl>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 82.223.202.166
country_id: 2510769
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[82.223.202.166] [Remote Port]=[60182] [Authentication Database]=[mail] [Username]=[sales@essenceceylontea.com] (10/10 failures) (blocked until [Mon Dec 15 18:38:06 2025 UTC/Tue Dec 16 00:08:06 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 00:08:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<PLg2zO1F8LRo7MS0>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 104.236.196.180
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[104.236.196.180] [Remote Port]=[46320] [Authentication Database]=[mail] [Username]=[hr@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Mon Dec 15 18:38:17 2025 UTC/Tue Dec 16 00:08:17 2025 LOCAL])


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.93
country_id: 1880251
description:
Dec 15 00:09:42 host2 sshd[3171913]: Disconnected from invalid user george 45.78.221.93 port 42196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 15 00:09:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<h7Xv0e1FAIo+PIdc>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 152.53.197.53
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[152.53.197.53] [Remote Port]=[58792] [Authentication Database]=[mail] [Username]=[no-reply@essenceceylontea.com] (10/10 failures) (blocked until [Mon Dec 15 18:39:54 2025 UTC/Tue Dec 16 00:09:54 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 00:09:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<XwMa0u1FqOWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 15 00:10:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<j52d1O1FytY+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 15 00:11:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<+Us61+1F3JFDzRqg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 00:11:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<JR+T1+1FWqg+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 15 00:13:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<soWa3u1F6qxDzRqg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 15 00:13:37 host2 sshd[3177721]: Disconnected from invalid user xh 202.157.177.161 port 33530 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.222.117.243
country_id: 6252001
description:
Dec 15 00:13:45 host2 sshd[3177843]: Disconnected from invalid user ubuntu 35.222.117.243 port 55994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 00:13:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<CL1g4O1F1IunR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.57.151.193
country_id: 3865483
description:
2025-12-15 00:14:00 dovecot_plain authenticator failed for ([89.116.164.85]) [186.57.151.193]:60740: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.49.108.211
country_id: 6252001
description:
2025-12-15 00:14:29 dovecot_plain authenticator failed for ip-72-49-108-211.dynamic.fuse.net ([89.116.164.85]) [72.49.108.211]:45623: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.93.131
country_id: 3439705
description:
2025-12-15 00:14:14 dovecot_plain authenticator failed for r186-53-93-131.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.93.131]:58728: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 15 00:15:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Dv5H5e1FvtQrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.23
country_id: 1880251
description:
Dec 15 00:15:39 host2 sshd[3180368]: Disconnected from invalid user danial 45.78.228.23 port 39128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 15 00:16:10 host2 sshd[3181019]: Disconnected from invalid user user 202.157.177.161 port 54538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-15 00:16:31 dovecot_login authenticator failed for (70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:35473: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 15 00:16:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<wCzU6e1F5Nw+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.6
country_id: 1269750
description:
2025-12-15 00:16:53 dovecot_login authenticator failed for ([182.95.85.221]) [182.95.124.6]:60350: 535 Incorrect authentication data (set_id=contact)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 200.105.156.165
country_id: 3923057
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[200.105.156.165] [Remote Port]=[34800] [Authentication Database]=[mail] [Username]=[admin@essenceceylontea.com] (10/10 failures) (blocked until [Mon Dec 15 18:49:17 2025 UTC/Tue Dec 16 00:19:17 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 15 00:20:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<3hNn9u1FYsg+PIdd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 15 00:19:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<9cad8+1F8IfIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-15 00:20:14 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (virehew) [68.83.181.181]:46872: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-15 00:20:49 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:60750: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-15 00:21:02 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:33321: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.84.14
country_id: 3608932
description:
2025-12-15 00:22:06 dovecot_plain authenticator failed for ([89.116.164.85]) [45.181.84.14]:41538: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-12-15 00:21:18 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:56694: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-15 00:22:25 dovecot_login authenticator failed for ([182.95.20.115]) [182.95.229.142]:50086: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.166.21.109
country_id: 3625428
description:
2025-12-15 00:22:28 dovecot_plain authenticator failed for ([89.116.164.85]) [38.166.21.109]:57696: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 15 00:22:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<XqwT/+1FMpdDzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-15 00:22:36 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (redeoutin) [73.208.81.125]:56596: 535 Incorrect authentication data (set_id=test@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.84.14
country_id: 3608932
description:
2025-12-15 00:22:13 dovecot_login authenticator failed for ([89.116.164.85]) [45.181.84.14]:41538: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.145.60.130
country_id: 6252001
description:
2025-12-15 00:22:17 dovecot_plain authenticator failed for ([89.116.164.85]) [35.145.60.130]:7054: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-15 00:22:33 dovecot_plain authenticator failed for (minize) [102.53.15.180]:40673: 535 Incorrect authentication data (set_id=test@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-15 00:22:52 dovecot_login authenticator failed for h225.17.21.98.static.ip.windstream.net [98.21.17.225]:55586: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 00:23:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<qsTVAO5FRN9o7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.34.196
country_id: 6251999
description:
Dec 15 00:22:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.203.34.196, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<zb0H/u1FsoWfyyLE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.178
country_id: 3469034
description:
Dec 15 00:24:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.89.136.178, lip=66.85.158.91, TLS, session=</BL8A+5FeLS+WYiy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 00:24:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<lt1xBe5FPgwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.197.166
country_id: 3865483
description:
Dec 15 00:24:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=186.96.197.166, lip=66.85.158.91, TLS, session=<ZWtNBe5F/9m6YMWm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.23
country_id: 1880251
description:
Dec 15 00:24:36 host2 sshd[3191616]: Disconnected from invalid user opc 45.78.228.23 port 56474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-15 00:25:11 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1323: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-15 00:25:28 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:44862: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.23
country_id: 1880251
description:
Dec 15 00:25:49 host2 sshd[3193364]: Disconnected from invalid user adminer 45.78.228.23 port 56016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 00:26:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<G1ocDe5Fku0+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-15 00:27:06 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:52636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 15 00:27:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<6ojvD+5FkKhDzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-15 00:27:19 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:55790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-15 00:27:42 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:53413: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.114.233.84
country_id: 6252001
description:
2025-12-15 00:28:09 dovecot_plain authenticator failed for 23-114-233-84.lightspeed.nworla.sbcglobal.net ([89.116.164.85]) [23.114.233.84]:56702: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.131.223
country_id: 3865483
description:
2025-12-15 00:28:23 dovecot_plain authenticator failed for ([89.116.164.85]) [45.181.131.223]:41742: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 00:28:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<QekAFO5FOt0+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-15 00:28:37 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:35348: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.12.169.191
country_id: 3865483
description:
2025-12-15 00:28:37 dovecot_plain authenticator failed for ([89.116.164.85]) [186.12.169.191]:42240: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 15 00:28:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<PFMtFu5FvK4z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-15 00:29:07 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:46416: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.114.233.84
country_id: 6252001
description:
2025-12-15 00:28:15 dovecot_login authenticator failed for 23-114-233-84.lightspeed.nworla.sbcglobal.net ([89.116.164.85]) [23.114.233.84]:56702: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-15 00:30:01 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:49705: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-12-15 00:29:22 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:55335: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 00:29:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<jlmnF+5FHNxS38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-12-15 00:29:48 dovecot_login authenticator failed for ([85.152.57.60]) [85.152.57.60]:37778: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 15 00:30:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<c89rHO5FqrfIaZyl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.219.146
country_id: 6252001
description:
Dec 15 00:30:58 host2 pure-ftpd[3199937]: (?@66.240.219.146) [INFO] New connection from 66.240.219.146


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.240.219.146
country_id: 6252001
description:
Dec 15 00:30:59 host2 pure-ftpd[3199961]: (?@66.240.219.146) [INFO] New connection from 66.240.219.146


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Dec 15 00:31:19 host2 sshd[3200380]: Disconnected from invalid user service 24.232.50.5 port 56566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-15 00:31:30 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (doxycom) [98.222.93.199]:51748: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.30.127
country_id: 99237
description:
2025-12-15 00:31:38 dovecot_plain authenticator failed for ([89.116.164.85]) [185.106.30.127]:61378: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 15 00:31:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<meq0IO5FysPIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.49.11.24
country_id: 290557
description:
2025-12-15 00:31:57 dovecot_plain authenticator failed for bba-2-49-11-24.alshamil.net.ae ([89.116.164.85]) [2.49.11.24]:43278: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.201.52.105
country_id: 1522867
description:
2025-12-15 00:32:08 dovecot_plain authenticator failed for ([89.116.164.85]) [109.201.52.105]:38979: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.201.52.105
country_id: 1522867
description:
2025-12-15 00:32:15 dovecot_login authenticator failed for ([89.116.164.85]) [109.201.52.105]:38979: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 15 00:33:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=</InuJe5FwJsz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-15 00:34:15 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (endly) [98.192.74.183]:45816: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.77.155
country_id: 99237
description:
2025-12-15 00:34:54 dovecot_plain authenticator failed for ([89.116.164.85]) [185.187.77.155]:54998: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.148.176.38
country_id: 6251999
description:
2025-12-15 00:35:06 dovecot_plain authenticator failed for ([89.116.164.85]) [207.148.176.38]:49017: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.148.176.38
country_id: 6251999
description:
2025-12-15 00:35:12 dovecot_login authenticator failed for ([89.116.164.85]) [207.148.176.38]:49017: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.30.134.42
country_id: 2635167
description:
2025-12-15 00:35:17 dovecot_plain authenticator failed for cpc124138-duns9-2-0-cust41.9-3.cable.virginm.net ([89.116.164.85]) [82.30.134.42]:33666: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.219.199.228
country_id: 6252001
description:
2025-12-15 00:35:40 dovecot_plain authenticator failed for ([89.116.164.85]) [98.219.199.228]:40718: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 00:35:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<7GajLu5Fsu0+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.81.27.112
country_id: 6252001
description:
2025-12-15 00:35:52 dovecot_plain authenticator failed for dhcp-147-81-27-112.hawaiiantel.net ([89.116.164.85]) [147.81.27.112]:46126: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-15 00:37:12 dovecot_login authenticator failed for 16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:57341: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 00:37:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<tZhINO5FhseYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-15 00:37:55 dovecot_login authenticator failed for (dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:47742: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-15 00:38:41 dovecot_plain authenticator failed for (waran) [96.85.104.2]:44342: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.232.50.5
country_id: 3865483
description:
Dec 15 00:38:53 host2 sshd[3209888]: Disconnected from invalid user test 24.232.50.5 port 44468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 00:39:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<jH4EOu5F1rVS38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 00:39:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<c+WdO+5F4NY+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Dec 15 00:39:32 host2 sshd[3210750]: Disconnected from invalid user user22 103.51.216.210 port 45542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.137.201
country_id: 3865483
description:
2025-12-15 00:40:08 dovecot_plain authenticator failed for ([89.116.164.85]) [143.105.137.201]:27394: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.137.201
country_id: 3865483
description:
2025-12-15 00:40:16 dovecot_login authenticator failed for ([89.116.164.85]) [143.105.137.201]:27394: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.249.23.235
country_id: 3996063
description:
2025-12-15 00:40:21 dovecot_plain authenticator failed for ([89.116.164.85]) [187.249.23.235]:42648: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Dec 15 00:40:30 host2 sshd[3212120]: Disconnected from invalid user frappe 167.99.238.157 port 39164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.83.210.244
country_id: 6252001
description:
2025-12-15 00:40:33 dovecot_plain authenticator failed for ([89.116.164.85]) [71.83.210.244]:33754: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-15 00:41:03 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:55418: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-15 00:41:22 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:52359: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 15 00:41:46 host2 sshd[3213840]: Disconnected from invalid user frappe 101.36.109.176 port 39086 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Dec 15 00:43:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS: Connection closed, session=<NL5wSO5FRoFAPsUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec 15 00:42:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.91, session=<+ysMR+5FgjW4aYtG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 15 00:42:42 host2 sshd[3215044]: Disconnected from invalid user test 142.93.126.22 port 51828 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.52
country_id: 6252001
description:
Dec 15 00:42:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.52, lip=66.85.158.91, session=<sTOhR+5FDVNAPsU0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Dec 15 00:43:13 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, session=<2yI/Se5FCrdAPsUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.73.162.178
country_id: 298795
description:
Dec 15 00:43:53 host2 sshd[3216382]: Disconnected from invalid user test 94.73.162.178 port 37754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 15 00:44:23 host2 sshd[3216961]: Disconnected from invalid user vhserver 101.36.109.176 port 53258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.73.162.178
country_id: 298795
description:
Dec 15 00:44:33 host2 sshd[3217082]: Disconnected from invalid user john 94.73.162.178 port 37224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-15 00:44:38 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (turgemihex) [71.230.228.16]:47750: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Dec 15 00:44:53 host2 sshd[3217750]: Disconnected from invalid user vhserver 167.99.238.157 port 39434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-15 00:44:43 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (essly) [76.145.10.140]:58586: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 15 00:45:03 host2 sshd[3218049]: Disconnected from invalid user ts 142.93.126.22 port 60548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 00:45:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<+tTsUe5FjKynR+bm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.173.73
country_id: 1269750
description:
Dec 15 00:45:46 host2 sshd[3219184]: Disconnected from invalid user server 64.227.173.73 port 45714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-15 00:46:57 dovecot_login authenticator failed for ([182.78.79.134]) [182.78.79.134]:52166: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.182.175
country_id: 3469034
description:
2025-12-15 00:47:06 dovecot_login authenticator failed for ([177.10.182.175]) [177.10.182.175]:57264: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-15 00:46:26 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:59396: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.22
country_id: 1227603
description:
2025-12-15 00:46:47 dovecot_login authenticator failed for (ADMIN) [95.181.239.22]:10357: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Dec 15 00:46:35 host2 sshd[3220400]: Disconnected from invalid user tunneluser 167.99.238.157 port 52554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.73.162.178
country_id: 298795
description:
Dec 15 00:47:07 host2 sshd[3221176]: Disconnected from invalid user test 94.73.162.178 port 41746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.194.10
country_id: 3017382
description:
Dec 15 00:46:32 host2 sshd[3220317]: Disconnected from invalid user server 51.75.194.10 port 51444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 15 00:48:01 host2 sshd[3222269]: Disconnected from invalid user test 142.93.126.22 port 36846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 00:47:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<U1BIV+5FRAcvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-15 00:47:16 dovecot_login authenticator failed for ([122.184.136.185]) [182.95.181.22]:35434: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.173.73
country_id: 1269750
description:
Dec 15 00:47:16 host2 sshd[3221349]: Disconnected from invalid user user22 64.227.173.73 port 38472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-15 00:47:29 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:47086: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.173.73
country_id: 1269750
description:
Dec 15 00:47:32 host2 sshd[3221657]: Disconnected from invalid user esuser 64.227.173.73 port 44878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Dec 15 00:47:48 host2 sshd[3222002]: Disconnected from invalid user ashish 167.99.238.157 port 34580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 15 00:48:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<2V2nXe5F2KAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Dec 15 00:48:32 host2 sshd[3222937]: Disconnected from invalid user test2 103.51.216.210 port 36630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-15 00:48:49 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:43900: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-15 00:50:01 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (swoon) [78.68.37.25]:46266: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-15 00:49:22 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:31267: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 00:49:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<8se5X+5FduM+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Dec 15 00:49:46 host2 sshd[3224509]: Disconnected from invalid user hw 103.51.216.210 port 47554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-15 00:49:53 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:51016: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 15 00:50:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Q6/aY+5FOJsrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.165.251
country_id: 2635167
description:
Dec 15 00:50:57 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=178.128.165.251, lip=66.85.158.91, TLS, session=<ShbnZO5FIoaygKX7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 15 00:51:07 host2 sshd[3226430]: Disconnected from invalid user user 2.57.121.25 port 53576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-12-15 00:52:08 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:42748: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-15 00:52:02 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:37074: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-15 00:52:21 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:36331: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-15 00:52:30 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:44171: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 00:53:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<F+5pbO5FkmFo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.162.240.149
country_id: 1269750
description:
2025-12-15 00:53:11 dovecot_login authenticator failed for (abts-north-dynamic-149.240.162.122.airtelbroadband.in) [122.162.240.149]:60226: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 15 00:53:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<7A+ibO5FttQrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-15 00:53:47 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:52528: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 00:55:14 host2 sshd[3231699]: Disconnected from invalid user ubnt 62.60.131.157 port 5860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 00:55:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<5hdHdu5Fyt6YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 00:58:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<OIpAfu5FUNmnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 15 00:58:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<w6pVge5FbtpDzRqg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 15 00:58:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<OwDSfu5FeMgv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.143.108.121
country_id: 953987
description:
2025-12-15 01:00:05 dovecot_plain authenticator failed for 192-143-108-121.ip.ahisp.co.za ([89.116.164.85]) [192.143.108.121]:50530: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 01:00:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<uddEh+5F1Opo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-15 01:00:38 dovecot_login authenticator failed for (cm-84.213.189.159.get.no) [84.213.189.159]:48588: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.109.215.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.109.215.6 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2025-12-15 01:01:04 dovecot_login authenticator failed for (syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:55412: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.143.108.121
country_id: 953987
description:
2025-12-15 01:00:12 dovecot_login authenticator failed for 192-143-108-121.ip.ahisp.co.za ([89.116.164.85]) [192.143.108.121]:50530: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.21.159.17
country_id: 3469034
description:
2025-12-15 01:00:19 dovecot_plain authenticator failed for ([89.116.164.85]) [177.21.159.17]:9017: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.65.242.61
country_id: 6252001
description:
2025-12-15 01:00:30 dovecot_plain authenticator failed for 108-65-242-61.lightspeed.snantx.sbcglobal.net ([89.116.164.85]) [108.65.242.61]:60236: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.230.65.188
country_id: 3865483
description:
2025-12-15 01:00:38 dovecot_plain authenticator failed for ([89.116.164.85]) [45.230.65.188]:44826: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.78.205.81
country_id: 3658394
description:
2025-12-15 01:00:50 dovecot_plain authenticator failed for ([89.116.164.85]) [181.78.205.81]:44820: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.67.94.208
country_id: 3017382
description:
2025-12-15 01:01:04 dovecot_plain authenticator failed for 208.94.67.37.rev.sfr.net ([89.116.164.85]) [37.67.94.208]:16543: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.67.94.208
country_id: 3017382
description:
2025-12-15 01:01:10 dovecot_login authenticator failed for 208.94.67.37.rev.sfr.net ([89.116.164.85]) [37.67.94.208]:16543: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.27
country_id: 6252001
description:
Dec 15 01:01:14 host2 sshd[3239499]: Disconnected from invalid user mehdi 12.189.234.27 port 60337 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 15 01:01:29 host2 pure-ftpd[3239822]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 01:02:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<HoW2jO5FoqovTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.38
country_id: 3996063
description:
2025-12-15 01:02:40 dovecot_login authenticator failed for (187.161.136.38-clientes-izzi.mx) [187.161.136.38]:53647: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-15 01:02:28 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:59299: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.245.53.141
country_id: 3996063
description:
2025-12-15 01:04:49 dovecot_plain authenticator failed for ([89.116.164.85]) [177.245.53.141]:46548: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.234.203.79
country_id: 6252001
description:
2025-12-15 01:05:00 dovecot_plain authenticator failed for ([89.116.164.85]) [216.234.203.79]:52351: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.17
country_id: 6252001
description:
Dec 15 01:04:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.33.109.17, lip=66.85.158.92, session=<hGg7lO5FI6YtIW0R>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.108.108
country_id: 3469034
description:
2025-12-15 01:04:39 dovecot_plain authenticator failed for ([89.116.164.85]) [190.15.108.108]:58370: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 12.189.234.27
country_id: 6252001
description:
Dec 15 01:06:04 host2 sshd[3246454]: Received disconnect from 12.189.234.27 port 58415:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.189.234.27
country_id: 6252001
description:
Dec 15 01:06:04 host2 sshd[3246454]: Disconnected from invalid user farhan 12.189.234.27 port 58415 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 01:05:18 host2 sshd[3245304]: Disconnected from invalid user ubnt 62.60.131.157 port 14504 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 01:05:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<Qmoyme5FlN5S38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.106
country_id: 6252001
description:
2025-12-15 01:05:50 dovecot_login authenticator failed for ([98.185.120.106]) [98.185.120.106]:36871: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 15 01:05:57 host2 sshd[3246190]: Disconnected from invalid user reza 103.255.147.244 port 34388 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 15 01:05:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<YQThmO5FgcAz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-15 01:07:06 dovecot_login authenticator failed for (nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:50430: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.120
country_id: 3996063
description:
2025-12-15 01:07:08 dovecot_login authenticator failed for (201.173.216.120-clientes-izzi.mx) [201.173.216.120]:57944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-15 01:06:26 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:36105: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-15 01:06:30 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:33822: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2025-12-15 01:07:21 dovecot_login authenticator failed for ([87.200.94.102]) [87.200.94.102]:53781: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 15 01:07:52 host2 sshd[3248884]: Disconnected from invalid user fmaster 103.255.147.244 port 39642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 15 01:09:09 host2 sshd[3250648]: Disconnected from invalid user alan 103.255.147.244 port 35926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 15 01:09:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<rVKyqO5Fr60z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 15 01:10:21 host2 sshd[3252349]: Disconnected from invalid user magento 103.255.147.244 port 34442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-15 01:11:11 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:36754: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.40
country_id: 6252001
description:
2025-12-15 01:11:30 dovecot_login authenticator failed for ([98.181.46.40]) [98.181.46.40]:59510: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2025-12-15 01:11:56 dovecot_login authenticator failed for ([182.95.125.122]) [182.95.125.122]:34002: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-15 01:12:10 dovecot_login authenticator failed for (nsg-corporate-126.60.187.122.airtel.in) [122.187.60.126]:41646: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.233.36
country_id: 2921044
description:
Dec 15 01:12:19 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.154.233.36, lip=66.85.158.91, TLS, session=<KGhPse5FZt/Pmukk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 15 01:12:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<l9RXse5FmKXIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.20.193
country_id: 290557
description:
2025-12-15 01:12:22 dovecot_login authenticator failed for ([94.207.20.193]) [94.207.20.193]:35020: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-15 01:12:53 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:55520: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 15 01:13:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<x5Vste5FDqLIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 01:14:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<pwMsue5FlpqYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 01:15:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<eDoTvu5FFug+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 01:15:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<zE/du+5FXrhS38qm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Dec 15 01:15:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<ZhE4vO5FVpanXpI/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 01:16:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<a5ilwO5FXKI+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.48
country_id: 6252001
description:
2025-12-15 01:17:48 dovecot_login authenticator failed for ([98.181.46.48]) [98.181.46.48]:41991: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-15 01:18:09 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:33386: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-15 01:21:08 dovecot_login authenticator failed for ([149.54.15.42]) [149.54.15.42]:58050: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-15 01:21:31 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:45966: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 01:23:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<VANN2u5F4I4+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.44.159.120
country_id: 6251999
description:
Dec 15 01:24:32 host2 sshd[3271987]: Disconnected from invalid user sammy 96.44.159.120 port 48848 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 01:25:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=</dnq3u5FsEYvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-12-15 01:24:24 dovecot_plain authenticator failed for (colize) [5.32.61.6]:41734: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.44.159.120
country_id: 6251999
description:
Dec 15 01:25:10 host2 sshd[3273073]: Disconnected from invalid user bench 96.44.159.120 port 35870 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 01:25:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<vMjU3+5FKoqnR+bm>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 167.71.230.230
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[167.71.230.230] [Remote Port]=[35370] [Authentication Database]=[mail] [Username]=[support@essenceceylontea.com] (10/10 failures) (blocked until [Mon Dec 15 19:55:20 2025 UTC/Tue Dec 16 01:25:20 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 15 01:25:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<QMR24e5Fqr0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 01:26:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<vTJG5e5FPqM+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.251
country_id: 1643084
description:
Dec 15 01:27:07 host2 sshd[3276128]: Disconnected from invalid user odoo 103.67.78.251 port 58090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 15 01:26:46 host2 sshd[3275575]: Disconnected from invalid user sammy 122.53.133.167 port 38836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.196.214
country_id: 3144096
description:
2025-12-15 01:27:35 dovecot_login authenticator failed for (cm-178.232.196.214.get.no) [178.232.196.214]:47829: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.251
country_id: 1643084
description:
Dec 15 01:27:50 host2 sshd[3277133]: Disconnected from invalid user docker 103.67.78.251 port 34872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.44.159.120
country_id: 6251999
description:
Dec 15 01:27:58 host2 sshd[3277317]: Disconnected from invalid user diana 96.44.159.120 port 55006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.118.26
country_id: 1605651
description:
Dec 15 01:27:14 host2 sshd[3276313]: Disconnected from invalid user www 165.154.118.26 port 49862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-15 01:27:22 dovecot_login authenticator failed for (aes-static-041.73.22.125.airtel.in) [122.186.201.62]:58832: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.251
country_id: 1643084
description:
Dec 15 01:28:32 host2 sshd[3278110]: Disconnected from invalid user kostas 103.67.78.251 port 41036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 15 01:28:12 host2 sshd[3277696]: Disconnected from invalid user jin 122.53.133.167 port 35634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.194
country_id: 2510769
description:
Dec 15 01:29:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=139.28.190.194, lip=66.85.158.91, TLS, session=<QFJz7e5FSc+LHL7C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.161
country_id: 3469034
description:
Dec 15 01:29:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.53.128.161, lip=66.85.158.91, TLS, session=<numv7u5FW9a/NYCh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.251
country_id: 1643084
description:
Dec 15 01:30:37 host2 sshd[3281120]: Disconnected from invalid user testuser 103.67.78.251 port 42106 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 01:30:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<uqzb8u5FRhVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-12-15 01:31:23 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:38321: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.251
country_id: 1643084
description:
Dec 15 01:32:01 host2 sshd[3283043]: Disconnected from invalid user vhserver 103.67.78.251 port 34418 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 15 01:32:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<7xM3+O5F2L4rpAFm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.230.58
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 45.162.230.58 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 01:32:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<ReUR++5FPNI+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 01:33:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<kSWM++5FRsmYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 15 01:35:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ZxSPAu9FHuUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-15 01:36:21 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:60280: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-15 01:36:33 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:60470: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-15 01:37:48 dovecot_login authenticator failed for ([125.23.229.42]) [182.78.64.150]:33058: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 01:37:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<qO5MDO9FjJ6nR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-15 01:37:19 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:45504: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 01:38:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<2BLaDe9FINpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 01:40:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<aK+PFO9F4KUvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-15 01:39:20 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (hucke) [71.230.228.16]:56002: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.118.26
country_id: 1605651
description:
Dec 15 01:40:38 host2 sshd[3294984]: Disconnected from invalid user username 165.154.118.26 port 57272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 01:41:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<neMuG+9FYuFS38qm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.118.26
country_id: 1605651
description:
Dec 15 01:41:40 host2 sshd[3296345]: Disconnected from invalid user john 165.154.118.26 port 37478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 15 01:42:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<a70hHO9FGqoz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-12-15 01:42:32 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:39595: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.118.26
country_id: 1605651
description:
Dec 15 01:42:36 host2 sshd[3297504]: Disconnected from invalid user notify 165.154.118.26 port 32910 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.21.151.21
country_id: 2802361
description:
2025-12-15 01:42:41 dovecot_plain authenticator failed for 78-21-151-21.access.telenet.be (matonasped) [78.21.151.21]:39496: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-15 01:42:44 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:50881: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-15 01:42:47 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:41400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.220.228
country_id: 99237
description:
2025-12-15 01:44:04 dovecot_login authenticator failed for ([93.191.115.52]) [194.31.220.228]:51143: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-15 01:44:20 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:45607: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 01:44:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<gtNKJO9FgLg+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 01:44:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<fRJCJO9FItg+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Dec 15 01:45:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+e2CKO9Fbd/G6xhl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 15 01:46:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<FjcALO9Fk4kz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 01:51:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<OzzLPu9FYoyYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 01:51:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<EaQRPu9F9LpS38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-15 01:52:09 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:50267: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-15 01:52:21 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:33182: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-15 01:56:08 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:45800: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-15 01:56:21 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:59772: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 01:57:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<1MRoU+9Fir2G0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 01:57:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<PccJVO9FGtakXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-15 02:01:05 dovecot_login authenticator failed for ([182.95.20.28]) [182.95.228.10]:43660: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 02:01:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<0h96X+9F0Nw+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-15 02:01:11 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:54252: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.162
country_id: 2542007
description:
2025-12-15 02:01:20 dovecot_login authenticator failed for ([105.73.190.162]) [105.73.190.162]:34232: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-12-15 02:01:41 dovecot_login authenticator failed for ([203.145.142.243]) [203.145.142.243]:34500: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-12-15 02:02:06 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:60271: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-15 02:02:39 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:55820: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 02:04:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<+NwQau9FGtaLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 02:04:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<3Humau9Fqrk+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 02:04:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<fApXa+9FWKyPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 15 02:04:47 host2 sshd[3328828]: Disconnected from invalid user jenkins 154.198.215.66 port 50912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 02:04:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=</3GRau9Flqy8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 02:04:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<XoeZa+9FIskvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.99
country_id: 690791
description:
Dec 15 02:04:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.17.125.99, lip=66.85.158.91, TLS, session=<9tZta+9FReq5EX1j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.118
country_id: 3469034
description:
Dec 15 02:05:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=177.44.96.118, lip=66.85.158.91, TLS, session=<Q0KRbO9FeZmxLGB2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 02:04:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<tg1Fa+9F7JBo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-15 02:05:16 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:38278: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 02:05:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=</bmtbu9FcLcu4ntB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.235
country_id: 3865483
description:
Dec 15 02:06:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<careers>, method=PLAIN, rip=190.181.101.235, lip=66.85.158.91, TLS, session=<JzX6cu9FzMy+tWXr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.22
country_id: 798544
description:
Dec 15 02:06:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=178.216.30.22, lip=66.85.158.91, TLS, session=<QzqSce9F2aGy2B4W>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 15 02:06:34 host2 sshd[3331536]: Disconnected from invalid user amir 154.198.215.66 port 59686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.205.223.74
country_id: 3469034
description:
Dec 15 02:06:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=168.205.223.74, lip=66.85.158.91, TLS, session=<NC4Wc+9FX+Sozd9K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.5.108.45
country_id: 2186224
description:
Dec 15 02:06:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers>, method=PLAIN, rip=103.5.108.45, lip=66.85.158.91, TLS, session=<71a6cu9F24RnBWwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 02:06:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ge2Scu9F6Epniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Dec 15 02:06:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<c22gce9FiITEAHqi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.41
country_id: 798544
description:
Dec 15 02:06:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=91.236.172.41, lip=66.85.158.91, TLS, session=<xC3Wcu9FTbFb7Kwp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.13.251
country_id: 3469034
description:
Dec 15 02:06:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.39.13.251, lip=66.85.158.91, TLS, session=<ZU+zce9FjYOxJw37>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-15 02:06:52 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:52808: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.153
country_id: 3469034
description:
Dec 15 02:06:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.44.96.153, lip=66.85.158.91, TLS, session=<NU+zce9FwdmxLGCZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Dec 15 02:07:07 host2 sshd[3332296]: Disconnected from invalid user james 154.198.215.66 port 43768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-15 02:07:38 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:55940: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.82.103
country_id: 3469034
description:
Dec 15 02:07:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=200.237.82.103, lip=66.85.158.91, TLS, session=<eHcwde9FMpXI7VJn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-15 02:08:06 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:47363: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.61
country_id: 6252001
description:
2025-12-15 02:07:19 dovecot_login authenticator failed for ([98.185.120.61]) [98.185.120.61]:49167: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.239.103.125
country_id: 3277605
description:
Dec 15 02:07:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=104.239.103.125, lip=66.85.158.91, TLS, session=<8oFddu9Fsoto72d9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 02:08:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<rcS7e+9FJos+PIMp>


