# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.80
country_id: 3017382
description:
Dec 10 20:28:38 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.80, lip=66.85.158.92, session=<J/JlQ5pFP89bxJhQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2025-12-10 20:28:56 dovecot_login authenticator failed for ([149.54.62.66]) [149.54.62.66]:45218: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.62
country_id: 3017382
description:
Dec 10 20:28:57 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.62, lip=66.85.158.92, session=<htWFRJpFP6xbxJg+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.63
country_id: 3017382
description:
Dec 10 20:28:26 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.63, lip=66.85.158.92, session=<Xm20QppFAYBbxJg/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.235.7.1
country_id: 3077311
description:
2025-12-10 20:28:32 dovecot_plain authenticator failed for customer7-1.airweb.cz (chmode) [109.235.7.1]:60782: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.86
country_id: 3017382
description:
Dec 10 20:28:53 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.86, lip=66.85.158.92, session=<zY1TRJpFm+pbxJhW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Dec 10 20:29:04 host2 pure-ftpd[2610090]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.96.169.244
country_id: 6252001
description:
2025-12-10 20:29:16 dovecot_login authenticator failed for ([192.96.169.244]) [192.96.169.244]:55003: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-10 20:29:36 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:50250: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-10 20:29:57 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:45862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 10 20:30:07 host2 sshd[2610899]: Disconnected from invalid user vpn 202.165.22.246 port 42218 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.47
country_id: 3017382
description:
Dec 10 20:30:18 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.47, lip=66.85.158.92, session=<UQNfSZpFs81bxJgv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-10 20:30:21 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:47455: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.100.255
country_id: 1269750
description:
2025-12-10 20:29:30 dovecot_login authenticator failed for ([113.193.53.56]) [103.181.100.255]:46414: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.66
country_id: 3017382
description:
Dec 10 20:30:30 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.66, lip=66.85.158.92, session=<lIAaSppFBcpbxJhC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.67
country_id: 3017382
description:
Dec 10 20:30:54 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.67, lip=66.85.158.92, session=<0+WCS5pFx9NbxJhD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.64
country_id: 3017382
description:
Dec 10 20:30:57 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.64, lip=66.85.158.92, session=<CS21S5pFGexbxJhA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 10 20:31:12 host2 sshd[2611960]: Disconnected from invalid user lorena 103.250.10.42 port 55380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.25.35.70
country_id: 732800
description:
Dec 10 20:31:49 host2 sshd[2612335]: Disconnected from invalid user admin 212.25.35.70 port 36710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 10 20:31:52 host2 sshd[2612309]: Disconnected from invalid user ak 202.165.22.246 port 42524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 10 20:33:12 host2 sshd[2613111]: Disconnected from invalid user student10 45.78.220.142 port 36302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.25.35.70
country_id: 732800
description:
Dec 10 20:32:32 host2 sshd[2612805]: Disconnected from invalid user rishabh 212.25.35.70 port 47376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 20:32:37 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<LOKGUZpFBpYXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.152.37
country_id: 1269750
description:
Dec 10 20:32:47 host2 sshd[2612950]: Disconnected from invalid user lorena 106.51.152.37 port 57694 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.152.37
country_id: 1269750
description:
Dec 10 20:34:17 host2 sshd[2613913]: Disconnected from invalid user oracle 106.51.152.37 port 34352 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-10 20:35:09 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:39827: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-10 20:35:13 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:49675: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.25.35.70
country_id: 732800
description:
Dec 10 20:34:26 host2 sshd[2614027]: Disconnected from invalid user postgres 212.25.35.70 port 50704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 20:34:45 host2 sshd[2614231]: Disconnected from invalid user  62.60.131.157 port 50010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-10 20:34:47 dovecot_login authenticator failed for (nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:39156: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.53.220.26
country_id: 1605651
description:
Dec 10 20:34:53 host2 sshd[2614313]: Disconnected from invalid user user 182.53.220.26 port 40286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-12-10 20:35:38 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:43384: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 10 20:35:47 host2 sshd[2615061]: Disconnected from invalid user rishabh 202.165.22.246 port 57378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-12-10 20:36:17 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:42510: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.25.35.70
country_id: 732800
description:
Dec 10 20:37:03 host2 sshd[2616224]: Disconnected from invalid user lorena 212.25.35.70 port 60708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.152.37
country_id: 1269750
description:
Dec 10 20:36:26 host2 sshd[2615678]: Disconnected from invalid user user01 106.51.152.37 port 51622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-10 20:36:37 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:49360: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-10 20:37:35 dovecot_plain authenticator failed for (mousole) [96.85.104.2]:55268: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 10 20:38:00 host2 sshd[2616869]: Disconnected from invalid user ak 103.250.10.42 port 46250 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.234
country_id: 6252001
description:
Dec 10 20:38:46 host2 pure-ftpd[2617323]: (?@198.235.24.234) [INFO] New connection from 198.235.24.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-10 20:40:55 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:51922: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 10 20:41:12 host2 sshd[2619394]: Disconnected from invalid user ubuntu 45.78.220.142 port 60854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-10 20:41:17 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:34805: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.25
country_id: 6252001
description:
2025-12-10 20:41:42 dovecot_login authenticator failed for ([72.214.133.25]) [72.214.133.25]:34105: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-10 20:41:54 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:47302: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.53.220.26
country_id: 1605651
description:
Dec 10 20:42:50 host2 sshd[2620319]: Disconnected from invalid user ftp1 182.53.220.26 port 45362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 10 20:44:08 host2 sshd[2621068]: Disconnected from invalid user publico 123.58.209.224 port 50648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.241.146
country_id: 6252001
description:
Dec 10 20:50:10 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.118.241.146, lip=66.85.158.92, session=<DIhtkJpFNocUdvGS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 10 20:49:56 host2 sshd[2625047]: Disconnected from invalid user csserver 123.58.209.224 port 52872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-10 20:51:18 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:49532: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 10 20:50:31 host2 sshd[2625592]: Disconnected from invalid user deployer 123.58.209.224 port 38704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-10 20:51:45 dovecot_login authenticator failed for (ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:39950: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.157
country_id: 6252001
description:
Dec 10 20:53:49 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.80.105.157, lip=66.85.158.91, session=<tKBznZpFcL4UUGmd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-10 20:55:50 dovecot_login authenticator failed for ([27.123.111.110]) [27.123.111.110]:47784: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-12-10 20:56:04 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:52210: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-12-10 21:00:35 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:60482: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-10 21:00:36 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:48216: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 21:00:37 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Qm6mtZpFPNIXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-10 21:00:47 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:44268: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-10 21:00:51 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:44058: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.142.55.40
country_id: 1861060
description:
2025-12-10 21:02:10 dovecot_login authenticator failed for 40.55.142.133.rev.iijmobile.jp [133.142.55.40]:34025: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-10 21:01:50 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:37202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-10 21:03:21 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:40944: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-10 21:02:55 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:51302: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-10 21:04:03 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:33786: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.142
country_id: 6252001
description:
Dec 10 21:06:17 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=162.216.149.142, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<c0MKyppF6Mii2JWO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-10 21:06:52 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:53298: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.142
country_id: 6252001
description:
Dec 10 21:07:12 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.142, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<X/xQzZpFFOGi2JWO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-10 21:06:37 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:42275: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-10 21:07:27 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:41087: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.142
country_id: 6252001
description:
Dec 10 21:07:31 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.142, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<oJZxzppF/POi2JWO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2025-12-10 21:07:44 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:55565: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.106.206.77
country_id: 6252001
description:
Dec 10 21:10:04 host2 pure-ftpd[2642499]: (?@20.106.206.77) [INFO] New connection from 20.106.206.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.124.173.207
country_id: 3996063
description:
2025-12-10 21:10:07 dovecot_plain authenticator failed for ([89.116.164.85]) [201.124.173.207]:41856: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.35
country_id: 798544
description:
Dec 10 21:10:22 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=178.216.28.35, lip=66.85.158.91, TLS, session=<BDew15pFCsey2Bwj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.148.42.126
country_id: 290291
description:
2025-12-10 21:09:44 dovecot_plain authenticator failed for ([89.116.164.85]) [89.148.42.126]:32243: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.69.1.98
country_id: 6252001
description:
2025-12-10 21:09:56 dovecot_plain authenticator failed for ([89.116.164.85]) [66.69.1.98]:38112: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.155
country_id: 798544
description:
Dec 10 21:10:39 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<info>, method=PLAIN, rip=109.125.244.155, lip=66.85.158.91, TLS, session=<uXXC2JpFgcVtffSb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-10 21:11:09 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:57806: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-10 21:11:57 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34986: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-10 21:12:15 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (carblest) [73.196.144.25]:48034: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-10 21:11:54 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:34765: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-12-10 21:17:20 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:60118: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-10 21:17:40 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:50823: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-10 21:21:32 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:51602: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2025-12-10 21:21:47 dovecot_login authenticator failed for ([125.19.220.30]) [125.19.220.30]:60478: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 21:21:58 host2 sshd[2654503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 21:23:47 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (stinge) [96.230.65.90]:42992: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 21:24:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (zounrapok) [87.103.126.54]:5165: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-10 21:26:27 dovecot_login authenticator failed for ([113.193.187.154]) [113.193.187.154]:43428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-10 21:26:40 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:39471: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-10 21:26:49 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:56973: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-10 21:26:56 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:34684: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-10 21:27:26 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:45588: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2025-12-10 21:27:49 dovecot_login authenticator failed for ([94.207.30.137]) [94.207.30.137]:56110: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-10 21:28:00 dovecot_login authenticator failed for (201.173.250.36-clientes-izzi.mx) [201.173.250.36]:58233: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-10 21:28:05 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:35412: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 21:30:35 host2 sshd[2663554]: Disconnected from invalid user user 2.57.121.25 port 9317 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-10 21:33:05 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (tomma) [68.82.141.145]:35582: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-10 21:33:08 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:53523: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-10 21:33:24 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:49732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-10 21:33:45 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:50934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-10 21:32:56 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:40636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 21:35:42 host2 sshd[2666987]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-12-10 21:39:45 dovecot_login authenticator failed for (2-55-68-141.orange.net.il) [2.55.68.141]:40394: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-10 21:39:50 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:39614: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 10 21:40:05 host2 sshd[2670878]: Disconnected from invalid user ubuntu 51.38.224.114 port 45184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-10 21:40:08 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:47954: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-12-10 21:40:17 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:37029: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-10 21:40:18 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:43429: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 10 21:40:59 host2 dovecot[2672060]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-10 21:41:26 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (momic) [73.168.136.150]:39678: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 21:41:29 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (listomist) [96.230.65.90]:34622: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-10 21:43:08 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:39848: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-10 21:43:22 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:34468: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 10 21:44:27 host2 sshd[2674475]: Disconnected from invalid user tunnel 45.197.145.10 port 47906 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 21:44:56 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JygsVJtFNOwXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 10 21:46:40 host2 sshd[2676254]: Disconnected from invalid user admin 51.38.224.114 port 55896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-12-10 21:47:14 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:39751: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 10 21:48:24 host2 sshd[2677947]: Disconnected from invalid user postgres 51.38.224.114 port 58294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 10 21:47:44 host2 sshd[2677099]: Disconnected from invalid user transfer 51.38.224.114 port 54364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 10 21:47:51 host2 sshd[2677179]: Disconnected from invalid user hadi 45.197.145.10 port 48170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-12-10 21:47:57 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:35542: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 10 21:48:55 host2 sshd[2678562]: Disconnected from invalid user niti 103.172.20.218 port 45406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.193.139
country_id: 1733045
description:
2025-12-10 21:51:48 dovecot_plain authenticator failed for ([89.116.164.85]) [124.13.193.139]:37097: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-10 21:52:00 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:59862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.185.133.139
country_id: 1269750
description:
2025-12-10 21:52:10 dovecot_plain authenticator failed for ([89.116.164.85]) [223.185.133.139]:23635: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.224.14.214
country_id: 99237
description:
2025-12-10 21:52:21 dovecot_plain authenticator failed for ([89.116.164.85]) [169.224.14.214]:64111: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-12-10 21:52:29 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:54619: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 10 21:52:32 host2 sshd[2694097]: Disconnected from invalid user ossadm 45.197.145.10 port 51322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.191.118
country_id: 3144096
description:
2025-12-10 21:52:33 dovecot_login authenticator failed for (cm-178.232.191.118.get.no) [178.232.191.118]:35076: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-12-10 21:53:02 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:41596: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-10 21:54:05 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (pentily) [73.145.107.251]:46058: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 10 21:54:26 host2 sshd[2696060]: Disconnected from invalid user liyang 45.197.145.10 port 60724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 10 21:53:59 host2 sshd[2695245]: Disconnected from invalid user liyang 103.172.20.218 port 38882 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 10 21:55:01 host2 sshd[2696434]: Disconnected from invalid user prod 103.172.20.218 port 56608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-10 21:55:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65110: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 10 21:56:07 host2 sshd[2697519]: Disconnected from invalid user singh 103.172.20.218 port 46112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-10 21:58:07 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:50727: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-10 21:59:28 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:47062: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-10 21:58:46 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:37206: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-10 21:58:50 dovecot_login authenticator failed for ([95.164.177.6]) [95.164.177.6]:40588: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-10 21:59:05 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:54252: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-10 21:59:07 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:44977: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-10 21:59:41 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:57802: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.87.13.247
country_id: 1227603
description:
[2025-12-10 22:07:35 +0530] info [cpaneld] 103.87.13.247 - mathsmot "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2025-12-10 22:08:34 dovecot_login authenticator failed for (syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:38740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-10 22:09:18 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:38148: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-10 22:12:53 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:36812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-10 22:13:09 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:37686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-10 22:15:43 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (trabilln) [68.82.141.145]:38446: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-10 22:15:54 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:59693: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-10 22:15:33 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:35052: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-12-10 22:17:48 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61971: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.21
country_id: 3996063
description:
2025-12-10 22:18:08 dovecot_login authenticator failed for (187.161.173.21-clientes-izzi.mx) [187.161.173.21]:52557: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2025-12-10 22:18:23 dovecot_login authenticator failed for ([182.95.226.138]) [182.95.226.138]:42420: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-10 22:18:35 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:59887: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-10 22:19:42 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:58831: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 22:19:49 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (arder) [51.195.117.220]:44042: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2025-12-10 22:20:05 dovecot_login authenticator failed for ([49.124.152.222]) [49.124.152.222]:39540: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.221.198.244
country_id: 6290252
description:
2025-12-10 22:21:14 dovecot_plain authenticator failed for 178-221-198-244.dynamic.isp.telekom.rs ([89.116.164.85]) [178.221.198.244]:59750: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.185.53.11
country_id: 1269750
description:
2025-12-10 22:20:54 dovecot_plain authenticator failed for ([89.116.164.85]) [223.185.53.11]:7382: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-10 22:21:07 dovecot_plain authenticator failed for (dismiac) [65.20.129.28]:37488: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-10 22:24:09 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 22:23:50 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (aciades) [87.103.126.54]:48783: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-10 22:23:55 dovecot_login authenticator failed for ([182.73.193.249]) [122.187.41.18]:46148: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.241
country_id: 6252001
description:
2025-12-10 22:24:52 dovecot_login authenticator failed for ([208.69.161.241]) [208.69.161.241]:44938: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-10 22:29:54 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (pologs) [174.166.153.20]:48896: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.132.164.17
country_id: 2635167
description:
Dec 10 22:33:33 host2 sshd[2729828]: Disconnected from invalid user admin 23.132.164.17 port 36644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-10 22:34:49 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:60009: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-10 22:35:09 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:47626: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-10 22:38:50 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:41610: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-10 22:39:09 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:43075: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-10 22:39:41 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:49164: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.78.163
country_id: 3469034
description:
Dec 10 22:42:04 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=177.190.78.163, lip=66.85.158.91, TLS, session=<dql5H5xFkbexvk6j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.64
country_id: 3996063
description:
2025-12-10 22:42:08 dovecot_login authenticator failed for (201.173.97.64-clientes-izzi.mx) [201.173.97.64]:35034: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.143
country_id: 798544
description:
Dec 10 22:42:22 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=178.219.105.143, lip=66.85.158.91, TLS, session=<uTetIJxFBOmy22mP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-10 22:41:47 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:33140: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-10 22:43:56 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:33389: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.196.80
country_id: 3996063
description:
2025-12-10 22:44:07 dovecot_login authenticator failed for ([201.173.196.80]) [201.173.196.80]:55380: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 22:45:00 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (bless) [51.195.117.220]:10428: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.16
country_id: 3996063
description:
2025-12-10 22:45:07 dovecot_login authenticator failed for (201.166.222.16-clientes-izzi.mx) [201.166.222.16]:51124: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-10 22:45:25 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:37706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-10 22:44:34 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:43412: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-12-10 22:44:52 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:58583: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.53
country_id: 1282988
description:
Dec 10 22:46:52 host2 sshd[2738588]: Disconnected from invalid user sonar 103.104.235.53 port 43569 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:48:15 host2 sshd[2739387]: Disconnected from invalid user taiko 91.240.15.18 port 57726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.20
country_id: 1643084
description:
Dec 10 22:47:36 host2 sshd[2739050]: Disconnected from invalid user david 103.250.11.20 port 34182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-10 22:48:09 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (gumudarres) [73.197.236.163]:43380: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Dec 10 22:49:42 host2 sshd[2740205]: Disconnected from invalid user deploy 154.72.233.36 port 44974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 10 22:49:45 host2 sshd[2740217]: Disconnected from invalid user dmdba 185.216.119.134 port 60396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-10 22:50:08 dovecot_login authenticator failed for (dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:55244: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-10 22:51:01 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:47306: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-12-10 22:50:29 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:40487: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-12-10 22:50:49 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:55972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Dec 10 22:50:48 host2 sshd[2741266]: Disconnected from invalid user taiko 154.72.233.36 port 44558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Dec 10 22:53:04 host2 sshd[2743135]: Disconnected from invalid user user 154.72.233.36 port 44654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 10 22:52:39 host2 sshd[2742800]: Disconnected from invalid user admin 193.187.148.79 port 44090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:52:52 host2 sshd[2742937]: Disconnected from invalid user mailtest 91.240.15.18 port 40056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:54:05 host2 sshd[2744029]: Disconnected from invalid user newuser 91.240.15.18 port 51642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 10 22:54:14 host2 sshd[2744236]: Disconnected from invalid user bitwarden 193.187.148.79 port 45492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.20
country_id: 1643084
description:
Dec 10 22:54:25 host2 sshd[2744391]: Disconnected from invalid user sonar 103.250.11.20 port 47126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-10 22:54:47 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (sconis) [73.13.220.220]:45052: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.20
country_id: 1643084
description:
Dec 10 22:55:00 host2 sshd[2745002]: Disconnected from invalid user deploy 103.250.11.20 port 50234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:55:19 host2 sshd[2745344]: Disconnected from invalid user deploy 91.240.15.18 port 59646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.11.20
country_id: 1643084
description:
Dec 10 22:56:14 host2 sshd[2746034]: Disconnected from invalid user user 103.250.11.20 port 48234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:55:54 host2 sshd[2745752]: Disconnected from invalid user user 91.240.15.18 port 32830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.53
country_id: 1282988
description:
Dec 10 22:58:41 host2 sshd[2747557]: Disconnected from invalid user admin 103.104.235.53 port 58102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.53
country_id: 1282988
description:
Dec 10 23:00:00 host2 sshd[2748305]: Disconnected from invalid user taiko 103.104.235.53 port 42452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-10 23:00:59 dovecot_login authenticator failed for ([182.95.181.62]) [182.95.181.62]:48548: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.103.243
country_id: 3469034
description:
2025-12-10 23:01:20 dovecot_login authenticator failed for ([38.43.103.243]) [38.43.103.243]:43427: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.71
country_id: 6252001
description:
Dec 10 23:01:27 host2 pure-ftpd[2750014]: (?@198.235.24.71) [INFO] New connection from 198.235.24.71


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.104.235.53
country_id: 1282988
description:
Dec 10 23:03:50 host2 sshd[2752028]: Disconnected from invalid user mailtest 103.104.235.53 port 51841 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Dec 10 23:04:21 host2 sshd[2752379]: Disconnected from invalid user elk 197.248.8.33 port 38616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-10 23:05:00 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:57887: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-10 23:04:33 dovecot_login authenticator failed for ([182.95.228.110]) [182.95.228.110]:45630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 10 23:04:36 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, session=<+64ycZxFzt/Y2s5E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-10 23:06:04 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:50739: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.8.33
country_id: 192950
description:
Dec 10 23:07:15 host2 sshd[2755037]: Disconnected from invalid user paula 197.248.8.33 port 39938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Dec 10 23:06:30 host2 sshd[2754309]: Disconnected from invalid user connect 197.248.8.33 port 53732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Dec 10 23:08:45 host2 sshd[2755948]: Disconnected from invalid user aluno 197.248.8.33 port 40576 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 10 23:09:33 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS: Connection closed, session=<jDnegpxFOhRChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.174.85
country_id: 1643084
description:
2025-12-10 23:09:39 dovecot_login authenticator failed for ([36.92.174.85]) [36.92.174.85]:62086: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-12-10 23:09:42 dovecot_login authenticator failed for ([37.142.173.63]) [37.142.173.63]:58607: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-10 23:10:02 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:59850: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-12-10 23:10:02 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:46553: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-10 23:11:14 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:49460: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-10 23:11:27 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:50735: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 23:14:36 host2 sshd[2760336]: Disconnected from invalid user admin 2.57.121.112 port 64999 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:15:34 host2 sshd[2761166]: Disconnected from invalid user bench 146.190.112.196 port 47162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.60.13
country_id: 3469034
description:
2025-12-10 23:16:17 dovecot_login authenticator failed for clientes-60.13.dbug.com.br [177.10.60.13]:52072: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 23:16:51 host2 sshd[2762459]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-10 23:17:23 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (sardsorium) [98.204.134.124]:47830: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-10 23:16:31 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:3551: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-10 23:16:44 dovecot_login authenticator failed for 14-0-142-131.static.pccw-hkt.com [14.0.142.131]:32439: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-10 23:16:49 dovecot_plain authenticator failed for (demish) [65.20.147.45]:54991: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-10 23:16:55 dovecot_plain authenticator failed for (drutic) [65.20.160.107]:51475: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-12-10 23:17:03 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:46958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.214.74.238
country_id: 2750405
description:
Dec 10 23:19:49 host2 sshd[2764198]: Disconnected from invalid user mani 185.214.74.238 port 51384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:20:35 host2 sshd[2764903]: Disconnected from invalid user wang 146.190.112.196 port 37800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:21:41 host2 sshd[2765987]: Disconnected from invalid user mani 146.190.112.196 port 50368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:22:40 host2 sshd[2766810]: Disconnected from invalid user xq 146.190.112.196 port 35976 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-10 23:23:11 dovecot_plain authenticator failed for (auxing) [64.72.74.162]:49906: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.214.74.238
country_id: 2750405
description:
Dec 10 23:24:03 host2 sshd[2767770]: Disconnected from invalid user app 185.214.74.238 port 39764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:24:48 host2 sshd[2768245]: Disconnected from invalid user free 146.190.112.196 port 40210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-10 23:25:01 dovecot_plain authenticator failed for (wepsed) [24.187.213.29]:36894: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-12-10 23:26:49 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:50082: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-10 23:27:32 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:46046: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 10 23:29:45 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, session=<MJUjy5xFMNXY2s5D>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 23:30:34 host2 sshd[2772311]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-10 23:30:42 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:46412: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-10 23:35:24 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:34439: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-10 23:35:28 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:61257: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2025-12-10 23:35:42 dovecot_login authenticator failed for ([182.95.226.138]) [182.95.226.138]:56586: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.59
country_id: 6252001
description:
2025-12-10 23:35:57 dovecot_login authenticator failed for wsip-184-191-250-59.fv.ks.cox.net [184.191.250.59]:36106: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 23:35:59 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (surene) [87.103.126.54]:21101: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-10 23:36:39 dovecot_login authenticator failed for ([84.210.151.158]) [84.210.151.158]:38591: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-10 23:36:50 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:44706: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 23:37:47 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pyrest) [87.103.126.54]:27318: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-10 23:41:03 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:36634: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-10 23:41:54 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:51536: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-12-10 23:41:57 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:34014: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-10 23:42:19 dovecot_login authenticator failed for ([178.239.238.23]) [178.239.238.23]:52836: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-10 23:43:39 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (waudge) [37.150.8.174]:39847: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 23:45:22 host2 sshd[2783831]: Disconnected from invalid user  62.60.131.157 port 61354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2025-12-10 23:51:06 dovecot_login authenticator failed for ([110.172.147.190]) [110.172.147.190]:44439: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-10 23:51:44 dovecot_login authenticator failed for ([49.124.154.160]) [49.124.154.160]:43052: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 23:54:52 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (parophrall) [87.103.126.54]:20004: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-10 23:55:06 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:41804: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.187
country_id: 1733045
description:
2025-12-10 23:55:26 dovecot_login authenticator failed for ([49.124.148.187]) [49.124.148.187]:37556: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 23:58:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (gaschum) [87.103.126.54]:36668: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2025-12-10 23:59:45 dovecot_login authenticator failed for ([152.52.227.94]) [152.52.227.94]:39604: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.167.82.206
country_id: 6252001
description:
2025-12-10 23:59:55 dovecot_login authenticator failed for (syn-024-167-082-206.res.spectrum.com) [24.167.82.206]:47941: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-11 00:00:05 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:53186: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-11 00:00:16 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:54090: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-11 00:01:02 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:42746: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.167
country_id: 6252001
description:
Dec 11 00:01:06 host2 pure-ftpd[2796394]: (?@64.62.197.167) [INFO] New connection from 64.62.197.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-11 00:01:29 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:46958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 11 00:03:28 host2 pure-ftpd[2797866]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 11 00:03:29 host2 pure-ftpd[2797902]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 11 00:03:57 host2 sshd[2798258]: Disconnected from invalid user user 139.59.188.13 port 37384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 00:04:34 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (unprox) [51.195.117.220]:14055: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-11 00:06:05 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:48553: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-11 00:06:22 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:48102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 11 00:06:49 host2 sshd[2800355]: Disconnected from invalid user oleg 139.59.188.13 port 58670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.105.69.45
country_id: 1643084
description:
2025-12-11 00:06:56 dovecot_login authenticator failed for ([103.87.155.27]) [103.105.69.45]:59274: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-11 00:07:26 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.74]:36879: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.16.124
country_id: 2300660
description:
Dec 11 00:08:09 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=41.211.16.124, lip=66.85.158.91, TLS, session=<1EE6U51FGuYp0xB8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec 11 00:08:31 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GXjGVZ1F6FPY2s5C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.66
country_id: 3469034
description:
Dec 11 00:08:38 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info>, method=PLAIN, rip=186.209.248.66, lip=66.85.158.91, TLS, session=<fQ64VJ1Fbbu60fhC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.112.9
country_id: 3469034
description:
Dec 11 00:10:27 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.39.112.9, lip=66.85.158.91, TLS, session=<iYCAW51FVbmxJ3AJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 00:10:32 host2 sshd[2802943]: Disconnected from invalid user user 2.57.121.25 port 45797 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.173
country_id: 798544
description:
Dec 11 00:10:44 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=178.219.98.173, lip=66.85.158.91, TLS, session=<FQbAXJ1Fj6uy22Kt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-12-11 00:16:33 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:41252: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.248.127.243
country_id: 3865483
description:
2025-12-11 00:16:37 dovecot_login authenticator failed for ([207.248.127.243]) [207.248.127.243]:47523: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.217.70
country_id: 1269750
description:
2025-12-11 00:17:03 dovecot_login authenticator failed for ([203.129.217.70]) [203.129.217.70]:56835: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-11 00:17:59 dovecot_login authenticator failed for (industrianaval.fla.gvt.net.br) [187.58.66.231]:54436: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-11 00:17:18 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:47438: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-12-11 00:17:25 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:44374: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-12-11 00:17:36 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:57719: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-12-11 00:18:13 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:39400: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-12-11 00:20:20 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:53109: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.238.200.135
country_id: 1819730
description:
Dec 11 00:20:39 host2 sshd[2810381]: Disconnected from invalid user ubuntu 47.238.200.135 port 45408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-11 00:21:18 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:42124: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.88
country_id: 6252001
description:
Dec 11 00:22:36 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.88, lip=66.85.158.91, TLS handshaking: Connection closed, session=</gMmiJ1F9bVAPsVY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Dec 11 00:22:54 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Hp45iZ1F2iFAPsVN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:22:56 host2 sshd[2812158]: Disconnected from invalid user richard 115.186.223.102 port 46828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 00:23:41 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (poodlerier) [51.195.117.220]:14853: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Dec 11 00:24:18 host2 sshd[2813172]: Disconnected from invalid user ubuntu 43.166.242.149 port 54222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 11 00:24:37 host2 sshd[2813347]: Disconnected from invalid user vpn 115.85.80.12 port 50624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:25:18 host2 sshd[2813957]: Disconnected from invalid user centos 115.186.223.102 port 57042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-11 00:25:35 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:59366: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-12-11 00:25:34 dovecot_login authenticator failed for ([128.185.70.193]) [125.19.157.158]:54130: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-11 00:25:50 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:37998: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-11 00:26:47 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:55159: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.6
country_id: 1269750
description:
2025-12-11 00:27:03 dovecot_login authenticator failed for ([182.66.251.185]) [182.95.124.6]:43810: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-11 00:27:07 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:47525: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-11 00:26:23 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:59432: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 00:26:45 host2 sshd[2814750]: Disconnected from invalid user admin 2.57.121.112 port 52326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 11 00:28:07 host2 sshd[2815610]: Disconnected from invalid user teamspeak 115.85.80.12 port 57812 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-11 00:27:17 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (qiste) [73.208.81.125]:57078: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-11 00:27:30 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:55713: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.211.56.214
country_id: 2750405
description:
Dec 11 00:28:03 host2 sshd[2815567]: Disconnected from invalid user rke 172.211.56.214 port 46258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.111.53.48
country_id: 6252001
description:
Dec 11 00:27:27 host2 sshd[2815153]: Disconnected from invalid user sysuser 174.111.53.48 port 60974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:27:31 host2 sshd[2815171]: Disconnected from invalid user devops 115.186.223.102 port 39016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:28:15 host2 sshd[2815665]: Disconnected from invalid user sammy 115.186.223.102 port 51832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.111.53.48
country_id: 6252001
description:
Dec 11 00:28:37 host2 sshd[2815843]: Disconnected from invalid user ahmet 174.111.53.48 port 34202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 11 00:29:40 host2 sshd[2816354]: Disconnected from invalid user jenkins 115.85.80.12 port 53642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:29:45 host2 sshd[2816397]: Disconnected from invalid user demo 115.186.223.102 port 49226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.111.53.48
country_id: 6252001
description:
Dec 11 00:29:50 host2 sshd[2816445]: Disconnected from invalid user jenkins 174.111.53.48 port 40222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.211.56.214
country_id: 2750405
description:
Dec 11 00:30:50 host2 sshd[2817366]: Disconnected from invalid user admin 172.211.56.214 port 37148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 11 00:31:10 host2 sshd[2817564]: Disconnected from invalid user postgres 115.85.80.12 port 48894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-11 00:31:49 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:35636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-11 00:32:05 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:59102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.61
country_id: 3865483
description:
Dec 11 00:33:05 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.251.61, lip=66.85.158.91, TLS, session=<lHRwrJ1FyLyzAPs9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-11 00:32:38 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:34413: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.166
country_id: 3175395
description:
Dec 11 00:32:42 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.63.132.166, lip=66.85.158.91, TLS, session=<vSNLq51FpKC5P4Sm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-11 00:32:49 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:48390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.241.249.27
country_id: 1643084
description:
2025-12-11 00:33:45 dovecot_plain authenticator failed for ([89.116.164.85]) [180.241.249.27]:49084: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.80.43.47
country_id: 102358
description:
2025-12-11 00:33:59 dovecot_plain authenticator failed for ([89.116.164.85]) [178.80.43.47]:44118: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.125.209.68
country_id: 718075
description:
2025-12-11 00:34:13 dovecot_plain authenticator failed for ([89.116.164.85]) [79.125.209.68]:44686: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Dec 11 00:34:27 host2 sshd[2819504]: Disconnected from invalid user wxg 43.166.242.149 port 58608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-11 00:42:07 dovecot_login authenticator failed for (aes-static-041.73.22.125.airtel.in) [122.186.201.62]:54386: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 11 00:42:24 host2 sshd[2824012]: Disconnected from invalid user steam 194.107.115.65 port 45978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-11 00:42:23 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:42706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:44:07 host2 sshd[2824868]: Disconnected from invalid user admini 38.105.25.194 port 42642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 11 00:43:28 host2 sshd[2824502]: Disconnected from invalid user dev 154.83.15.123 port 33620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 11 00:43:57 host2 sshd[2824751]: Disconnected from invalid user ubuntu 194.107.115.65 port 9318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 11 00:44:10 host2 sshd[2824887]: Disconnected from invalid user misha 154.83.15.123 port 47982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-11 00:44:27 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:35498: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-11 00:44:49 dovecot_login authenticator failed for (223-197-145-126.static.imsbiz.com) [223.197.145.126]:59271: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 11 00:45:14 host2 sshd[2826244]: Disconnected from invalid user azureuser 194.107.115.65 port 34180 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.113
country_id: 6252001
description:
2025-12-11 00:45:30 dovecot_login authenticator failed for wsip-184-191-250-113.fv.ks.cox.net [184.191.250.113]:57598: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-11 00:45:52 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:50548: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-11 00:46:08 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:36036: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-11 00:46:13 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:56120: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.48
country_id: 6252001
description:
Dec 11 00:46:38 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.48, lip=66.85.158.92, TLS: Connection closed, session=<kL0a3p1FQuWnXpIw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-11 00:46:43 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:54295: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:47:23 host2 sshd[2827925]: Disconnected from invalid user eric 38.105.25.194 port 38910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 11 00:47:27 host2 sshd[2827962]: Disconnected from invalid user devops 51.77.137.25 port 55966 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 11 00:47:35 host2 sshd[2828026]: Disconnected from invalid user s1 154.83.15.123 port 35074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Dec 11 00:48:59 host2 sshd[2828991]: Disconnected from invalid user deploy 43.166.242.149 port 47306 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:49:03 host2 sshd[2829078]: Received disconnect from 38.105.25.194 port 34632:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 11 00:48:07 host2 pure-ftpd[2828403]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 11 00:48:08 host2 pure-ftpd[2828417]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:48:29 host2 sshd[2828675]: Disconnected from invalid user admin 38.105.25.194 port 55796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 11 00:48:32 host2 sshd[2828708]: Disconnected from invalid user manager 51.77.137.25 port 39420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:49:35 host2 sshd[2829391]: Disconnected from invalid user aj 38.105.25.194 port 56090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 11 00:50:36 host2 sshd[2830418]: Disconnected from invalid user ismail 51.77.137.25 port 51540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-11 00:50:39 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:49280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.201
country_id: 1269750
description:
2025-12-11 00:51:02 dovecot_login authenticator failed for (nsg-corporate-201.229.187.122.airtel.in) [122.187.229.201]:35411: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-11 00:51:12 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:37936: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-11 00:51:16 dovecot_login authenticator failed for ([27.123.119.254]) [128.185.246.106]:46176: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 11 00:51:30 host2 sshd[2831052]: Disconnected from invalid user intern 45.232.73.84 port 41228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-11 00:51:32 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:57660: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-11 00:52:21 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:60934: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-11 00:52:28 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (chanagn) [98.227.25.115]:38310: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-12-11 00:52:32 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:40032: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 11 00:52:55 host2 sshd[2832261]: Disconnected from invalid user acct 45.232.73.84 port 33478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.92.15
country_id: 357994
description:
Dec 11 00:53:55 host2 sshd[2832993]: Disconnected from invalid user hadi 45.246.92.15 port 52888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 11 00:53:29 host2 sshd[2832717]: Disconnected from invalid user ubuntu 5.182.26.99 port 58652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 11 00:53:38 host2 sshd[2832818]: Disconnected from invalid user drcom 45.232.73.84 port 46122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-11 00:54:31 dovecot_plain authenticator failed for (pallic) [24.105.248.218]:42350: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-11 00:57:03 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:16592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-11 00:56:13 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (golowl) [98.222.93.199]:53752: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 11 00:56:22 host2 sshd[2835618]: Disconnected from invalid user postgres 45.232.73.84 port 40246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-11 00:56:52 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:35936: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-11 00:57:32 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (marof) [174.161.27.82]:60527: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.218.240.181
country_id: 1819730
description:
Dec 11 00:58:35 host2 sshd[2837091]: Disconnected from invalid user vboxuser 103.218.240.181 port 43634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 11 00:58:45 host2 sshd[2837171]: Disconnected from invalid user z 5.182.26.99 port 58014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 11 01:00:05 host2 sshd[2838246]: Disconnected from invalid user william 5.182.26.99 port 48994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.144.5.61
country_id: 130758
description:
Dec 11 00:59:09 host2 sshd[2837476]: Disconnected from invalid user user1 2.144.5.61 port 34042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Dec 11 00:59:14 host2 sshd[2837514]: Disconnected from invalid user user1 103.218.240.181 port 60940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Dec 11 01:00:44 host2 sshd[2838747]: Disconnected from invalid user hadi 103.218.240.181 port 40078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.92.15
country_id: 357994
description:
Dec 11 01:01:55 host2 sshd[2839420]: Disconnected from invalid user xyx 45.246.92.15 port 34544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.14
country_id: 3996063
description:
2025-12-11 01:02:28 dovecot_login authenticator failed for (201.173.216.14-clientes-izzi.mx) [201.173.216.14]:41933: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.246.92.15
country_id: 357994
description:
Dec 11 01:02:44 host2 sshd[2839820]: Disconnected from invalid user acct 45.246.92.15 port 49428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.25.78
country_id: 298795
description:
2025-12-11 01:02:48 dovecot_login authenticator failed for ([188.59.25.78]) [188.59.25.78]:44624: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-11 01:05:02 dovecot_plain authenticator failed for (citrumble) [12.150.243.22]:14494: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-11 01:06:05 dovecot_plain authenticator failed for (adens) [154.144.243.93]:53504: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-11 01:07:22 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:41115: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-11 01:07:53 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:39333: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 01:11:19 host2 sshd[2846380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 01:11:06 host2 sshd[2846245]: Disconnected from invalid user user 2.57.121.25 port 34145 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-11 01:11:09 dovecot_login authenticator failed for ([27.123.111.110]) [27.123.111.110]:52884: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-11 01:12:08 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:38740: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2025-12-11 01:16:29 dovecot_login authenticator failed for ([149.54.51.230]) [149.54.51.230]:47221: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-11 01:16:29 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:45877: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-11 01:16:43 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:35720: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-11 01:16:14 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:34950: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.6
country_id: 1269750
description:
2025-12-11 01:17:20 dovecot_login authenticator failed for ([182.95.85.221]) [182.95.124.6]:33016: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.64
country_id: 1733045
description:
2025-12-11 01:17:59 dovecot_login authenticator failed for ([49.124.153.64]) [49.124.153.64]:38594: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 01:20:25 host2 sshd[2853067]: Disconnected from invalid user ubnt 62.60.131.157 port 25452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:20:52 host2 sshd[2853357]: Disconnected from invalid user sistema 103.160.37.151 port 60828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.190.44
country_id: 3017382
description:
Dec 11 01:21:10 host2 sshd[2853717]: Disconnected from invalid user power 57.128.190.44 port 39812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:22:08 host2 sshd[2854390]: Disconnected from invalid user power 103.160.37.151 port 51520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-11 01:22:57 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:46750: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.249
country_id: 6252001
description:
2025-12-11 01:23:08 dovecot_login authenticator failed for ([98.185.121.249]) [98.185.121.249]:50240: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-11 01:22:26 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:55292: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-11 01:24:02 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:38454: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:24:05 host2 sshd[2855742]: Disconnected from invalid user elasticsearch 103.160.37.151 port 33684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-11 01:23:47 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:52821: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.187
country_id: 1733045
description:
2025-12-11 01:23:57 dovecot_login authenticator failed for ([49.124.148.187]) [49.124.148.187]:42576: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2025-12-11 01:24:16 dovecot_login authenticator failed for ([5.11.161.152]) [5.11.161.152]:40402: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-11 01:24:20 dovecot_login authenticator failed for ([136.232.73.130]) [49.37.32.248]:33630: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-11 01:24:19 dovecot_login authenticator failed for (201.173.56.28-clientes-izzi.mx) [201.173.56.28]:47131: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-11 01:24:26 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:42552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-11 01:24:39 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:41472: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:24:43 host2 sshd[2856123]: Disconnected from invalid user server1 103.160.37.151 port 46684 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 01:25:14 host2 sshd[2856623]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 11 01:25:35 host2 sshd[2856996]: Disconnected from invalid user temp 49.49.231.208 port 49754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 01:26:00 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (cursing) [51.195.117.220]:51194: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.190.44
country_id: 3017382
description:
Dec 11 01:25:13 host2 sshd[2856611]: Disconnected from invalid user elasticsearch 57.128.190.44 port 36394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:25:21 host2 sshd[2856695]: Disconnected from invalid user reza 103.160.37.151 port 59674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.184.139
country_id: 1269750
description:
Dec 11 01:26:12 host2 sshd[2857682]: Disconnected from invalid user ubuntu 64.227.184.139 port 37572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.190.44
country_id: 3017382
description:
Dec 11 01:26:20 host2 sshd[2857832]: Disconnected from invalid user sistema 57.128.190.44 port 43476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 11 01:27:33 host2 sshd[2859238]: Disconnected from invalid user pzuser 95.85.114.218 port 60664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.230
country_id: 1733045
description:
Dec 11 01:27:31 host2 sshd[2859208]: Disconnected from invalid user deployer 202.165.17.230 port 48756 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.178
country_id: 6252001
description:
Dec 11 01:28:09 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.178, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+geYcp5FE8XN0h+y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.230
country_id: 1733045
description:
Dec 11 01:29:46 host2 sshd[2861170]: Disconnected from invalid user ubuntu 202.165.17.230 port 28627 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.17.230
country_id: 1733045
description:
Dec 11 01:30:28 host2 sshd[2861879]: Disconnected from invalid user myuser 202.165.17.230 port 55861 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.125.178
country_id: 3017382
description:
Dec 11 01:30:38 host2 sshd[2861973]: Disconnected from invalid user ftpUser 138.124.125.178 port 36632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.184.139
country_id: 1269750
description:
Dec 11 01:30:47 host2 sshd[2862028]: Disconnected from invalid user admin 64.227.184.139 port 57228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-11 01:30:59 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:41620: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-11 01:31:21 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:51970: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.184.139
country_id: 1269750
description:
Dec 11 01:31:26 host2 sshd[2862400]: Disconnected from invalid user ubuntu 64.227.184.139 port 50156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-11 01:32:01 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:55602: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.125.178
country_id: 3017382
description:
Dec 11 01:32:14 host2 sshd[2862914]: Disconnected from invalid user admin 138.124.125.178 port 55520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.53
country_id: 798544
description:
Dec 11 01:32:27 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.216.28.53, lip=66.85.158.91, TLS, session=<mLj7gJ5Ff5my2Bw1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.230
country_id: 1733045
description:
Dec 11 01:33:07 host2 sshd[2863417]: Disconnected from invalid user ftpUser 202.165.17.230 port 30370 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.184.139
country_id: 1269750
description:
Dec 11 01:32:07 host2 sshd[2862852]: Disconnected from invalid user server 64.227.184.139 port 56584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.199.0
country_id: 3865483
description:
Dec 11 01:32:09 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=186.96.199.0, lip=66.85.158.91, TLS, session=<42mof55FWOe6YMcA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 11 01:32:53 host2 sshd[2863262]: Disconnected from invalid user webuser 95.85.114.218 port 53122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Dec 11 01:33:18 host2 sshd[2863495]: Disconnected from invalid user myadmin 138.68.104.233 port 39370 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.103.243
country_id: 3469034
description:
2025-12-11 01:33:44 dovecot_login authenticator failed for ([38.43.103.243]) [38.43.103.243]:49973: 535 Incorrect authentication data (set_id=mail@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.230
country_id: 1733045
description:
Dec 11 01:33:48 host2 sshd[2863798]: Disconnected from invalid user myadmin 202.165.17.230 port 43652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 11 01:33:51 host2 sshd[2863847]: Disconnected from invalid user sam 49.49.231.208 port 36918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 11 01:33:52 host2 sshd[2863854]: Disconnected from invalid user administrator 95.85.114.218 port 57944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 11 01:33:54 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dR0fh55FDFlChJmI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.184.139
country_id: 1269750
description:
Dec 11 01:34:10 host2 sshd[2864130]: Disconnected from invalid user dat 64.227.184.139 port 56564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.125.178
country_id: 3017382
description:
Dec 11 01:34:18 host2 sshd[2864285]: Disconnected from invalid user ubuntu 138.124.125.178 port 49922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 11 01:35:44 host2 sshd[2865533]: Disconnected from invalid user jenkins 49.49.231.208 port 39934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 11 01:35:08 host2 sshd[2865007]: Disconnected from invalid user seekcy 95.85.114.218 port 51542 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 11 01:35:27 host2 sshd[2865350]: Received disconnect from 95.85.114.218 port 54176:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 11 01:36:20 host2 sshd[2866020]: Disconnected from invalid user admin 49.49.231.208 port 8372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-12-11 01:36:46 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:58836: 535 Incorrect authentication data (set_id=mail@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-11 01:37:15 dovecot_login authenticator failed for (ws99-36-153-203.rcil.gov.in) [136.233.79.230]:42742: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-11 01:38:16 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (hydoings) [68.83.181.181]:43592: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.238.40.227
country_id: 1880251
description:
Dec 11 01:39:09 host2 sshd[2868754]: Disconnected from invalid user admin 206.238.40.227 port 36672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.227
country_id: 1880251
description:
Dec 11 01:40:30 host2 sshd[2870054]: Disconnected from invalid user webuser 206.238.40.227 port 55872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-11 01:41:40 dovecot_login authenticator failed for (30-170-97-62.cust.smartcall.no) [62.97.170.30]:53207: 535 Incorrect authentication data (set_id=mail@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.21
country_id: 1733045
description:
2025-12-11 01:41:46 dovecot_login authenticator failed for ([49.124.153.21]) [49.124.153.21]:37224: 535 Incorrect authentication data (set_id=mail@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-11 01:42:47 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:48684: 535 Incorrect authentication data (set_id=mail@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-11 01:42:50 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:42174: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-12-11 01:42:12 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:42183: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-11 01:42:29 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:46089: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-12-11 01:42:32 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:40364: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-11 01:43:19 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:50326: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Dec 11 01:43:57 host2 pure-ftpd[2873656]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-11 01:44:06 dovecot_plain authenticator failed for (trociferge) [91.73.188.251]:37069: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-11 01:44:14 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (flutbill) [188.219.104.210]:54492: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-11 01:44:35 dovecot_plain authenticator failed for (traing) [94.206.93.90]:59545: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-11 01:44:39 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (inknagy) [98.40.101.10]:49248: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.49
country_id: 6252001
description:
Dec 11 01:44:50 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=44.220.188.49, lip=66.85.158.92, TLS handshaking: Connection closed, session=<zIE1rp5FlOos3Lwx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.185.164.76
country_id: 2077456
description:
2025-12-11 01:47:39 dovecot_login authenticator failed for (cpe-101-185-164-76.wb06.wa.asp.telstra.net) [101.185.164.76]:57826: 535 Incorrect authentication data (set_id=mail@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-11 01:47:47 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (thess) [73.224.171.101]:52402: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-11 01:47:53 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:44666: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-11 01:48:09 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:38240: 535 Incorrect authentication data (set_id=mail@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.170
country_id: 3469034
description:
Dec 11 01:48:21 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=191.53.40.170, lip=66.85.158.91, TLS, session=<pke3uZ5Fw4e/NSiq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-11 01:48:35 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:57184: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-11 01:48:34 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:34268: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.186
country_id: 2510769
description:
Dec 11 01:48:40 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=139.28.190.186, lip=66.85.158.91, TLS, session=<Foriup5Fd56LHL66>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-12-11 01:48:56 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:47884: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 01:51:07 host2 sshd[2880025]: Disconnected from invalid user admin 2.57.121.112 port 56109 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.229.220.185
country_id: 6251999
description:
2025-12-11 01:57:26 dovecot_login authenticator failed for ([199.229.220.185]) [199.229.220.185]:57378: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-11 01:57:41 dovecot_plain authenticator failed for (revolbed) [24.104.225.201]:55292: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-11 01:57:45 dovecot_login authenticator failed for 40-54-166-83.dyn.estpak.ee [83.166.54.40]:39582: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.109
country_id: 690791
description:
Dec 11 01:59:04 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=176.103.11.109, lip=66.85.158.91, TLS, session=<y/cX4J5FetCwZwtt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.26
country_id: 3865483
description:
Dec 11 01:59:25 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.252.26, lip=66.85.158.91, TLS, session=<5R5C4Z5Fi5+zAPwa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.31
country_id: 3175395
description:
Dec 11 02:01:22 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.15.171.31, lip=66.85.158.91, TLS, session=<UBlL6J5FcYu5D6sf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-12-11 02:01:32 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:48217: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.38
country_id: 798544
description:
Dec 11 02:01:42 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=89.231.35.38, lip=66.85.158.91, TLS, session=<9+d06Z5F+MxZ5yMm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.249
country_id: 6252001
description:
2025-12-11 02:01:57 dovecot_login authenticator failed for ([98.185.121.249]) [98.185.121.249]:57771: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-12-11 02:05:22 dovecot_login authenticator failed for ([115.248.153.209]) [115.248.4.85]:49622: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-11 02:05:34 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:49098: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.0
country_id: 2750405
description:
Dec 11 02:05:35 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=85.217.140.0, lip=66.85.158.92, session=<C2lr+J5F+uNV2YwA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 02:05:46 host2 sshd[2890999]: Disconnected from invalid user  62.60.131.157 port 13983 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-11 02:06:44 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:52144: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-11 02:06:43 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:47340: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.100.204.180
country_id: 2661886
description:
2025-12-11 02:06:09 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:52608: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-11 02:06:22 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:58882: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.109
country_id: 6252001
description:
2025-12-11 02:07:29 dovecot_login authenticator failed for ([98.185.120.109]) [98.185.120.109]:46567: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-11 02:07:48 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:46016: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.89.137.98
country_id: 3686110
description:
2025-12-11 02:09:49 dovecot_plain authenticator failed for (T31NGXPI6836) [191.89.137.98]:50015: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.13
country_id: 6252001
description:
Dec 11 02:10:28 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.13, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<a+LqCZ9F6MqTuYQN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-11 02:19:29 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (lispider) [98.204.134.124]:42594: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-12-11 02:20:46 dovecot_plain authenticator failed for (noncelly) [87.121.76.190]:59401: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-11 02:20:50 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:34965: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-11 02:21:08 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:21710: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-11 02:22:24 dovecot_plain authenticator failed for (worry) [24.187.213.29]:60004: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-11 02:22:49 dovecot_login authenticator failed for ([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2025-12-11 02:23:04 dovecot_login authenticator failed for ([125.19.175.93]) [182.95.176.122]:40418: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-11 02:23:10 dovecot_plain authenticator failed for (balloed) [5.31.23.133]:56013: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-11 02:23:29 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63792: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 02:23:54 host2 sshd[2902838]: Disconnected from invalid user user 2.57.121.25 port 41900 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-11 02:24:26 dovecot_login authenticator failed for ([182.95.85.181]) [182.95.123.46]:37334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-12-11 02:24:49 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:1718: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 02:26:49 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (actichar) [87.103.126.54]:20370: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-12-11 02:27:26 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:28222: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-11 02:27:40 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:52460: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2025-12-11 02:29:19 dovecot_login authenticator failed for ([103.111.109.194]) [103.111.109.194]:35230: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-11 02:28:59 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:53442: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2025-12-11 02:32:28 dovecot_login authenticator failed for ([110.172.147.190]) [110.172.147.190]:33071: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.39
country_id: 1733045
description:
2025-12-11 02:32:44 dovecot_login authenticator failed for ([49.124.151.39]) [49.124.151.39]:47040: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.113
country_id: 3996063
description:
2025-12-11 02:33:02 dovecot_login authenticator failed for ([201.173.250.113]) [201.173.250.113]:40387: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-12-11 02:33:01 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:35654: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2025-12-11 02:33:49 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:39547: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-11 02:34:01 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:37921: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2025-12-11 02:35:26 dovecot_plain authenticator failed for (chemice) [173.165.182.203]:53941: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.104.111.237
country_id: 298795
description:
2025-12-11 02:36:03 dovecot_plain authenticator failed for (hoticons) [85.104.111.237]:36630: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-11 02:36:06 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (trion) [76.157.219.158]:57626: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.137
country_id: 1643084
description:
Dec 11 02:38:50 host2 sshd[2911836]: Disconnected from invalid user steam 116.193.191.137 port 51660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
country_id: 6252001
description:
2025-12-11 02:38:05 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:50605: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 11 02:38:08 host2 sshd[2911663]: Disconnected from invalid user mantis 152.32.218.149 port 39384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-11 02:38:15 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:45046: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-11 02:38:32 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:38508: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-11 02:38:46 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:42370: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-11 02:39:26 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:49451: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-11 02:39:48 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:49399: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.137
country_id: 1643084
description:
Dec 11 02:40:09 host2 sshd[2912505]: Disconnected from invalid user ubuntu 116.193.191.137 port 46556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 11 02:40:42 host2 sshd[2912847]: Disconnected from invalid user zcm 84.51.43.58 port 44866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 11 02:41:06 host2 sshd[2913001]: Disconnected from invalid user mis 152.32.218.149 port 48010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-11 02:41:26 dovecot_plain authenticator failed for (brooda) [81.0.54.119]:41395: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.27.36.4
country_id: 1643084
description:
Dec 11 02:41:40 host2 sshd[2913211]: Disconnected from invalid user rahim 103.27.36.4 port 41602 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.137
country_id: 1643084
description:
Dec 11 02:42:05 host2 sshd[2913410]: Disconnected from invalid user eric 116.193.191.137 port 42060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 11 02:42:12 host2 sshd[2913486]: Disconnected from invalid user agent 177.54.62.66 port 51998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 11 02:42:14 host2 sshd[2913502]: Disconnected from invalid user fastuser 84.51.43.58 port 47410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.27.36.4
country_id: 1643084
description:
Dec 11 02:42:19 host2 sshd[2913594]: Disconnected from invalid user netbox 103.27.36.4 port 60398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 11 02:42:25 host2 sshd[2913699]: Disconnected from invalid user wangke 197.13.24.157 port 35594 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 02:43:52 host2 sshd[2914573]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 11 02:43:32 host2 sshd[2914440]: Disconnected from invalid user ganesh 177.54.62.66 port 53199 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.27.36.4
country_id: 1643084
description:
Dec 11 02:42:57 host2 sshd[2914164]: Disconnected from invalid user qiyuesuo 103.27.36.4 port 41220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 11 02:43:01 host2 sshd[2914188]: Disconnected from invalid user user 84.51.43.58 port 40047 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 84.51.43.58
country_id: 298795
description:
Dec 11 02:44:20 host2 sshd[2914911]: Disconnected from invalid user admin 84.51.43.58 port 53549 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.27.36.4
country_id: 1643084
description:
Dec 11 02:44:47 host2 sshd[2915438]: Disconnected from invalid user zcm 103.27.36.4 port 53316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.137
country_id: 1643084
description:
Dec 11 02:44:04 host2 sshd[2914771]: Disconnected from invalid user admini 116.193.191.137 port 40468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 11 02:44:17 host2 sshd[2914885]: Disconnected from invalid user ubuntu 197.13.24.157 port 39254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 11 02:44:18 host2 sshd[2914888]: Disconnected from invalid user vincent 125.21.53.232 port 54990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 11 02:44:58 host2 sshd[2915778]: Disconnected from invalid user jenkins 84.51.43.58 port 52983 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 11 02:45:29 host2 sshd[2916329]: Disconnected from invalid user zabbix 177.54.62.66 port 65030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 11 02:45:34 host2 sshd[2916395]: Disconnected from invalid user jenkins 125.21.53.232 port 51678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 11 02:46:45 host2 sshd[2917045]: Disconnected from invalid user david 125.21.53.232 port 36968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 11 02:46:07 host2 sshd[2916731]: Disconnected from invalid user jrodriguez 177.54.62.66 port 61786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 11 02:47:13 host2 sshd[2917357]: Disconnected from invalid user ftpuser1 197.13.24.157 port 39516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 11 02:47:20 host2 sshd[2917444]: Disconnected from invalid user odoo17 125.21.53.232 port 52830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 11 02:48:30 host2 sshd[2918173]: Disconnected from invalid user waleed 125.21.53.232 port 34562 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.36
country_id: 1733045
description:
2025-12-11 02:49:27 dovecot_login authenticator failed for (static.ftth.bgn.117.211.77.184.bsnl.in) [49.124.153.36]:38030: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 11 02:49:30 host2 sshd[2918933]: Disconnected from invalid user guest 160.251.101.169 port 59784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-11 02:49:38 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:57492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-11 02:50:05 dovecot_login authenticator failed for ([49.124.152.171]) [65.20.150.36]:38448: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 11 02:51:33 host2 sshd[2920691]: Disconnected from invalid user admin 154.198.215.66 port 32942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 11 02:51:36 host2 sshd[2920731]: Disconnected from invalid user maks 160.251.101.169 port 37812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 11 02:52:04 host2 sshd[2921413]: Disconnected from invalid user ociispth 181.49.50.6 port 42566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 11 02:53:12 host2 sshd[2922222]: Disconnected from invalid user dev 181.49.50.6 port 39010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-11 02:53:25 dovecot_login authenticator failed for (191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:46177: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 11 02:53:25 host2 sshd[2922334]: Disconnected from invalid user ociispth 154.198.215.66 port 41894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-11 02:53:41 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:56569: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 11 02:53:48 host2 sshd[2922553]: Disconnected from invalid user storage 181.49.50.6 port 51374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.46.125.140
country_id: 6252001
description:
Dec 11 02:54:10 host2 sshd[2923128]: Disconnected from invalid user uftp 209.46.125.140 port 57294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 11 02:53:57 host2 sshd[2922628]: Disconnected from invalid user star 160.251.101.169 port 53102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 11 02:54:59 host2 sshd[2923802]: Disconnected from invalid user www-data 181.49.50.6 port 47854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.46.125.140
country_id: 6252001
description:
Dec 11 02:55:11 host2 sshd[2924176]: Disconnected from invalid user ts3 209.46.125.140 port 45540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 11 02:56:04 host2 sshd[2924897]: Disconnected from invalid user mike 52.187.9.8 port 42936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-11 02:56:42 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (recin) [76.16.7.82]:49756: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 11 02:57:31 host2 sshd[2925731]: Disconnected from invalid user runner 154.198.215.66 port 44004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.236.223.62
country_id: 2077456
description:
Dec 11 02:57:39 host2 sshd[2925812]: Disconnected from invalid user admin 13.236.223.62 port 49740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-12-11 02:58:19 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:51140: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.46.125.140
country_id: 6252001
description:
Dec 11 02:58:24 host2 sshd[2926246]: Disconnected from invalid user itadmin 209.46.125.140 port 53052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 11 02:58:46 host2 sshd[2926464]: Disconnected from invalid user user123 52.187.9.8 port 57266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-11 02:58:49 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:37841: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.226
country_id: 6252001
description:
2025-12-11 02:58:57 dovecot_login authenticator failed for wsip-184-191-242-226.fv.ks.cox.net [184.191.242.226]:41718: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.249
country_id: 1733045
description:
2025-12-11 02:59:18 dovecot_login authenticator failed for ([49.124.152.249]) [49.124.152.249]:42542: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-11 02:59:18 dovecot_plain authenticator failed for (chroter) [65.20.147.45]:60722: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-11 02:59:20 dovecot_plain authenticator failed for (canceav) [65.20.184.80]:58800: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-11 02:59:36 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:50394: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.236.223.62
country_id: 2077456
description:
Dec 11 02:59:41 host2 sshd[2927013]: Disconnected from invalid user almacen 13.236.223.62 port 40824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-12-11 03:00:07 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:56276: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.46.125.140
country_id: 6252001
description:
Dec 11 03:00:19 host2 sshd[2927606]: Disconnected from invalid user ako 209.46.125.140 port 59070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.115.13.62
country_id: 6252001
description:
Dec 11 03:00:40 host2 sshd[2927754]: Disconnected from invalid user peter 136.115.13.62 port 56716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 11 03:00:52 host2 sshd[2927997]: Disconnected from invalid user doris 52.187.9.8 port 49446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 11 03:01:19 host2 sshd[2928333]: Disconnected from invalid user automation 123.58.213.126 port 45232 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 11 03:03:03 host2 sshd[2929596]: Disconnected from invalid user admin1 123.58.213.126 port 36626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 11 03:03:46 host2 sshd[2930298]: Disconnected from invalid user ftptest 52.187.9.8 port 49258 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 03:04:36 host2 sshd[2930788]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.236.223.62
country_id: 2077456
description:
Dec 11 03:04:16 host2 sshd[2930559]: Disconnected from invalid user mrodelo 13.236.223.62 port 53690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 11 03:04:28 host2 sshd[2930701]: Disconnected from invalid user alex 52.187.9.8 port 42864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.236.223.62
country_id: 2077456
description:
Dec 11 03:05:52 host2 sshd[2931823]: Disconnected from invalid user www-data 13.236.223.62 port 47642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-12-11 03:04:56 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:59311: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.245.141.225
country_id: 2077456
description:
2025-12-11 03:05:09 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:55067: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.27.203.82
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 103.27.203.82 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-11 03:05:17 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12172: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 11 03:05:30 host2 sshd[2931582]: Disconnected from invalid user www-data 123.58.213.126 port 41758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.115.13.62
country_id: 6252001
description:
Dec 11 03:06:29 host2 sshd[2932320]: Disconnected from invalid user webadmin 136.115.13.62 port 44280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 03:09:42 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (suplas) [87.103.126.54]:55888: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.115.13.62
country_id: 6252001
description:
Dec 11 03:08:54 host2 sshd[2934012]: Disconnected from invalid user ark 136.115.13.62 port 36110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-11 03:08:56 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:40756: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-11 03:09:17 dovecot_login authenticator failed for ([177.236.146.191]) [177.236.146.191]:40650: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-12-11 03:15:08 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:45513: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-12-11 03:15:49 dovecot_login authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:45008: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-11 03:16:52 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (siannescon) [24.91.103.202]:41042: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.249.51.34
country_id: 248816
description:
2025-12-11 03:17:17 dovecot_plain authenticator failed for ([89.116.164.85]) [94.249.51.34]:47168: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.206.53
country_id: 290557
description:
2025-12-11 03:17:33 dovecot_plain authenticator failed for ([89.116.164.85]) [5.31.206.53]:15496: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.70.49.137
country_id: 285570
description:
2025-12-11 03:17:48 dovecot_plain authenticator failed for ([89.116.164.85]) [188.70.49.137]:48233: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 03:18:08 host2 sshd[2941888]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.70.49.137
country_id: 285570
description:
2025-12-11 03:17:55 dovecot_login authenticator failed for ([89.116.164.85]) [188.70.49.137]:48233: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 03:18:55 host2 sshd[2942262]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-11 03:19:15 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:54746: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-12-11 03:19:50 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:34692: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.151.2
country_id: 690791
description:
Dec 11 03:21:15 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.221.151.2, lip=66.85.158.91, TLS, session=<2oUGBqBFVoQl3ZcC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.82
country_id: 3469034
description:
Dec 11 03:21:35 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=186.209.251.82, lip=66.85.158.91, TLS, session=<j1IkB6BFt7a60ftS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-11 03:24:23 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:40998: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.40.236.31
country_id: 2510769
description:
2025-12-11 03:24:34 dovecot_login authenticator failed for 31.red-83-40-236.dynamicip.rima-tde.net [83.40.236.31]:40573: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-11 03:24:44 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:46014: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.40.236.31
country_id: 2510769
description:
2025-12-11 03:25:15 dovecot_login authenticator failed for 31.red-83-40-236.dynamicip.rima-tde.net [83.40.236.31]:41144: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-11 03:25:45 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:37268: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.32.121
country_id: 390903
description:
2025-12-11 03:26:06 dovecot_login authenticator failed for (149-210-32-121.mobile.nym.cosmote.net) [149.210.32.121]:58724: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.117
country_id: 6252001
description:
Dec 11 03:27:10 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.117, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aWEyHKBFwMSTuYR1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-11 03:28:19 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (entiants) [24.23.125.83]:59076: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 11 03:30:30 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ibccKKBF9pJChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-11 03:31:02 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:46260: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-11 03:31:16 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:50754: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2025-12-11 03:31:40 dovecot_login authenticator failed for ([152.52.227.94]) [152.52.227.94]:34784: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2025-12-11 03:32:02 dovecot_login authenticator failed for ([122.187.181.57]) [182.95.174.178]:51084: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-11 03:33:52 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:48366: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 03:33:32 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:19504: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-11 03:36:45 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:34190: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.41
country_id: 6252001
description:
2025-12-11 03:36:22 dovecot_login authenticator failed for ([98.185.120.41]) [98.185.120.41]:35253: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-11 03:38:51 dovecot_login authenticator failed for ([62.97.161.159]) [182.78.64.150]:49600: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.168
country_id: 6252001
description:
Dec 11 03:39:47 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ru1TSaBFc8yTuYSo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-11 03:41:13 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:59236: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-11 03:41:33 dovecot_login authenticator failed for (187.161.136.37-clientes-izzi.mx) [187.161.136.37]:51899: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-11 03:42:12 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (doless) [217.215.74.195]:38106: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-11 03:43:29 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (supecers) [68.52.119.193]:36898: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Dec 11 03:43:28 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS: Connection closed, session=<SIx7VqBFbI9ChJmH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-11 03:45:08 dovecot_login authenticator failed for (201.172.89.74-clientes-izzi.mx) [201.172.89.74]:55678: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-11 03:45:28 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:45678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-11 03:45:38 dovecot_plain authenticator failed for (eiscely) [24.104.225.201]:39807: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-11 03:45:42 dovecot_plain authenticator failed for (incomegal) [102.53.15.18]:32887: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-11 03:50:40 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37644: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-11 03:50:47 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:59466: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-11 03:50:54 dovecot_login authenticator failed for 14-0-142-131.static.pccw-hkt.com [14.0.142.131]:21887: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.41
country_id: 6252001
description:
2025-12-11 03:50:58 dovecot_login authenticator failed for ([98.181.46.41]) [98.181.46.41]:40582: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2025-12-11 03:51:40 dovecot_login authenticator failed for ([180.94.76.126]) [180.94.76.126]:47431: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-11 03:52:09 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:48196: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-11 03:55:17 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:43288: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-11 03:56:08 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:48272: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-11 03:56:33 dovecot_login authenticator failed for (30-170-97-62.cust.smartcall.no) [62.97.170.30]:48977: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.235.7.1
country_id: 3077311
description:
2025-12-11 03:57:40 dovecot_plain authenticator failed for customer7-1.airweb.cz (woring) [109.235.7.1]:42695: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.107
country_id: 3865483
description:
Dec 11 03:57:47 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.252.107, lip=66.85.158.91, TLS, session=<eEFtiKBFi+SzAPxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2025-12-11 03:57:50 dovecot_login authenticator failed for ([197.251.249.72]) [197.251.249.72]:35130: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-11 03:57:00 dovecot_plain authenticator failed for (crizint) [65.20.148.165]:50831: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-11 03:57:19 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:34453: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.20
country_id: 798544
description:
Dec 11 03:58:04 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=178.216.25.20, lip=66.85.158.91, TLS, session=<+ZC+iaBFLoKy2BkU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-11 03:59:48 dovecot_plain authenticator failed for (oveline) [154.144.243.93]:41976: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-11 04:05:17 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:48936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-11 04:05:38 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:44913: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-11 04:05:45 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:33254: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-11 04:05:45 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:7492: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-11 04:05:48 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:59566: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.188
country_id: 3996063
description:
2025-12-11 04:05:57 dovecot_login authenticator failed for ([177.239.164.188]) [177.239.164.188]:45194: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.199
country_id: 1733045
description:
2025-12-11 04:06:02 dovecot_login authenticator failed for ([49.124.149.199]) [49.124.149.199]:56428: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.63
country_id: 3996063
description:
2025-12-11 04:06:15 dovecot_login authenticator failed for (189.219.138.63-clientes-izzi.mx) [189.219.138.63]:33688: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-11 04:06:21 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:49322: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-11 04:07:10 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:54556: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.222.117.243
country_id: 6252001
description:
Dec 11 04:10:00 host2 sshd[2992180]: Disconnected from invalid user svxlink 35.222.117.243 port 55482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-11 04:10:29 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:58972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 11 04:11:34 host2 sshd[2994401]: Disconnected from invalid user admin 51.158.146.24 port 57544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 11 04:11:44 host2 sshd[2994546]: Disconnected from invalid user svxlink 152.32.171.99 port 45366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-11 04:11:49 dovecot_login authenticator failed for ([84.211.13.69]) [84.211.13.69]:58809: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 11 04:11:05 host2 sshd[2993825]: Disconnected from invalid user steam 152.32.171.99 port 53312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-11 04:11:13 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:34954: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-11 04:11:21 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:57282: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.222.117.243
country_id: 6252001
description:
Dec 11 04:12:39 host2 sshd[2995790]: Disconnected from invalid user tw 35.222.117.243 port 59338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-11 04:12:08 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:42656: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-11 04:16:12 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:38530: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 11 04:16:30 host2 sshd[3001497]: Disconnected from invalid user ubuntu 152.32.171.99 port 42946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 11 04:16:35 host2 sshd[3001629]: Disconnected from invalid user tw 51.158.146.24 port 56708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-11 04:16:39 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:54921: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-11 04:17:09 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:36174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.222.117.243
country_id: 6252001
description:
Dec 11 04:17:27 host2 sshd[3002817]: Disconnected from invalid user dbadmin 35.222.117.243 port 45416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-11 04:20:50 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:46274: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-12-11 04:21:07 dovecot_login authenticator failed for ([122.187.229.194]) [122.187.229.194]:50990: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-11 04:21:21 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:43767: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2025-12-11 04:21:52 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:54544: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-11 04:22:31 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:48412: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-11 04:22:07 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:51335: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 04:23:29 host2 sshd[3010733]: Disconnected from invalid user admin 62.60.131.157 port 33256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.191.141.128
country_id: 1512440
description:
2025-12-11 04:25:27 dovecot_plain authenticator failed for (shumine) [185.191.141.128]:34354: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-11 04:25:31 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (flaunnidap) [98.222.93.199]:54714: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.85
country_id: 6252001
description:
Dec 11 04:27:00 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.85, lip=66.85.158.92, session=<KfYu8qBFTtwUQcJV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-11 04:27:57 dovecot_plain authenticator failed for (kilactisup) [5.31.15.108]:52105: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-11 04:28:00 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (belisest) [73.68.220.15]:45168: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.183
country_id: 6252001
description:
Dec 11 04:29:03 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.183, lip=66.85.158.91, session=<yRp/+aBF/OuTuYS3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-11 04:31:43 dovecot_plain authenticator failed for (borthilate) [102.53.15.180]:53603: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2025-12-11 04:31:47 dovecot_plain authenticator failed for c-98-195-138-52.hsd1.tx.comcast.net (manhiides) [98.195.138.52]:60090: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-11 04:32:14 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:46525: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-11 04:31:55 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:54279: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-12-11 04:35:48 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:46930: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.188.178.23
country_id: 6252001
description:
2025-12-11 04:36:05 dovecot_login authenticator failed for syn-108-188-178-023.biz.spectrum.com [108.188.178.23]:40946: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Dec 11 04:37:13 host2 sshd[3023566]: Disconnected from invalid user zabbix 102.88.137.145 port 39532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-11 04:37:35 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:58350: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-11 04:37:59 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:39946: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-12-11 04:38:02 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:36418: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-11 04:38:27 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:55524: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.111.222.2
country_id: 6252001
description:
Dec 11 04:39:33 host2 sshd[3024972]: Disconnected from invalid user ubuntu 172.111.222.2 port 41606 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.104
country_id: 6252001
description:
Dec 11 04:38:55 host2 pure-ftpd[3024591]: (?@195.184.76.104) [INFO] New connection from 195.184.76.104


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Dec 11 04:39:21 host2 sshd[3024853]: Disconnected from invalid user parth 102.88.137.145 port 33820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.145
country_id: 2328926
description:
Dec 11 04:40:44 host2 sshd[3025846]: Disconnected from invalid user srs 102.88.137.145 port 38852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-11 04:40:54 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:39688: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-12-11 04:40:57 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:55727: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.10
country_id: 6252001
description:
2025-12-11 04:41:17 dovecot_login authenticator failed for wsip-184-191-243-10.fv.ks.cox.net [184.191.243.10]:41207: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-11 04:41:28 dovecot_login authenticator failed for (54-170-97-62.cust.smartcall.no) [62.97.170.54]:53820: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.111.222.2
country_id: 6252001
description:
Dec 11 04:41:50 host2 sshd[3026430]: Disconnected from invalid user kevin 172.111.222.2 port 50978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.253
country_id: 6252001
description:
2025-12-11 04:41:55 dovecot_login authenticator failed for wsip-184-191-242-253.fv.ks.cox.net [184.191.242.253]:39220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 172.111.222.2
country_id: 6252001
description:
Dec 11 04:42:16 host2 sshd[3026647]: Received disconnect from 172.111.222.2 port 40314:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-11 04:42:35 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:33637: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.111.222.2
country_id: 6252001
description:
Dec 11 04:43:10 host2 sshd[3027315]: Disconnected from invalid user dokku 172.111.222.2 port 50044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.111.222.2
country_id: 6252001
description:
Dec 11 04:43:38 host2 sshd[3027630]: Disconnected from invalid user oracle 172.111.222.2 port 34394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Dec 11 04:44:17 host2 sshd[3028064]: Disconnected from invalid user mcserver 102.88.137.145 port 33116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.42
country_id: 3865483
description:
Dec 11 04:46:43 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.249.42, lip=66.85.158.91, TLS, session=<X7V9N6FFc7izAPkq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.208
country_id: 3469034
description:
Dec 11 04:46:20 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.250.208, lip=66.85.158.91, TLS, session=<wrk/NqFFX6y60frQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-11 04:46:44 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:60738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-11 04:47:06 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:34898: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.46.235.164
country_id: 6252001
description:
Dec 11 04:47:07 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.46.235.164, lip=66.85.158.92, TLS, session=<8jEjOqFFLMsULuuk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-11 04:48:20 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:43151: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-11 04:47:55 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:40708: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.35.96
country_id: 3175395
description:
Dec 11 04:49:27 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=178.239.35.96, lip=66.85.158.91, TLS, session=<yh5wQaFF1a6y7yNg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.43
country_id: 953987
description:
Dec 11 04:49:47 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.129.59.43, lip=66.85.158.91, TLS, session=<yMqUQqFF2oNmgTsr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-11 04:50:38 dovecot_plain authenticator failed for (chary) [24.187.213.29]:34972: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.234
country_id: 6252001
description:
Dec 11 04:51:33 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.234, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<64sASqFFDMrN0h/q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.64
country_id: 6252001
description:
Dec 11 04:55:10 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.64, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tBTrVqFFLMuTuYRA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 04:57:17 host2 sshd[3037123]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-11 04:56:55 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:35404: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.108
country_id: 6252001
description:
2025-12-11 04:57:06 dovecot_login authenticator failed for ([70.174.168.108]) [70.174.168.108]:52105: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 04:59:48 host2 sshd[3038340]: Disconnected from invalid user user 2.57.121.25 port 8969 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.250.19
country_id: 6252001
description:
Dec 11 05:04:55 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.40.250.19, lip=66.85.158.91, session=<b7vNeaFF7KgUKPoT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-11 05:05:42 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:35080: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.54.83.21
country_id: 690791
description:
[2025-12-11 05:05:46 +0530] info [webmaild] 194.54.83.21 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-11 05:06:01 dovecot_login authenticator failed for a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:43142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-11 05:06:04 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:33549: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-11 05:07:17 dovecot_login authenticator failed for ([182.95.227.70]) [182.95.227.70]:54030: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2025-12-11 05:07:34 dovecot_login authenticator failed for ([49.124.155.162]) [49.124.155.162]:40500: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-12-11 05:07:38 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:44933: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-11 05:07:49 dovecot_login authenticator failed for ([152.52.92.105]) [152.52.192.74]:33954: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.1.44
country_id: 2077456
description:
2025-12-11 05:07:49 dovecot_login authenticator failed for ([120.157.1.44]) [120.157.1.44]:38400: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-11 05:07:59 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:50764: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-11 05:08:14 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:32864: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.34
country_id: 6252001
description:
2025-12-11 05:08:22 dovecot_login authenticator failed for wsip-184-191-250-34.fv.ks.cox.net [184.191.250.34]:60723: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 05:10:43 host2 sshd[3046392]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-11 05:11:43 dovecot_login authenticator failed for (dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:33780: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 05:11:47 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (suplas) [51.195.117.220]:27337: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 05:10:58 host2 sshd[3046484]: Disconnected from invalid user admin 62.60.131.157 port 53941 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-11 05:12:13 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:58088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-12-11 05:12:23 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:34055: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.14.195.218
country_id: 2510769
description:
2025-12-11 05:12:35 dovecot_login authenticator failed for 218.red-88-14-195.dynamicip.rima-tde.net [88.14.195.218]:57500: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-11 05:13:24 dovecot_plain authenticator failed for (ercine) [65.20.133.208]:39893: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-11 05:15:54 dovecot_plain authenticator failed for (plaali) [154.146.240.123]:40360: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-11 05:14:59 dovecot_plain authenticator failed for (phoncys) [102.53.15.180]:41156: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-11 05:15:40 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (furagid) [96.230.65.90]:50200: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.115.97
country_id: 2921044
description:
Dec 11 05:18:42 host2 pure-ftpd[3051010]: (?@46.101.115.97) [INFO] New connection from 46.101.115.97


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.226.127.55
country_id: 2921044
description:
Dec 11 05:18:41 host2 pure-ftpd[3051002]: (?@64.226.127.55) [INFO] New connection from 64.226.127.55


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.13.6
country_id: 3996063
description:
Dec 11 05:20:57 host2 sshd[3052542]: Disconnected from invalid user fmaster 189.178.13.6 port 42412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-12-11 05:21:56 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:36634: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.13.6
country_id: 3996063
description:
Dec 11 05:22:11 host2 sshd[3053592]: Disconnected from invalid user postgres 189.178.13.6 port 34402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-11 05:22:48 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:40326: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.13.6
country_id: 3996063
description:
Dec 11 05:23:39 host2 sshd[3054576]: Disconnected from invalid user zhang 189.178.13.6 port 35090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-11 05:26:06 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:49878: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-11 05:26:25 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:37215: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.13.6
country_id: 3996063
description:
Dec 11 05:26:52 host2 sshd[3057257]: Disconnected from invalid user test1234 189.178.13.6 port 50894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.13.6
country_id: 3996063
description:
Dec 11 05:27:33 host2 sshd[3057871]: Disconnected from invalid user developer1 189.178.13.6 port 37120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-11 05:28:56 dovecot_plain authenticator failed for (cynephlon) [5.31.15.108]:59085: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.46.222.66
country_id: 3469034
description:
Dec 11 05:30:36 host2 sshd[3060614]: Disconnected from invalid user ftpuser 177.46.222.66 port 17063 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-11 05:31:14 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:35075: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-11 05:31:17 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:27151: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-12-11 05:31:39 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:45600: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-11 05:31:43 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:58056: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-11 05:32:27 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:49875: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.117.94
country_id: 2510769
description:
2025-12-11 05:32:49 dovecot_login authenticator failed for ([46.35.117.94]) [46.35.117.94]:59437: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 05:33:52 host2 pure-ftpd[3062638]: (?@188.26.220.248) [WARNING] Authentication failed for user [ssvorof@epid.gov.lk]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 05:33:44 host2 sshd[3062640]: Invalid user ssvorof@epid.gov.lk from 188.26.220.248 port 56927


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 05:33:44 host2 pure-ftpd[3062638]: (?@188.26.220.248) [INFO] New connection from 188.26.220.248


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.159
country_id: 3469034
description:
Dec 11 05:33:49 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.250.159, lip=66.85.158.91, TLS, session=<xW3736FF8ee60fqf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.62
country_id: 1269750
description:
Dec 11 05:34:10 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=43.229.225.62, lip=66.85.158.91, TLS, session=<0UNA4aFFX9gr5eE+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 05:34:14 host2 pure-ftpd[3062989]: (?@188.26.220.248) [INFO] New connection from 188.26.220.248


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 05:34:21 host2 pure-ftpd[3062989]: (?@188.26.220.248) [WARNING] Authentication failed for user [epid]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.46.222.66
country_id: 3469034
description:
Dec 11 05:34:45 host2 sshd[3063264]: Disconnected from invalid user pterodactyl 177.46.222.66 port 50332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.46.222.66
country_id: 3469034
description:
Dec 11 05:35:27 host2 sshd[3063895]: Disconnected from invalid user system 177.46.222.66 port 9279 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.53
country_id: 6252001
description:
Dec 11 05:35:36 host2 pure-ftpd[3063979]: (?@205.210.31.53) [INFO] New connection from 205.210.31.53


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-11 05:36:04 dovecot_plain authenticator failed for (viness) [109.226.14.93]:50370: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.26.220.248
country_id: 2510769
description:
2025-12-11 05:36:18 dovecot_plain authenticator failed for (LAPTOP-46BM8FS3) [188.26.220.248]:51626: 535 Incorrect authentication data (set_id=ssvorof@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.54
country_id: 6252001
description:
2025-12-11 05:37:51 dovecot_login authenticator failed for ([98.185.120.54]) [98.185.120.54]:60264: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-11 05:38:48 dovecot_login authenticator failed for ([182.95.58.114]) [182.95.58.114]:60288: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.93.36.83
country_id: 1821275
description:
2025-12-11 05:39:09 dovecot_login authenticator failed for ([182.93.36.83]) [182.93.36.83]:39932: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-11 05:41:55 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (eming) [71.62.34.216]:47024: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.243.254.67
country_id: 1643084
description:
Dec 11 05:42:27 host2 sshd[3069026]: Disconnected from invalid user sa 180.243.254.67 port 15282 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.112
country_id: 6252001
description:
Dec 11 05:43:12 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.195.112, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ttqyAqJFCugUQcNw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.243.254.67
country_id: 1643084
description:
Dec 11 05:43:45 host2 sshd[3070731]: Disconnected from invalid user dev1 180.243.254.67 port 25778 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.243.254.67
country_id: 1643084
description:
Dec 11 05:44:24 host2 sshd[3071648]: Disconnected from invalid user website 180.243.254.67 port 16989 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-11 05:45:49 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (dectival) [96.230.65.90]:59206: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 11 05:47:04 host2 sshd[3076162]: Disconnected from invalid user tomas 162.223.91.130 port 37120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.82.240
country_id: 1269750
description:
2025-12-11 05:47:41 dovecot_login authenticator failed for (static.ill.117.247.82.240.bsnl.co.in) [117.247.82.240]:41924: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.80.220.155
country_id: 6252001
description:
2025-12-11 05:47:54 dovecot_login authenticator failed for mobile-107-80-220-155.mycingular.net [107.80.220.155]:43212: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Dec 11 05:47:58 host2 sshd[3077623]: Disconnected from invalid user bot1 51.158.120.121 port 38092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 11 05:48:11 host2 sshd[3077996]: Disconnected from invalid user deployer 162.223.91.130 port 33940 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 11 05:48:42 host2 sshd[3078766]: Disconnected from invalid user kiosk 162.223.91.130 port 46464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 11 05:49:13 host2 sshd[3079548]: Disconnected from invalid user ubuntu 162.223.91.130 port 58984 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.197
country_id: 2635167
description:
Dec 11 05:50:19 host2 dovecot[2672093]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.197, lip=66.85.158.91, TLS, session=<akwkHKJFmdVX7LDF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.23
country_id: 2635167
description:
Dec 11 05:50:20 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.23, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bp4zHKJFs6JX7LAX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Dec 11 05:50:28 host2 sshd[3080935]: Disconnected from invalid user userftp 51.158.120.121 port 51372 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.25
country_id: 2635167
description:
Dec 11 05:50:53 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.25, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<BfAuHqJFxYW594kZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Dec 11 05:51:10 host2 sshd[3081430]: Disconnected from invalid user user 146.59.80.142 port 48900 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.8
country_id: 2635167
description:
Dec 11 05:51:26 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NScqIKJFy5S594kI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.120.121
country_id: 3017382
description:
Dec 11 05:51:32 host2 sshd[3081604]: Disconnected from invalid user git 51.158.120.121 port 40844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-12-11 05:51:47 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:55020: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.20
country_id: 2635167
description:
Dec 11 05:52:33 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.20, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<luMgJKJF/ea594kU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.36
country_id: 2635167
description:
Dec 11 05:52:00 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.36, lip=66.85.158.91, TLS handshaking: Connection closed, session=<CqslIqJFf9RX7LAk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-11 05:52:14 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:34914: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 11 05:52:27 host2 sshd[3082610]: Disconnected from invalid user administrator 103.186.1.120 port 39368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Dec 11 05:52:59 host2 sshd[3083038]: Disconnected from invalid user gandalf 146.59.80.142 port 47932 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.26
country_id: 2635167
description:
Dec 11 05:53:06 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<H2IaJqJFV6hX7LAa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.104.187.66
country_id: 719819
description:
[2025-12-11 05:53:21 +0530] info [webmaild] 185.104.187.66 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.37
country_id: 2635167
description:
Dec 11 05:53:39 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.37, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iX4XKKJFk+pX7LAl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.59.80.142
country_id: 3017382
description:
Dec 11 05:54:17 host2 sshd[3084150]: Disconnected from invalid user git 146.59.80.142 port 48790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Dec 11 05:54:37 host2 sshd[3084671]: Disconnected from invalid user cat 194.107.115.199 port 39780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.36
country_id: 2635167
description:
Dec 11 05:54:46 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.36, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<PUwMLKJFJay594kk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 11 05:53:58 host2 sshd[3083740]: Disconnected from invalid user aa 103.186.1.120 port 52832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.10
country_id: 2635167
description:
Dec 11 05:54:13 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.10, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<+eYSKqJF39NX7LAK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.17
country_id: 2635167
description:
Dec 11 05:55:19 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.17, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<G5UHLqJFzYRX7LAR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 11 05:55:24 host2 sshd[3085680]: Disconnected from invalid user admin 103.186.1.120 port 41510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 11 05:55:52 host2 sshd[3086171]: Disconnected from invalid user piyush 72.240.125.133 port 39172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-11 05:56:37 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:45390: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 11 05:56:49 host2 sshd[3086727]: Disconnected from invalid user admin 72.240.125.133 port 55664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Dec 11 05:56:22 host2 sshd[3086479]: Disconnected from invalid user admin 194.107.115.199 port 53204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-11 05:56:26 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:41306: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-11 05:57:41 dovecot_login authenticator failed for ([62.97.169.221]) [62.97.169.221]:55200: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-11 05:56:57 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:51486: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-11 05:57:04 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:44312: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 11 05:57:26 host2 sshd[3086996]: Disconnected from invalid user mina 103.186.1.120 port 42212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2025-12-11 05:57:42 dovecot_login authenticator failed for cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:49001: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Dec 11 05:57:48 host2 sshd[3087294]: Disconnected from invalid user mysqld 194.107.115.199 port 3240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2025-12-11 05:58:29 dovecot_login authenticator failed for ([49.124.148.2]) [49.124.148.2]:33594: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.158.125.117
country_id: 2921044
description:
Dec 11 05:57:55 host2 sshd[3087324]: Disconnected from invalid user sbserver 35.158.125.117 port 47340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-11 05:57:55 dovecot_login authenticator failed for (177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:43893: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Dec 11 05:59:07 host2 sshd[3088215]: Disconnected from invalid user administrador 194.107.115.199 port 17780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.65
country_id: 1605651
description:
Dec 11 05:58:57 host2 sshd[3088063]: Disconnected from invalid user admin 110.78.149.65 port 41898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 11 05:59:02 host2 sshd[3088160]: Disconnected from invalid user mysqld 72.240.125.133 port 49902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.62
country_id: 1643084
description:
Dec 11 05:59:58 host2 sshd[3088732]: Disconnected from invalid user testuser 103.172.204.62 port 58794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-11 06:02:31 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:36416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-11 06:02:49 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:48563: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-11 06:02:58 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:37024: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-11 06:03:18 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:50535: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-11 06:03:21 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:43374: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-12-11 06:03:48 dovecot_login authenticator failed for ([149.54.33.130]) [149.54.33.130]:59779: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.78.149.65
country_id: 1605651
description:
Dec 11 06:04:24 host2 sshd[3092391]: Disconnected from invalid user shoutcast 110.78.149.65 port 53120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.62
country_id: 1643084
description:
Dec 11 06:03:59 host2 sshd[3092060]: Disconnected from invalid user git 103.172.204.62 port 38274 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.142
country_id: 6252001
description:
Dec 11 06:05:03 host2 pure-ftpd[3093047]: (?@66.132.153.142) [INFO] New connection from 66.132.153.142


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.65
country_id: 1605651
description:
Dec 11 06:05:04 host2 sshd[3093039]: Disconnected from invalid user wcs 110.78.149.65 port 39992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.62
country_id: 1643084
description:
Dec 11 06:05:33 host2 sshd[3093410]: Disconnected from invalid user sandy 103.172.204.62 port 41046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.62
country_id: 1643084
description:
Dec 11 06:06:23 host2 sshd[3093914]: Disconnected from invalid user ubuntu 103.172.204.62 port 43638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-11 06:09:12 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60256: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.62
country_id: 1643084
description:
Dec 11 06:11:01 host2 sshd[3096740]: Disconnected from invalid user builder 103.172.204.62 port 53138 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-11 06:12:37 dovecot_login authenticator failed for ([150.129.20.234]) [150.129.20.234]:59343: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 11 06:17:15 host2 sshd[3101176]: Disconnected from invalid user deploy 103.55.36.22 port 54776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 11 06:17:24 host2 sshd[3101277]: Disconnected from invalid user ubuntu 137.184.30.179 port 46000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.79.179
country_id: 3017382
description:
Dec 11 06:17:37 host2 sshd[3101408]: Disconnected from invalid user git 163.5.79.179 port 53552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.186.225
country_id: 2921044
description:
Dec 11 06:17:40 host2 sshd[3101428]: Disconnected from invalid user admin 138.124.186.225 port 35072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.186.225
country_id: 2921044
description:
Dec 11 06:18:11 host2 sshd[3101921]: Disconnected from invalid user user 138.124.186.225 port 60512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Dec 11 06:18:17 host2 sshd[3101997]: Disconnected from invalid user admin 168.167.228.74 port 36306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Dec 11 06:18:36 host2 sshd[3102202]: Disconnected from invalid user user 103.187.147.92 port 59022 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 11 06:19:10 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kZpVg6JFlIoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.155.189.74
country_id: 3996063
description:
2025-12-11 06:19:29 dovecot_plain authenticator failed for ([89.116.164.85]) [187.155.189.74]:34818: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.155.189.74
country_id: 3996063
description:
2025-12-11 06:19:35 dovecot_login authenticator failed for ([89.116.164.85]) [187.155.189.74]:34818: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.77.49
country_id: 3865483
description:
2025-12-11 06:19:41 dovecot_plain authenticator failed for ([89.116.164.85]) [181.46.77.49]:6740: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.186.225
country_id: 2921044
description:
Dec 11 06:19:41 host2 sshd[3102964]: Disconnected from invalid user sonar 138.124.186.225 port 39828 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 11 06:19:52 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Xk/NhaJFTKMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.245.39.117
country_id: 6290252
description:
2025-12-11 06:19:54 dovecot_plain authenticator failed for ([89.116.164.85]) [109.245.39.117]:60115: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Dec 11 06:20:24 host2 sshd[3103657]: Disconnected from invalid user bitwarden 168.167.228.74 port 36309 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 11 06:20:40 host2 sshd[3103865]: Disconnected from invalid user frappe 182.48.68.82 port 43048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 11 06:20:42 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<MKTOiKJFntIDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Dec 11 06:20:35 host2 sshd[3103823]: Disconnected from invalid user taiko 103.187.147.92 port 33530 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.92
country_id: 1643084
description:
Dec 11 06:21:12 host2 sshd[3104178]: Disconnected from invalid user admin 103.187.147.92 port 34150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-11 06:21:25 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:52934: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.152.225
country_id: 1269750
description:
Dec 11 06:21:38 host2 sshd[3104433]: Disconnected from invalid user sonar 122.160.152.225 port 52090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.72
country_id: 3996063
description:
2025-12-11 06:21:44 dovecot_login authenticator failed for ([177.236.144.72]) [177.236.144.72]:40543: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Dec 11 06:21:59 host2 sshd[3104625]: Disconnected from invalid user sonar 103.187.147.92 port 58716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-11 06:22:06 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:3552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.122
country_id: 1880251
description:
Dec 11 06:22:07 host2 sshd[3104635]: Disconnected from invalid user deploy 45.78.220.122 port 34020 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.117
country_id: 3017382
description:
Dec 11 06:22:11 host2 pure-ftpd[3104763]: (?@91.231.89.117) [INFO] New connection from 91.231.89.117


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.114
country_id: 3017382
description:
Dec 11 06:22:12 host2 pure-ftpd[3104788]: (?@91.231.89.114) [INFO] New connection from 91.231.89.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-11 06:23:04 dovecot_login authenticator failed for ([95.164.177.6]) [95.164.177.6]:48140: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.122
country_id: 1880251
description:
Dec 11 06:23:11 host2 sshd[3105248]: Disconnected from invalid user david 45.78.220.122 port 50732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 11 06:22:32 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<I79ej6JFaMoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-11 06:22:44 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:49076: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 11 06:22:47 host2 sshd[3105035]: Disconnected from invalid user ftpuser 137.184.30.179 port 39226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Dec 11 06:22:34 host2 sshd[3104930]: Disconnected from invalid user deployer 103.187.147.92 port 34508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.190.134
country_id: 3175395
description:
Dec 11 06:22:52 host2 sshd[3105079]: Disconnected from invalid user ubuntu 79.32.190.134 port 36316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.220.122
country_id: 1880251
description:
Dec 11 06:24:22 host2 sshd[3106134]: Disconnected from invalid user bitwarden 45.78.220.122 port 33500 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 11 06:23:55 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AtpUlKJFNuUDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.190.134
country_id: 3175395
description:
Dec 11 06:24:13 host2 sshd[3106028]: Disconnected from invalid user gitlab-runner 79.32.190.134 port 33818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Dec 11 06:24:16 host2 sshd[3106085]: Disconnected from invalid user sonar 168.167.228.74 port 36315 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.122
country_id: 1880251
description:
Dec 11 06:25:28 host2 sshd[3106982]: Disconnected from invalid user admin 45.78.220.122 port 43860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 11 06:24:39 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uAbqlqJFvpgDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.152.225
country_id: 1269750
description:
Dec 11 06:24:59 host2 sshd[3106527]: Disconnected from invalid user deployer 122.160.152.225 port 43666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 11 06:25:22 host2 sshd[3106958]: Disconnected from invalid user space 137.184.30.179 port 54322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.190.134
country_id: 3175395
description:
Dec 11 06:25:34 host2 sshd[3107036]: Disconnected from invalid user mtvps1 79.32.190.134 port 59554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 11 06:25:56 host2 sshd[3107276]: Disconnected from invalid user kitchen 182.48.68.82 port 48754 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 11 06:26:16 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<cBK4nKJF5NoDgmBb>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 11 06:26:26 host2 sshd[3107550]: Received disconnect from 137.184.30.179 port 46142:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 11 06:26:26 host2 sshd[3107550]: Disconnected from invalid user mtvps1 137.184.30.179 port 46142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 11 06:26:44 host2 sshd[3107680]: Disconnected from invalid user postgres 182.48.68.82 port 59528 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 11 06:26:46 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<BoF8nqJF0rkDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.139.105
country_id: 690791
description:
Dec 11 06:26:53 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=37.221.139.105, lip=66.85.158.91, TLS, session=<CO/ZnaJFXO0l3Ytp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.140.234.172
country_id: 719819
description:
Dec 11 06:27:10 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=45.140.234.172, lip=66.85.158.91, TLS, session=<bWz1nqJFj6ktjOqs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-11 06:27:24 dovecot_login authenticator failed for ([27.123.113.10]) [27.123.113.10]:49000: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-11 06:28:00 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:36518: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 11 06:27:34 host2 sshd[3108144]: Disconnected from invalid user ghostuser 182.48.68.82 port 39052 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.207.250.28
country_id: 130758
description:
2025-12-11 06:27:42 dovecot_plain authenticator failed for (placidis) [213.207.250.28]:49310: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.38
country_id: 3996063
description:
2025-12-11 06:29:01 dovecot_login authenticator failed for (187.161.136.38-clientes-izzi.mx) [187.161.136.38]:36440: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.152.225
country_id: 1269750
description:
Dec 11 06:29:08 host2 sshd[3109507]: Disconnected from invalid user ubuntu 122.160.152.225 port 44838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-11 06:28:41 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:51680: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.152.225
country_id: 1269750
description:
Dec 11 06:31:12 host2 sshd[3111400]: Disconnected from invalid user dmdba 122.160.152.225 port 45418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-11 06:35:17 dovecot_plain authenticator failed for (sopolee) [12.150.243.22]:31542: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.188.177.46
country_id: 1643084
description:
Dec 11 06:36:03 host2 sshd[3117108]: Disconnected from invalid user ilya 103.188.177.46 port 45754 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.188.177.46
country_id: 1643084
description:
Dec 11 06:36:44 host2 sshd[3118001]: Disconnected from invalid user ubuntu 103.188.177.46 port 59048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.108
country_id: 6252001
description:
2025-12-11 06:38:09 dovecot_login authenticator failed for ([70.174.168.108]) [70.174.168.108]:51638: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-11 06:38:31 dovecot_login authenticator failed for ([84.210.151.158]) [84.210.151.158]:47725: 535 Incorrect authentication data (set_id=orders@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-11 06:37:44 dovecot_login authenticator failed for ([182.73.193.249]) [122.187.41.18]:41664: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-12-11 06:38:36 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:49226: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.188.177.46
country_id: 1643084
description:
Dec 11 06:38:47 host2 sshd[3119508]: Disconnected from invalid user tmp 103.188.177.46 port 41574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.3
country_id: 6252001
description:
2025-12-11 06:38:50 dovecot_login authenticator failed for wsip-184-191-243-3.fv.ks.cox.net [184.191.243.3]:49903: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-11 06:41:21 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (niculednes) [196.47.172.253]:44838: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-11 06:41:57 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:44534: 535 Incorrect authentication data (set_id=orders@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-11 06:42:06 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:36802: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-12-11 06:42:25 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:55102: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-11 06:42:30 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:53893: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.35
country_id: 1269750
description:
Dec 11 06:42:29 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.237.58.35, lip=66.85.158.91, TLS, session=<a1uQ1aJFa6Nn7Toj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-11 06:42:38 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:50018: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.89.213.20
country_id: 3469034
description:
Dec 11 06:42:50 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=189.89.213.20, lip=66.85.158.91, TLS, session=<IL/T1qJFGLG9WdUU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-11 06:44:05 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (ratized) [73.137.7.97]:54478: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 06:45:12 host2 sshd[3123547]: Disconnected from invalid user  62.60.131.157 port 61245 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-11 06:46:57 dovecot_login authenticator failed for (nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:57920: 535 Incorrect authentication data (set_id=orders@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-12-11 06:47:18 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:47482: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.252
country_id: 1733045
description:
2025-12-11 06:47:26 dovecot_login authenticator failed for ([49.124.152.252]) [49.124.152.252]:47748: 535 Incorrect authentication data (set_id=orders@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-11 06:47:46 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:57278: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-12-11 06:48:11 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:43376: 535 Incorrect authentication data (set_id=orders@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-11 06:48:27 dovecot_login authenticator failed for ([125.19.110.89]) [182.78.107.6]:55808: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-11 06:50:07 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (setivers) [76.157.219.158]:54456: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-11 06:52:40 dovecot_login authenticator failed for (70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:58541: 535 Incorrect authentication data (set_id=orders@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-11 06:52:52 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:39453: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-11 06:53:38 dovecot_login authenticator failed for ([125.20.154.97]) [182.95.178.206]:35494: 535 Incorrect authentication data (set_id=orders@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 06:54:13 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (sisomic) [51.195.117.220]:27523: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-11 06:54:14 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:39758: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.249
country_id: 6252001
description:
Dec 11 06:58:09 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.249, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ELC5DqNF3djG6xj5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-11 07:00:41 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (ancrus) [24.98.45.238]:35396: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-11 07:02:08 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (pogbohity) [96.230.65.90]:42074: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.72
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.72: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-12-11 07:02:44 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:39370: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 11 07:04:24 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.92, TLS: Connection closed, session=<kR4aJaNFqsdChJmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-11 07:03:47 dovecot_login authenticator failed for (cm-84.211.12.159.get.no) [84.211.12.159]:38054: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-11 07:04:02 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:59046: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 11 07:04:31 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<sBiJJaNF1kdChJmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-11 07:06:06 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:55589: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2025-12-11 07:06:28 dovecot_login authenticator failed for ([203.193.147.75]) [203.193.147.75]:57172: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-11 07:06:43 dovecot_login authenticator failed for ([182.95.229.38]) [182.95.229.38]:53922: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-12-11 07:06:58 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:52064: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-11 07:07:23 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:55006: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 07:07:41 host2 pure-ftpd[3139271]: (?@188.26.220.248) [INFO] New connection from 188.26.220.248


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 07:07:43 host2 sshd[3139268]: Invalid user ssvorof@epid.gov.lk from 188.26.220.248 port 50418


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 07:07:48 host2 pure-ftpd[3139271]: (?@188.26.220.248) [WARNING] Authentication failed for user [ssvorof@epid.gov.lk]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-11 07:07:54 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (nomin) [24.61.199.212]:55946: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-11 07:07:55 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:42987: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 11 07:10:03 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<+FJSOaNFDsWLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.74.133.70
country_id: 3374766
description:
2025-12-11 07:10:41 dovecot_plain authenticator failed for (tabodie) [41.74.133.70]:44625: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-11 07:10:42 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (throuses) [68.38.201.238]:37926: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-12-11 07:11:39 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:35630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-11 07:11:53 dovecot_login authenticator failed for (246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:40157: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-11 07:12:51 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:52620: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.64
country_id: 3996063
description:
2025-12-11 07:13:09 dovecot_login authenticator failed for (201.173.97.64-clientes-izzi.mx) [201.173.97.64]:51998: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-11 07:16:47 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (priliatify) [68.83.181.181]:56478: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-12-11 07:17:33 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:40862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-11 07:17:47 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:42072: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-11 07:19:10 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (bioness) [24.91.103.202]:41892: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.33
country_id: 1643084
description:
Dec 11 07:19:21 host2 sshd[3146949]: Disconnected from invalid user spark 103.179.56.33 port 51196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:19:27 host2 sshd[3146991]: Disconnected from invalid user wuhan 63.250.41.173 port 33938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Dec 11 07:20:30 host2 sshd[3147725]: Disconnected from invalid user wuhan 138.124.20.112 port 34026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 11 07:21:23 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS: Connection closed, session=<3ZzaYaNF5h1ChJmA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Dec 11 07:21:30 host2 sshd[3148284]: Disconnected from invalid user wzy 51.222.30.51 port 54436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.152.174.44
country_id: 130758
description:
Dec 11 07:21:53 host2 sshd[3148754]: Disconnected from invalid user wzy 37.152.174.44 port 52146 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.192
country_id: 6252001
description:
Dec 11 07:22:18 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.192, lip=66.85.158.91, TLS, session=<e1MXZaNFGOuTuYTA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.30.51
country_id: 6251999
description:
Dec 11 07:22:37 host2 sshd[3149447]: Disconnected from invalid user server 51.222.30.51 port 53096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:24:29 host2 sshd[3152059]: Disconnected from invalid user ftpuser 63.250.41.173 port 40234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Dec 11 07:23:40 host2 sshd[3150818]: Disconnected from invalid user dima 138.124.20.112 port 56142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.152.174.44
country_id: 130758
description:
Dec 11 07:23:40 host2 sshd[3150841]: Disconnected from invalid user dima 37.152.174.44 port 57706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-11 07:25:26 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (turgatent) [174.169.224.27]:51218: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.33
country_id: 1643084
description:
Dec 11 07:24:33 host2 sshd[3152142]: Disconnected from invalid user 1 103.179.56.33 port 42736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Dec 11 07:24:52 host2 sshd[3152532]: Disconnected from invalid user sara 51.222.30.51 port 55764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Dec 11 07:24:59 host2 sshd[3152690]: Disconnected from invalid user myuser 138.124.20.112 port 48296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.152.174.44
country_id: 130758
description:
Dec 11 07:25:03 host2 sshd[3152860]: Disconnected from invalid user anna 37.152.174.44 port 54748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.33
country_id: 1643084
description:
Dec 11 07:26:08 host2 sshd[3154518]: Disconnected from invalid user ubuntu 103.179.56.33 port 44338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Dec 11 07:26:57 host2 sshd[3155711]: Disconnected from invalid user liuyong 138.124.20.112 port 53004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:27:13 host2 sshd[3156291]: Disconnected from invalid user myuser 63.250.41.173 port 52286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-11 07:27:52 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:39714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:28:19 host2 sshd[3157651]: Received disconnect from 63.250.41.173 port 40380:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-11 07:28:24 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:41150: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 07:29:06 host2 sshd[3158648]: Disconnected from invalid user admin 2.57.121.112 port 20188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:29:58 host2 sshd[3159379]: Disconnected from invalid user sara 63.250.41.173 port 55980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.254.239
country_id: 953987
description:
2025-12-11 07:32:12 dovecot_login authenticator failed for ([102.23.254.239]) [102.23.254.239]:47631: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.21
country_id: 1733045
description:
2025-12-11 07:32:30 dovecot_login authenticator failed for ([49.124.153.21]) [49.124.153.21]:57670: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 11 07:32:40 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.222, lip=66.85.158.92, session=<k6koiqNFPnpBMQHe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.96.223.49
country_id: 2589581
description:
2025-12-11 07:33:28 dovecot_plain authenticator failed for (T8FWR3M6R) [105.96.223.49]:49622: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.96.223.49
country_id: 2589581
description:
2025-12-11 07:33:34 dovecot_login authenticator failed for (T8FWR3M6R) [105.96.223.49]:49622: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Dec 11 07:35:40 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.183, lip=66.85.158.92, TLS, session=<TI3hlKNFru7G6xi3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.41
country_id: 3865483
description:
Dec 11 07:37:01 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.0.249.41, lip=66.85.158.91, TLS, session=<WWOGmKNF1cyzAPkp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-12-11 07:37:12 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:42129: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.69
country_id: 798544
description:
Dec 11 07:37:18 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.228.32.69, lip=66.85.158.91, TLS, session=<R4jGmaNFsN5b5CBF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-12-11 07:37:27 dovecot_login authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:51035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-11 07:36:34 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:55476: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-11 07:38:09 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:56808: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.175
country_id: 3865483
description:
2025-12-11 07:38:27 dovecot_login authenticator failed for (red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:37727: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-11 07:37:39 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:35449: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-11 07:37:48 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:39408: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-11 07:39:07 dovecot_login authenticator failed for ([125.20.183.201]) [27.123.90.94]:45700: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.165
country_id: 6252001
description:
Dec 11 07:41:30 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8q/IqaNFUM2TuYSl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-12-11 07:43:20 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:48490: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-11 07:42:34 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:38377: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-11 07:42:58 dovecot_login authenticator failed for ([113.193.187.154]) [113.193.187.154]:44918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-11 07:43:32 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:60373: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-11 07:45:21 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (cluadous) [71.235.225.181]:46608: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 11 07:49:25 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=<m8YOxqNFprpChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-11 07:49:55 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (tuarbelead) [67.172.54.29]:60316: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-11 07:52:01 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:55797: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-11 07:52:04 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:44960: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-11 07:52:10 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:40282: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.70.118
country_id: 1168579
description:
2025-12-11 07:52:21 dovecot_login authenticator failed for ([115.42.70.118]) [115.42.70.118]:52827: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-12-11 07:51:36 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:52756: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-11 07:51:46 dovecot_login authenticator failed for ([182.79.87.18]) [182.79.87.18]:44756: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-11 07:51:50 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:49127: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-11 07:52:41 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:41594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-11 07:52:53 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:57479: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-11 07:53:50 dovecot_plain authenticator failed for (coble) [64.72.74.162]:55617: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 07:54:08 host2 sshd[3177122]: Disconnected from invalid user user 2.57.121.25 port 5959 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-11 07:56:25 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:60021: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-11 07:56:53 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:39256: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.186
country_id: 2635167
description:
Dec 11 08:00:18 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.186, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AWL+7KNFMNwjy9O6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.150
country_id: 6252001
description:
2025-12-11 08:01:16 dovecot_login authenticator failed for ([70.174.167.150]) [70.174.167.150]:55655: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.186
country_id: 2635167
description:
Dec 11 08:00:41 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.211.186, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<b4Re7qNFKvwjy9O6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 11 08:01:46 host2 sshd[3182512]: Disconnected from invalid user user1 85.206.171.113 port 50842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-11 08:01:50 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:48696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-11 08:02:05 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:48167: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-12-11 08:02:25 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:57985: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-12-11 08:01:40 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:40716: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Dec 11 08:02:47 host2 sshd[3183119]: Disconnected from invalid user robin 94.254.0.234 port 45990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.206.171.113
country_id: 597427
description:
Dec 11 08:02:56 host2 sshd[3183176]: Disconnected from invalid user Azure 85.206.171.113 port 48518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-11 08:02:58 dovecot_plain authenticator failed for (fresm) [23.30.11.253]:43395: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.52
country_id: 6252001
description:
2025-12-11 08:03:08 dovecot_login authenticator failed for ([98.181.46.52]) [98.181.46.52]:51742: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-11 08:04:14 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:45008: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-11 08:04:01 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:38048: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.254.0.234
country_id: 2661886
description:
Dec 11 08:05:02 host2 sshd[3184878]: Disconnected from invalid user ubuntu 94.254.0.234 port 54550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Dec 11 08:05:37 host2 sshd[3185391]: Disconnected from invalid user celery 94.254.0.234 port 38468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 11 08:05:39 host2 sshd[3185416]: Disconnected from invalid user system 85.206.171.113 port 47454 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.186
country_id: 2635167
description:
Dec 11 08:05:47 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.186, lip=66.85.158.92, TLS, session=<lmiVAKRFCPYjy9O6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-11 08:06:53 dovecot_plain authenticator failed for (relferm) [65.20.149.93]:49151: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-11 08:07:04 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:38721: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-11 08:07:31 dovecot_login authenticator failed for ([149.54.15.90]) [149.54.15.90]:46299: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-11 08:08:13 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:45726: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-11 08:08:29 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:61236: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-11 08:07:45 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:39062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2025-12-11 08:08:09 dovecot_login authenticator failed for ([147.235.226.154]) [147.235.226.154]:53344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 08:10:53 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tablowchic) [87.103.126.54]:14267: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-11 08:17:14 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:59380: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-12-11 08:17:18 dovecot_plain authenticator failed for (melmocid) [85.29.149.211]:40222: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-11 08:16:54 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:60924: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.135.196.139
country_id: 1227603
description:
[2025-12-11 08:18:41 +0530] info [cpaneld] 112.135.196.139 - fhbhealt "GET /assets/brand/favicon.ico HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-11 08:21:24 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:51854: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2025-12-11 08:21:41 dovecot_login authenticator failed for ([49.125.201.75]) [49.125.201.75]:34252: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 08:21:51 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (cogra) [51.195.117.220]:34063: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-11 08:21:55 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (amells) [74.218.95.154]:46840: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-11 08:22:08 dovecot_plain authenticator failed for (sublechele) [91.73.195.150]:33702: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.248.172.86
country_id: 2328926
description:
[2025-12-11 08:24:26 +0530] info [webmaild] 23.248.172.86 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-11 08:25:38 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:60786: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-12-11 08:26:00 dovecot_login authenticator failed for (nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:42354: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-12-11 08:26:04 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:33740: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-12-11 08:26:22 dovecot_login authenticator failed for ip-d9bc.d-net.kiev.ua [94.154.217.188]:53320: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-11 08:27:06 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:41900: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-11 08:27:20 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:60058: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-11 08:27:22 dovecot_plain authenticator failed for (campted) [65.20.133.4]:41588: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-11 08:27:27 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (trades) [78.66.119.139]:45178: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.188.87.245
country_id: 1694008
description:
Dec 11 08:28:38 host2 sshd[3204754]: Invalid user ssvorof@epid.gov.lk from 103.188.87.245 port 61949


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.188.87.245
country_id: 1694008
description:
Dec 11 08:28:37 host2 pure-ftpd[3204753]: (?@103.188.87.245) [INFO] New connection from 103.188.87.245


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.188.87.245
country_id: 1694008
description:
Dec 11 08:28:44 host2 pure-ftpd[3204753]: (?@103.188.87.245) [WARNING] Authentication failed for user [ssvorof@epid.gov.lk]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 11 08:27:57 host2 sshd[3204298]: Disconnected from invalid user it 20.185.243.158 port 53542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 08:30:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (seption) [87.103.126.54]:58095: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:30:18 host2 sshd[3206471]: Disconnected from invalid user devops 101.47.162.254 port 58766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 11 08:29:52 host2 sshd[3205943]: Disconnected from invalid user test123 20.185.243.158 port 40172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.84.106
country_id: 1605651
description:
Dec 11 08:30:00 host2 sshd[3206058]: Disconnected from invalid user test123 49.228.84.106 port 50994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-11 08:31:39 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:33514: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 11 08:31:41 host2 sshd[3207664]: Disconnected from invalid user himanshu 20.185.243.158 port 34206 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.188.87.245
country_id: 1694008
description:
Dec 11 08:31:47 host2 dovecot[2672093]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=103.188.87.245, lip=66.85.158.91, TLS handshaking, session=<eoqaXaRFlvtnvFf1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.30
country_id: 1733045
description:
2025-12-11 08:31:27 dovecot_login authenticator failed for ([49.124.151.30]) [49.124.151.30]:48856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-12-11 08:31:35 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:58827: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-11 08:32:42 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:34092: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 11 08:32:55 host2 sshd[3208615]: Disconnected from invalid user gabriel 20.185.243.158 port 60462 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.206.227.180
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 185.206.227.180 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:34:13 host2 sshd[3209566]: Disconnected from invalid user gabriel 101.47.162.254 port 45608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.67.119
country_id: 6252001
description:
Dec 11 08:35:01 host2 sshd[3210087]: Disconnected from invalid user student 172.245.67.119 port 42636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:35:29 host2 sshd[3210575]: Disconnected from invalid user opsadmin 101.47.162.254 port 46760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.67.119
country_id: 6252001
description:
Dec 11 08:36:32 host2 sshd[3211239]: Disconnected from invalid user server 172.245.67.119 port 50980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-11 08:36:20 dovecot_plain authenticator failed for (appacenes) [64.72.74.162]:56764: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.45.177.42
country_id: 3865483
description:
Dec 11 08:36:52 host2 sshd[3211664]: Disconnected from invalid user webuser 181.45.177.42 port 54681 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 11 08:37:07 host2 sshd[3211835]: Disconnected from invalid user webuser 101.36.109.176 port 54600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.36.162
country_id: 1880251
description:
Dec 11 08:38:30 host2 sshd[3212747]: Disconnected from invalid user server 206.189.36.162 port 43632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:37:57 host2 sshd[3212398]: Disconnected from invalid user manoj 101.47.162.254 port 59774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:39:13 host2 sshd[3213157]: Disconnected from invalid user idempiere 101.47.162.254 port 53982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.238
country_id: 2300660
description:
Dec 11 08:39:20 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=41.139.44.238, lip=66.85.158.91, TLS, session=<oFN+d6RFoJ4piyzu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:39:25 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<ZG7qeKRFluADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.154
country_id: 2635167
description:
Dec 11 08:39:35 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.210.154, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<hlOAeaRF68Ijy9Ka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.246.11
country_id: 798544
description:
Dec 11 08:39:37 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=109.125.246.11, lip=66.85.158.91, TLS, session=<bBineKRFvKBtffYL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.154
country_id: 2635167
description:
Dec 11 08:40:24 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.210.154, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<6M5ifKRFsuAjy9Ka>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:40:35 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<MCUSfaRFSMEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:40:55 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<cB1EfqRFKOQDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 11 08:41:03 host2 sshd[3214651]: Disconnected from invalid user pterodactyl 101.36.109.176 port 44700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-11 08:41:50 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:52013: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-11 08:42:04 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:57798: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:42:04 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<VH5bgqRFyu0DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-11 08:42:08 dovecot_login authenticator failed for ([118.39.230.40]) [187.58.66.231]:41265: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-11 08:42:48 dovecot_login authenticator failed for ([49.124.151.82]) [38.148.95.217]:39425: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 08:41:58 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (punalsing) [87.103.126.54]:55405: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:42:52 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Dqk6haRF2J4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:44:01 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<LMdTiaRFnMcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:45:14 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<S964jaRFSLMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-11 08:45:26 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:44696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.188
country_id: 3996063
description:
2025-12-11 08:45:38 dovecot_login authenticator failed for ([177.239.164.188]) [177.239.164.188]:39536: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:45:53 host2 dovecot[2672093]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<mwULkKRFRMUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:46:24 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<X5fckaRFtOgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-11 08:47:37 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:41995: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-11 08:47:50 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:44202: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:47:03 host2 dovecot[2672093]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=</P4ylKRFjMADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:47:17 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<xKADlaRF/OsDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.231.50
country_id: 1269750
description:
2025-12-11 08:47:20 dovecot_login authenticator failed for ([182.95.85.109]) [125.19.231.50]:46938: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.21
country_id: 3996063
description:
2025-12-11 08:47:26 dovecot_login authenticator failed for (187.161.173.21-clientes-izzi.mx) [187.161.173.21]:43071: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.154
country_id: 2635167
description:
Dec 11 08:47:32 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.154, lip=66.85.158.91, TLS, session=<G2HslaRFqu4jy9Ka>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-11 08:47:53 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:53248: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-11 08:48:19 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:58724: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.45.177.42
country_id: 3865483
description:
Dec 11 08:48:19 host2 sshd[3222030]: Disconnected from invalid user server 181.45.177.42 port 65078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:48:27 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<axUtmaRFnukDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 08:50:39 host2 sshd[3224036]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-11 08:50:09 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:48030: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-11 08:50:18 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:42204: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.100
country_id: 6252001
description:
2025-12-11 08:50:37 dovecot_login authenticator failed for ([70.174.168.100]) [70.174.168.100]:35614: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-11 08:50:39 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:49546: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2025-12-11 08:50:55 dovecot_login authenticator failed for ([103.79.237.54]) [103.79.237.54]:56162: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-11 08:51:18 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:42668: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-12-11 08:51:55 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:42972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-11 08:56:07 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:35552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-11 08:56:18 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:44462: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 08:56:39 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (untgeness) [51.195.117.220]:25054: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-11 08:56:57 dovecot_login authenticator failed for ([125.20.231.225]) [128.185.231.6]:38410: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-11 08:57:28 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:44320: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-11 08:58:39 dovecot_plain authenticator failed for (reekness) [154.146.240.123]:38136: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 08:58:52 host2 sshd[3229852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-11 08:59:40 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:39752: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-11 08:59:12 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:55366: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-12-11 08:59:19 +0530] info [cpaneld] 117.103.80.92 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-11 08:59:38 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (unwigast) [98.192.74.183]:33646: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Dec 11 09:01:52 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.61, lip=66.85.158.91, TLS: Connection closed, session=<Yoo1yaRFQBSnXpI9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.100.104
country_id: 798544
description:
Dec 11 09:03:52 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=178.219.100.104, lip=66.85.158.91, TLS, session=<MBpez6RFAMGy22Ro>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.223
country_id: 3865483
description:
Dec 11 09:04:14 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.223, lip=66.85.158.91, TLS, session=<BAl+0KRF56CzAPrf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-12-11 09:05:48 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:35986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-11 09:06:06 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:58774: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.255.103.194
country_id: 1819730
description:
Dec 11 09:07:16 host2 sshd[3236763]: Disconnected from invalid user new 218.255.103.194 port 38528 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.248.9.129
country_id: 3469034
description:
[2025-12-11 09:09:32 +0530] info [cpaneld] 207.248.9.129 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-11 09:09:37 dovecot_plain authenticator failed for (enece) [65.20.143.159]:52743: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.50
country_id: 6252001
description:
2025-12-11 09:09:54 dovecot_login authenticator failed for ([98.181.46.50]) [98.181.46.50]:48229: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-12-11 09:10:21 dovecot_login authenticator failed for ([125.19.171.126]) [152.52.197.174]:56518: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Dec 11 09:12:57 host2 sshd[3241452]: Disconnected from invalid user ts 154.90.59.75 port 45916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-11 09:14:27 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:54660: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-11 09:14:34 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:34770: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-11 09:14:46 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.90.59.75
country_id: 1880251
description:
Dec 11 09:15:02 host2 sshd[3242984]: Disconnected from invalid user wireguard 154.90.59.75 port 48662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.72.17.43
country_id: 2750405
description:
2025-12-11 09:15:38 dovecot_login authenticator failed for ([77.72.17.43]) [77.72.17.43]:51448: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-11 09:15:56 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:36314: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Dec 11 09:16:32 host2 sshd[3244160]: Disconnected from invalid user alex 154.90.59.75 port 43410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-11 09:18:34 dovecot_login authenticator failed for ([149.54.62.26]) [149.54.62.26]:48772: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-11 09:19:04 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:45989: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-12-11 09:19:12 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:59994: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-11 09:19:42 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:60067: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-11 09:20:09 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:49608: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.47
country_id: 1733045
description:
2025-12-11 09:20:32 dovecot_login authenticator failed for ([49.124.149.47]) [49.124.149.47]:50706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-11 09:21:04 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:45360: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-11 09:21:20 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:63631: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.165.154.155
country_id: 1643084
description:
2025-12-11 09:21:27 dovecot_plain authenticator failed for ([89.116.164.85]) [125.165.154.155]:12288: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.190.52.108
country_id: 298795
description:
2025-12-11 09:21:42 dovecot_plain authenticator failed for ([89.116.164.85]) [78.190.52.108]:61110: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-11 09:21:43 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (gridae) [73.161.96.107]:57378: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.77.76.134
country_id: 1269750
description:
2025-12-11 09:21:57 dovecot_plain authenticator failed for ([89.116.164.85]) [182.77.76.134]:3146: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.178
country_id: 130758
description:
Dec 11 09:23:37 host2 sshd[3249051]: Disconnected from invalid user testuser 109.122.251.178 port 39676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.178
country_id: 130758
description:
Dec 11 09:24:45 host2 sshd[3249809]: Disconnected from invalid user rf 109.122.251.178 port 39776 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.122.251.178
country_id: 130758
description:
Dec 11 09:25:17 host2 sshd[3250319]: Disconnected from invalid user mami 109.122.251.178 port 39824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.217
country_id: 1819730
description:
Dec 11 09:26:33 host2 sshd[3251410]: Disconnected from invalid user ubuntu 152.32.135.217 port 60210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.135.217
country_id: 1819730
description:
Dec 11 09:27:49 host2 sshd[3252574]: Disconnected from invalid user TEST 152.32.135.217 port 52038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.217
country_id: 1819730
description:
Dec 11 09:27:10 host2 sshd[3252066]: Disconnected from invalid user zain 152.32.135.217 port 41956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-11 09:28:03 dovecot_plain authenticator failed for (undick) [91.73.195.150]:40945: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 11 09:28:28 host2 sshd[3253016]: Disconnected from invalid user consultor 103.179.56.78 port 57442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 11 09:28:34 host2 sshd[3253090]: Disconnected from invalid user kt 124.18.141.70 port 34266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:28:47 host2 sshd[3253181]: Disconnected from invalid user yzx 186.103.169.12 port 58172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-11 09:27:58 dovecot_plain authenticator failed for (trazzary) [41.248.243.181]:57120: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Dec 11 09:29:43 host2 sshd[3253785]: Disconnected from invalid user samp 118.193.61.63 port 58538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 11 09:29:18 host2 sshd[3253536]: Disconnected from invalid user rf 103.179.56.78 port 37298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 11 09:30:11 host2 sshd[3254254]: Disconnected from invalid user TEST 103.179.56.78 port 53988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Dec 11 09:30:22 host2 sshd[3254386]: Disconnected from invalid user es 118.193.61.63 port 16136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-11 09:30:01 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (wavicliker) [73.145.107.251]:46066: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Dec 11 09:31:05 host2 sshd[3254801]: Disconnected from invalid user demo 118.193.61.63 port 28742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.63
country_id: 1861060
description:
Dec 11 09:31:54 host2 sshd[3255329]: Disconnected from invalid user deploy 118.193.61.63 port 41350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 11 09:32:06 host2 sshd[3255485]: Disconnected from invalid user lisa 124.18.141.70 port 52254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.230
country_id: 1819730
description:
Dec 11 09:32:16 host2 sshd[3255556]: Disconnected from invalid user server 103.243.26.230 port 45508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 11 09:33:22 host2 sshd[3256147]: Disconnected from invalid user frappe 124.18.141.70 port 35714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.230
country_id: 1819730
description:
Dec 11 09:33:33 host2 sshd[3256248]: Disconnected from invalid user lisa 103.243.26.230 port 44818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:33:14 host2 sshd[3256062]: Disconnected from invalid user pz 186.103.169.12 port 39908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-11 09:34:29 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:41666: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:34:44 host2 sshd[3256919]: Disconnected from invalid user ricardo 186.103.169.12 port 60176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 11 09:36:17 host2 sshd[3258350]: Disconnected from invalid user erpnext 124.18.141.70 port 50920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-11 09:36:22 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (overiers) [71.235.225.181]:48846: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-11 09:36:28 dovecot_plain authenticator failed for (pativers) [102.53.15.18]:45571: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:36:14 host2 sshd[3258299]: Disconnected from invalid user lisa 186.103.169.12 port 39872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:37:52 host2 sshd[3259440]: Disconnected from invalid user frappe 186.103.169.12 port 55776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-11 09:38:49 dovecot_plain authenticator failed for (ephosts) [80.227.147.94]:53972: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-11 09:39:32 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:54887: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-11 09:39:31 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:34154: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-11 09:39:19 dovecot_login authenticator failed for (187-50-226-182.customer.tdatabrasil.net.br) [187.50.226.182]:54149: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.156
country_id: 6252001
description:
2025-12-11 09:39:21 dovecot_login authenticator failed for ([98.185.120.156]) [98.185.120.156]:43455: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.200
country_id: 3469034
description:
Dec 11 09:40:15 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=138.255.206.200, lip=66.85.158.91, TLS, session=<+YxgUaVFfNWK/87I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-11 09:40:22 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:37712: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.114
country_id: 3469034
description:
Dec 11 09:40:40 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts>, method=PLAIN, rip=190.89.137.114, lip=66.85.158.91, TLS, session=<IDenUqVFLMu+WYly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-11 09:40:48 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:57497: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-11 09:42:18 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (unaggic) [68.82.141.145]:44018: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:42:27 host2 sshd[3262775]: Disconnected from invalid user homeassistant 138.68.150.253 port 33304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Dec 11 09:44:22 host2 sshd[3264241]: Disconnected from invalid user user14 27.50.25.190 port 37402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:44:36 host2 sshd[3264471]: Disconnected from invalid user amalia 138.68.150.253 port 42334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-11 09:45:17 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:51770: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.50.25.190
country_id: 1643084
description:
Dec 11 09:46:15 host2 sshd[3266903]: Disconnected from invalid user www-data 27.50.25.190 port 58594 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-11 09:46:25 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:35832: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:46:40 host2 sshd[3267401]: Disconnected from invalid user consultor 138.68.150.253 port 38410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-11 09:46:11 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:57378: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:47:45 host2 sshd[3268768]: Disconnected from invalid user hydra 138.68.150.253 port 33166 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:47:15 host2 sshd[3268278]: Received disconnect from 138.68.150.253 port 37006:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Dec 11 09:48:14 host2 sshd[3269169]: Disconnected from invalid user deployer 27.50.25.190 port 41498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:48:16 host2 sshd[3269188]: Disconnected from invalid user www-data 138.68.150.253 port 34654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Dec 11 09:49:33 host2 sshd[3270046]: Disconnected from invalid user hydra 27.50.25.190 port 40980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
country_id: 2802361
description:
2025-12-11 09:51:11 dovecot_plain authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be (reprel) [81.243.106.218]:49496: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:52:14 host2 sshd[3272599]: Disconnected from invalid user dev 190.0.63.226 port 37042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 09:53:19 host2 sshd[3273296]: Disconnected from invalid user admin 2.57.121.112 port 30544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:53:31 host2 sshd[3273398]: Disconnected from invalid user shubham 190.0.63.226 port 34544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:52:53 host2 sshd[3273041]: Disconnected from invalid user vpn 190.0.63.226 port 49912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:54:11 host2 sshd[3274132]: Disconnected from invalid user isaac 190.0.63.226 port 47418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-11 09:55:23 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:60094: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:55:27 host2 sshd[3275156]: Disconnected from invalid user cma 190.0.63.226 port 44924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-11 09:55:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50771: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-11 09:56:43 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (rinitelly) [217.215.74.195]:57929: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-11 09:58:51 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:42534: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-11 09:59:27 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:46898: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.48
country_id: 2464461
description:
2025-12-11 10:03:52 dovecot_login authenticator failed for ([102.110.11.48]) [102.110.11.48]:1811: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-11 10:03:59 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:49302: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-11 10:04:14 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:44495: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.205.166
country_id: 953987
description:
2025-12-11 10:04:14 dovecot_login authenticator failed for ([197.90.205.166]) [197.90.205.166]:46061: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.120
country_id: 3996063
description:
2025-12-11 10:05:14 dovecot_login authenticator failed for (201.173.216.120-clientes-izzi.mx) [201.173.216.120]:47097: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.70
country_id: 1733045
description:
2025-12-11 10:05:38 dovecot_login authenticator failed for ([49.124.151.70]) [49.124.151.70]:57690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-11 10:07:54 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (diaticam) [67.173.58.47]:46138: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 10:08:29 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (rhyped) [51.195.117.220]:24638: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2025-12-11 10:10:04 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:59500: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-11 10:10:18 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:47808: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-11 10:10:31 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:36886: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-11 10:09:52 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:56535: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Dec 11 10:10:57 host2 sshd[3288990]: Disconnected from invalid user slurm 196.196.253.20 port 39958 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.198.253
country_id: 1210997
description:
Dec 11 10:11:13 host2 sshd[3289217]: Disconnected from invalid user root2 103.86.198.253 port 57224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-11 10:12:26 dovecot_plain authenticator failed for (pusly) [65.20.149.93]:50704: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 11 10:16:20 host2 dovecot[3293386]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 112.135.221.7
country_id: 1227603
description:
[2025-12-11 10:16:29 +0530] info [cpaneld] 112.135.221.7 NEW fhbhealt:DFXIiO8iJcxbd5tX address=112.135.221.7,app=cpaneld,creator=fhbhealt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.135.221.7
country_id: 1227603
description:
[2025-12-11 10:16:44 +0530] info [cpaneld] 112.135.221.7 - fhbhealt "GET /cpsess0568280221/frontend/jupiter/resource_usage/resource_usage.live.pl HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.231
country_id: 1880251
description:
Dec 11 10:16:59 host2 sshd[3294171]: Disconnected from invalid user postgres 45.78.230.231 port 49818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-11 10:20:12 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:55074: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-11 10:23:14 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:43690: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-11 10:23:29 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:34731: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-11 10:23:35 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:41299: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-11 10:23:46 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:38587: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.231
country_id: 1880251
description:
Dec 11 10:23:48 host2 sshd[3299508]: Disconnected from invalid user luz 45.78.230.231 port 35234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-11 10:24:12 dovecot_plain authenticator failed for (noxaters) [96.85.104.2]:58948: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.231
country_id: 1880251
description:
Dec 11 10:27:19 host2 sshd[3301866]: Disconnected from invalid user ubuntu 45.78.230.231 port 57804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 10:27:01 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (kantrapy) [51.195.117.220]:43461: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-11 10:28:14 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:48994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.231
country_id: 1880251
description:
Dec 11 10:28:28 host2 sshd[3302453]: Disconnected from invalid user ftpuser 45.78.230.231 port 53880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-11 10:27:55 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:54742: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-11 10:29:17 dovecot_login authenticator failed for (static.92.254.104.190.cps.com.ar) [190.104.254.91]:41273: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-11 10:29:22 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (aniter) [73.195.211.98]:59486: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-11 10:29:25 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:55674: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-11 10:29:26 dovecot_plain authenticator failed for (danizedrid) [64.72.74.162]:38058: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-11 10:29:38 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (theclicase) [98.227.25.115]:33468: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-12-11 10:29:39 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:57331: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 10:32:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (hemon) [87.103.126.54]:17973: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-11 10:34:50 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:33183: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-11 10:33:59 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:63295: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-11 10:34:24 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:43480: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 10:34:38 host2 sshd[3306322]: Disconnected from invalid user user 2.57.121.25 port 24670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-11 10:35:05 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:61217: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-11 10:37:50 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (wherreas) [2.135.31.74]:39349: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.3
country_id: 6252001
description:
Dec 11 10:37:39 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.3, lip=66.85.158.92, TLS: Connection closed, session=<57W+H6ZFWOnLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-12-11 10:41:11 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:50638: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-11 10:41:26 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43657: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.45
country_id: 1269750
description:
Dec 11 10:43:18 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=103.18.166.45, lip=66.85.158.91, TLS, session=<MmHFMqZFYrRnEqYt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.190
country_id: 3175395
description:
Dec 11 10:43:35 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.63.132.190, lip=66.85.158.91, TLS, session=<t0v5M6ZFE5e5P4S+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 10:44:45 host2 sshd[3316157]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-11 10:44:28 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:35872: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-11 10:44:42 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:45136: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 10:48:06 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (dentenan) [51.195.117.220]:58412: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-11 10:48:35 dovecot_plain authenticator failed for (unden) [109.226.14.93]:34399: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.72
country_id: 3996063
description:
2025-12-11 10:48:39 dovecot_login authenticator failed for ([177.236.144.72]) [177.236.144.72]:52760: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-11 10:49:02 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:36218: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 10:52:59 host2 sshd[3323369]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-11 10:53:22 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:45920: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-11 10:53:51 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:58791: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-11 10:53:50 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:60017: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 10:54:10 dovecot_login authenticator failed for vps-f9a28e39.vps.ovh.net [51.195.117.220]:20167: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-11 10:55:06 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:47957: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.186
country_id: 1733045
description:
2025-12-11 10:55:23 dovecot_login authenticator failed for ([49.124.159.186]) [49.124.159.186]:33812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2025-12-11 10:56:46 +0530] info [cpaneld] 54.37.131.169 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.90
country_id: 3175395
description:
Dec 11 10:59:10 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.15.170.90, lip=66.85.158.91, TLS, session=<3uVsa6ZFJaq5D6pa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.70.70
country_id: 3996063
description:
Dec 11 10:59:27 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=201.168.70.70, lip=66.85.158.91, TLS, session=<JXu6bKZFTKzJqEZG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-11 10:59:30 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:40857: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-11 10:59:42 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:54270: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2025-12-11 11:00:11 dovecot_login authenticator failed for ([202.22.204.23]) [202.22.204.23]:44326: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.37
country_id: 1733045
description:
2025-12-11 11:01:10 dovecot_login authenticator failed for ([49.124.146.37]) [49.124.146.37]:50016: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 11:02:40 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (brotord) [51.195.117.220]:23946: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.135.182.112
country_id: 1227603
description:
[2025-12-11 11:04:46 +0530] info [cpaneld] 112.135.182.112 - fhbhealt "GET /cpsess1318739637/frontend/jupiter/index.html?=undefined&login=1&post_login=81245659505391 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [112.135.221.7] != Current IP Address [112.135.182.112]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 11:08:33 host2 sshd[3335070]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-11 11:09:36 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:48328: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-11 11:10:23 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:36626: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 11:11:27 host2 sshd[3336848]: Disconnected from invalid user admin 2.57.121.112 port 50279 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-11 11:13:43 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:43401: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.228
country_id: 6252001
description:
Dec 11 11:16:08 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.228, lip=66.85.158.91, TLS, session=<T71iqaZF0vrN0h/k>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-12-11 11:18:35 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:60386: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-11 11:18:36 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:51778: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-11 11:19:37 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:48342: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-11 11:19:48 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:46318: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-11 11:18:55 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:35100: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-11 11:18:55 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:57061: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.171
country_id: 1733045
description:
2025-12-11 11:24:17 dovecot_login authenticator failed for ([49.124.154.171]) [49.124.154.171]:55308: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-11 11:24:43 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:55084: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 11:25:34 host2 sshd[3346865]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-11 11:25:06 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:64325: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-11 11:25:28 dovecot_login authenticator failed for ([27.123.102.122]) [27.123.102.122]:56426: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 11:26:46 host2 sshd[3347501]: Disconnected from invalid user admin 2.57.121.112 port 25209 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-12-11 11:27:48 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:60726: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-11 11:27:30 dovecot_login authenticator failed for ([80.88.102.128]) [80.88.102.128]:53448: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-11 11:27:54 dovecot_plain authenticator failed for (tagreed) [65.20.148.194]:45521: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 11:32:55 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (scatigion) [87.103.126.54]:17341: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-11 11:34:41 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:45010: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-11 11:35:17 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:53152: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-11 11:35:27 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (nestraunce) [96.230.65.90]:57086: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-11 11:35:12 dovecot_plain authenticator failed for (habled) [149.62.239.4]:57314: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.20.11
country_id: 6252001
description:
Dec 11 11:36:30 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.172.20.11, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Uoot8qZFstanrBQL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-11 11:38:07 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:57456: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.60
country_id: 6252001
description:
2025-12-11 11:38:25 dovecot_login authenticator failed for ([98.185.120.60]) [98.185.120.60]:43050: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-11 11:42:48 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (hoding) [73.13.220.220]:35992: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-11 11:43:15 dovecot_login authenticator failed for ([182.95.20.31]) [182.95.228.22]:51422: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-11 11:43:32 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:49356: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-11 11:43:00 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:42594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-11 11:43:13 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:50532: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-11 11:44:17 dovecot_login authenticator failed for c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:37243: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-11 11:44:29 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:47387: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-12-11 11:45:26 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:42826: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-11 11:45:33 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (cotess) [68.60.77.128]:54558: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-11 11:45:48 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:53397: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-11 11:49:43 dovecot_login authenticator failed for ([135.13.8.246]) [74.224.215.23]:10180: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-11 11:49:09 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:44567: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-11 11:49:41 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:56878: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-11 11:50:13 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:44485: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-11 11:50:16 dovecot_plain authenticator failed for (adjuddlia) [92.62.243.174]:40881: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-11 11:50:21 dovecot_plain authenticator failed for (pilented) [102.53.15.180]:42830: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 11:54:04 host2 sshd[3365861]: Disconnected from invalid user user 2.57.121.25 port 40921 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-12-11 11:59:16 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:48434: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-11 11:59:34 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:54075: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.146.143
country_id: 690791
description:
Dec 11 12:02:33 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.221.146.143, lip=66.85.158.91, TLS, session=<tp1bTqdF3akl3ZKP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.78.150
country_id: 1861060
description:
2025-12-11 12:03:27 dovecot_login authenticator failed for 133.232.78.150.static.zoot.jp ([125.19.174.244]) [133.232.78.150]:33206: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.225
country_id: 1269750
description:
Dec 11 12:03:41 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.59.134.225, lip=66.85.158.91, TLS, session=<Pd9UUqdFUYJnO4bh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.16
country_id: 732800
description:
Dec 11 12:03:40 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.255.215.16, lip=66.85.158.91, TLS, session=<dTBhUqdF9Ym5/9cQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.124
country_id: 732800
description:
Dec 11 12:02:51 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=185.255.215.124, lip=66.85.158.91, TLS, session=<duFyT6dF16S5/9d8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-11 12:02:54 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:41670: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.153
country_id: 6252001
description:
2025-12-11 12:03:21 dovecot_login authenticator failed for ([70.174.167.153]) [70.174.167.153]:34086: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.57
country_id: 953987
description:
Dec 11 12:04:03 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=102.64.43.57, lip=66.85.158.91, TLS, session=<k3WMU6dFdKlmQCs5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.182.148.54
country_id: 3658394
description:
Dec 11 12:04:12 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=201.182.148.54, lip=66.85.158.91, TLS, session=<Pwk2VKdFxZzJtpQ2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.162.20.240
country_id: 3865483
description:
Dec 11 12:04:15 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=45.162.20.240, lip=66.85.158.91, TLS, session=<x1ZLVKdFwpktohTw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.14
country_id: 953987
description:
Dec 11 12:03:53 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.59.14, lip=66.85.158.91, TLS, session=<NC/iUqdFd+xmgTsO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.215
country_id: 3865483
description:
Dec 11 12:03:53 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=190.181.101.215, lip=66.85.158.91, TLS, session=<+dzuUqdFp8G+tWXX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.62
country_id: 798544
description:
Dec 11 12:03:58 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=128.127.94.62, lip=66.85.158.91, TLS, session=<cfJvU6dF+cKAf14+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 11 12:06:52 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LpvNXqdF1NhChJl9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:07:41 host2 sshd[3376869]: Disconnected from invalid user kian 154.91.90.27 port 34936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-11 12:07:47 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:37632: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-11 12:07:57 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:54553: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.23
country_id: 1733045
description:
2025-12-11 12:08:13 dovecot_login authenticator failed for ([49.124.151.23]) [49.124.151.23]:46874: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-11 12:08:24 dovecot_login authenticator failed for (cm-84.215.110.96.get.no) [84.215.110.96]:54517: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:08:27 host2 sshd[3377290]: Disconnected from invalid user alexis 154.91.90.27 port 58460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2025-12-11 12:08:54 dovecot_login authenticator failed for dsl-212-135-208-13.dsl.easynet.co.uk [212.135.208.13]:43863: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-12-11 12:09:10 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:42920: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:09:09 host2 sshd[3377722]: Disconnected from invalid user ubuntu 154.91.90.27 port 54884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:10:35 host2 sshd[3378801]: Disconnected from invalid user issabel 154.91.90.27 port 41188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:11:58 host2 sshd[3379653]: Disconnected from invalid user vpnuser 154.91.90.27 port 58004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 11 12:18:13 host2 sshd[3385069]: Disconnected from invalid user brandon 150.5.169.176 port 59054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 11 12:23:01 host2 sshd[3389234]: Disconnected from invalid user eva 150.5.169.176 port 48708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.2.118.205
country_id: 3865483
description:
2025-12-11 12:23:05 dovecot_plain authenticator failed for ([89.116.164.85]) [190.2.118.205]:53582: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.66.142.244
country_id: 1694008
description:
2025-12-11 12:22:41 dovecot_plain authenticator failed for ([89.116.164.85]) [103.66.142.244]:39992: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.164.152.143
country_id: 6252001
description:
2025-12-11 12:22:53 dovecot_plain authenticator failed for 47-164-152-143.bng03.brpt.ct.frontiernet.net ([89.116.164.85]) [47.164.152.143]:36802: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-11 12:23:47 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:48858: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-12-11 12:24:08 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:43930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-11 12:25:33 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:50433: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.14
country_id: 1733045
description:
2025-12-11 12:25:44 dovecot_login authenticator failed for ([49.124.153.14]) [49.124.153.14]:60632: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-11 12:25:56 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:39657: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-12-11 12:26:06 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:56926: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-11 12:26:11 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:33342: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-11 12:26:20 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:58230: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 12:26:45 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (flaterious) [87.103.126.54]:63884: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-11 12:26:50 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:33902: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-11 12:27:09 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:56079: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-11 12:27:52 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:60096: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Dec 11 12:28:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, session=<6GoOrKdFLtTCpGsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-11 12:27:39 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:42198: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 12:27:46 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (isemilie) [87.103.126.54]:30588: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 11 12:28:58 host2 sshd[3394512]: Disconnected from invalid user samba 150.5.169.176 port 57884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 12:30:25 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (meter) [87.103.126.54]:13665: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2025-12-11 12:31:15 dovecot_plain authenticator failed for (comialy) [46.35.178.104]:58290: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-11 12:32:20 dovecot_login authenticator failed for (broadband.actcorp.in) [49.204.232.244]:48034: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-11 12:32:30 dovecot_plain authenticator failed for (culituade) [154.144.243.93]:52858: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-11 12:32:32 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:49338: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-11 12:32:12 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:38720: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-11 12:32:42 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:56418: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.96
country_id: 3865483
description:
Dec 11 12:33:34 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.250.96, lip=66.85.158.91, TLS, session=<PjwKvadF0tOzAPpg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.154
country_id: 953987
description:
Dec 11 12:33:59 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=102.129.62.154, lip=66.85.158.91, TLS, session=<MiGEvqdFabdmgT6a>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-11 12:34:18 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:54781: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.60
country_id: 1733045
description:
2025-12-11 12:34:35 dovecot_login authenticator failed for ([49.124.151.60]) [49.124.151.60]:49346: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-11 12:37:01 dovecot_plain authenticator failed for (tupectid) [64.72.74.162]:35043: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-11 12:38:25 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:40012: 535 Incorrect authentication data (set_id=contact)


