# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.124.35.65
country_id: 3469034
description:
2025-12-13 10:16:00 dovecot_plain authenticator failed for ([31.57.166.48]) [177.124.35.65]:34161: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 10:16:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<fVlqD85FPsNo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 10:16:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Dj06Ec5FbuXCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.23.92.193
country_id: 6252001
description:
2025-12-13 10:16:12 dovecot_plain authenticator failed for 165-23-92-193-dynamic.midco.net ([31.57.166.48]) [165.23.92.193]:34576: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.139.41.107
country_id: 3865483
description:
2025-12-13 10:16:25 dovecot_plain authenticator failed for host107.190-139-41.telecom.net.ar ([31.57.166.48]) [190.139.41.107]:16937: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-13 10:17:29 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:55812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-12-13 10:17:30 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:59233: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-13 10:17:42 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:57310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-13 10:17:18 dovecot_login authenticator failed for (189.219.138.45-clientes-izzi.mx) [189.219.138.45]:42366: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 10:18:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<uP4sFs5FBNoI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.97
country_id: 6252001
description:
2025-12-13 10:18:54 dovecot_login authenticator failed for ([70.174.168.97]) [70.174.168.97]:33949: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-13 10:19:13 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:46422: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 10:20:06 host2 sshd[1410057]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 63992


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-13 10:20:05 dovecot_plain authenticator failed for (chous) [38.248.111.238]:48824: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 10:21:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<iFQlIc5FAqgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-13 10:22:38 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:39457: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-13 10:22:47 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:41500: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-13 10:22:52 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (pedle) [2.135.31.74]:39795: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-13 10:23:31 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:53950: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-13 10:23:57 dovecot_login authenticator failed for ([182.95.181.22]) [182.95.181.22]:46176: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-13 10:24:19 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:47492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-13 10:24:40 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:47196: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.79.208
country_id: 2661886
description:
2025-12-13 10:24:59 dovecot_plain authenticator failed for c-83-226-79-208.bbcust.telenor.se ([31.57.166.48]) [83.226.79.208]:57520: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 10:25:27 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (depigy) [196.47.172.253]:56579: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.198.13.144
country_id: 3865483
description:
2025-12-13 10:25:26 dovecot_plain authenticator failed for ([31.57.166.48]) [192.198.13.144]:57871: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.66.226.23
country_id: 2635167
description:
2025-12-13 10:25:12 dovecot_plain authenticator failed for ([31.57.166.48]) [84.66.226.23]:55990: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-13 10:25:24 dovecot_plain authenticator failed for (unmenderd) [5.31.15.108]:33376: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 10:26:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<zvhsMs5FXJlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 10:26:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<g+QVNc5FeLNm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.174.162.68
country_id: 3469034
description:
Dec 13 10:28:05 host2 sshd[1414848]: Disconnected from invalid user joe 45.174.162.68 port 58122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 10:27:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<sutENs5FKoaB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec 13 10:27:56 host2 sshd[1414703]: Disconnected from invalid user cad 124.155.125.131 port 60258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:28:29 host2 sshd[1415137]: Disconnected from invalid user ansible 37.32.13.93 port 40476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 10:28:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<K567O85F2L8+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:29:04 host2 sshd[1415781]: Disconnected from invalid user nvr 194.74.196.10 port 48166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 10:29:34 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:60948: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-13 10:29:46 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:39517: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:29:51 host2 sshd[1416182]: Disconnected from invalid user hqadmin 37.32.13.93 port 59780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:29:13 host2 sshd[1415886]: Disconnected from invalid user ubuntu 154.92.109.196 port 24836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:29:25 host2 sshd[1416011]: Disconnected from invalid user ubuntu 107.174.41.51 port 53398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 10:29:32 host2 sshd[1416056]: Disconnected from invalid user  62.60.131.157 port 49220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:30:29 host2 sshd[1416840]: Disconnected from invalid user nvr 68.183.144.238 port 59588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:30:14 host2 sshd[1416667]: Disconnected from invalid user deployer 194.74.196.10 port 56818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:31:55 host2 sshd[1417542]: Disconnected from invalid user sgp 154.92.109.196 port 41732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:31:10 host2 sshd[1417128]: Disconnected from invalid user panel 37.32.13.93 port 55260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 10:31:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<D1N5RM5FMuTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:31:18 host2 sshd[1417232]: Disconnected from invalid user ubuntu 154.92.109.196 port 53773 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 13 10:32:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<t+/CR85FVKlog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-13 10:32:32 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:16908: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:32:35 host2 sshd[1417942]: Disconnected from invalid user proxyuser 37.32.13.93 port 57832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:32:38 host2 sshd[1417886]: Disconnected from invalid user docker 154.222.24.142 port 33626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 13 10:32:43 host2 sshd[1418012]: Disconnected from invalid user appadmin 202.4.106.201 port 33556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-12-13 10:32:53 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:51854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:32:56 host2 sshd[1418111]: Disconnected from invalid user nick 194.74.196.10 port 53548 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 13 10:33:26 host2 sshd[1418405]: Disconnected from invalid user docker 202.4.106.201 port 45950 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:33:26 host2 sshd[1418415]: Received disconnect from 194.74.196.10 port 50930:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:33:59 host2 sshd[1418795]: Disconnected from invalid user temp 68.183.144.238 port 46846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 10:33:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<qXQyS85FItdntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 13 10:33:22 host2 sshd[1418387]: Disconnected from invalid user ubuntu 213.6.203.226 port 46172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 13 10:35:03 host2 sshd[1419392]: Disconnected from invalid user admins 213.6.203.226 port 40992 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-13 10:34:09 dovecot_login authenticator failed for ([182.95.20.28]) [182.95.228.10]:39530: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:34:50 host2 sshd[1419242]: Disconnected from invalid user alice 141.227.137.228 port 51092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2025-12-13 10:34:55 dovecot_login authenticator failed for ([122.186.230.25]) [125.19.161.150]:37822: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:35:31 host2 sshd[1419810]: Disconnected from invalid user user123 107.174.41.51 port 53576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 10:35:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Cvw1VM5FfsGH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:36:21 host2 sshd[1420201]: Disconnected from invalid user max 154.222.24.142 port 60972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.145
country_id: 3865483
description:
Dec 13 10:36:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.249.145, lip=66.85.158.91, TLS, session=<l5ioVc5FE6GzAPmR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:36:41 host2 sshd[1420367]: Disconnected from invalid user docker 107.174.41.51 port 53676 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.136
country_id: 3469034
description:
Dec 13 10:36:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=187.120.72.136, lip=66.85.158.91, TLS, session=<fcryVs5F25G7eEiI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:36:50 host2 sshd[1420449]: Disconnected from invalid user vinay 68.183.144.238 port 55970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:36:06 host2 sshd[1420102]: Disconnected from invalid user appadmin 107.174.41.51 port 53624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:36:29 host2 sshd[1420290]: Disconnected from invalid user user123 141.227.137.228 port 49984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 13 10:36:57 host2 sshd[1420480]: Disconnected from invalid user ubuntu 110.164.228.242 port 55996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:36:12 host2 sshd[1420122]: Disconnected from invalid user issabel 103.186.1.120 port 38816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 10:37:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<YVaiWc5FdIrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 10:37:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<NH33Ws5FALIImxNM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:37:35 host2 sshd[1420956]: Disconnected from invalid user arthur 154.222.24.142 port 57144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:37:59 host2 sshd[1421181]: Disconnected from invalid user mpi 141.227.137.228 port 59918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 13 10:38:11 host2 sshd[1421307]: Disconnected from invalid user max 110.164.228.242 port 33164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 10:38:30 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:50688: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:38:47 host2 sshd[1421682]: Disconnected from invalid user issabel 154.222.24.142 port 54016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 10:38:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<C+KSX85FZKel6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-13 10:38:08 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:38432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:39:20 host2 sshd[1422197]: Disconnected from invalid user admin 103.186.1.120 port 47884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 10:40:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<o/70Y85FNJe8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:40:59 host2 sshd[1423250]: Disconnected from invalid user administrator 154.222.24.142 port 45100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-13 10:40:31 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (nestive) [68.52.119.193]:35306: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:40:48 host2 sshd[1423151]: Disconnected from invalid user ftptest 103.186.1.120 port 42474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:40:57 host2 sshd[1423227]: Disconnected from invalid user vinay 151.46.198.234 port 39247 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:41:38 host2 sshd[1423630]: Disconnected from invalid user john 151.46.198.234 port 39810 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.166.86.83
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 174.166.86.83 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.73.94.253
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.73.94.253 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.154.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.2.154.34 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 10:42:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<S2CNbc5FxKYvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:42:20 host2 sshd[1424029]: Disconnected from invalid user deployer 151.46.198.234 port 39871 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.208.124.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.208.124.100 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.20.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.147.20.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 10:42:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ncUgbc5FFumKxX03>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.205.34.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.205.34.6 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.86.99.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.86.99.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.232.204.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.232.204.210 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.24.108
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.193.24.108 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.166.222.109
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.166.222.109 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.238.16.128
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.238.16.128 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.99.225.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.99.225.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.186.77.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.186.77.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.130.66.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.130.66.217 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-13 10:43:51 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:57431: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-13 10:43:10 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:49452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2025-12-13 10:43:21 dovecot_login authenticator failed for ([107.85.14.208]) [107.85.14.208]:43676: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-13 10:43:33 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:44386: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-13 10:45:00 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:39807: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 10:44:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lV2Bdc5FTovO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:44:58 host2 sshd[1426230]: Disconnected from invalid user guest 151.46.198.234 port 39220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-13 10:44:58 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:40661: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 10:45:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<uHaReM5FNJ5AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-12-13 10:45:22 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:56088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-13 10:45:40 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:45610: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-13 10:46:50 dovecot_plain authenticator failed for (nintledive) [65.20.164.137]:54013: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-13 10:47:09 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (aking) [73.27.33.174]:56082: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.236
country_id: 6252001
description:
Dec 13 10:47:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</VVefc5F7MvG6xjs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 10:47:12 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (subleting) [98.227.25.115]:44236: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.35
country_id: 1733045
description:
2025-12-13 10:49:16 dovecot_login authenticator failed for ([49.124.151.35]) [49.124.151.35]:39630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 10:49:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<w+Mzhc5FQp8IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-13 10:49:43 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:57839: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 10:50:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<onibh85FKOA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-12-13 10:50:09 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:51173: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-13 10:51:21 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:41390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 10:51:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<2TQmjc5F9oHAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 10:51:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<aEHsjc5FxIyG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 10:54:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<B9D2ls5FXr+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 10:55:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<vtb5ms5F6IyWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.151.7.93
country_id: 6252001
description:
2025-12-13 10:55:50 dovecot_plain authenticator failed for ([31.57.166.48]) [35.151.7.93]:31610: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-13 10:56:01 dovecot_plain authenticator failed for (porapers) [5.11.143.72]:46522: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.12.40.68
country_id: 3865483
description:
2025-12-13 10:56:05 dovecot_plain authenticator failed for ([31.57.166.48]) [198.12.40.68]:49238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.114.233.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 69.114.233.176 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.154.51.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.154.51.18 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.90.168.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.90.168.4 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 10:56:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<3PIOoM5F3J5100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.163.12.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.163.12.68 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.60.66.14
country_id: 3895114
description:
2025-12-13 10:56:19 dovecot_plain authenticator failed for ([31.57.166.48]) [179.60.66.14]:56290: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.119.109.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.119.109.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.32.130.42
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.32.130.42 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.205.150.113
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.205.150.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.12.40.68
country_id: 3865483
description:
2025-12-13 10:56:12 dovecot_login authenticator failed for ([31.57.166.48]) [198.12.40.68]:49238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 10:57:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<+zrQos5FZUBetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 10:58:52 host2 sshd[1433994]: Disconnected from invalid user es 41.57.65.25 port 59376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.162
country_id: 3658394
description:
2025-12-13 10:58:59 dovecot_plain authenticator failed for ([31.57.166.48]) [181.199.46.162]:54083: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-13 11:00:02 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:58452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-13 11:00:01 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (spismatii) [73.161.96.107]:46828: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 10:59:10 host2 sshd[1434147]: Disconnected from invalid user umar 102.211.234.150 port 59206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.158.35
country_id: 1733045
description:
2025-12-13 10:59:14 dovecot_plain authenticator failed for ([31.57.166.48]) [161.142.158.35]:5029: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.23.228
country_id: 1282988
description:
2025-12-13 10:59:32 dovecot_plain authenticator failed for ([31.57.166.48]) [103.148.23.228]:12927: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:00:11 host2 sshd[1434808]: Disconnected from invalid user hb 190.111.211.81 port 42520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 11:00:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<vbuOrM5FAtAI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-12-13 11:00:24 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:43678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 11:00:38 host2 sshd[1435062]: Disconnected from invalid user cloud 102.211.234.150 port 33162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 11:01:23 host2 sshd[1435573]: Disconnected from invalid user opsadmin 102.211.234.150 port 48494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 11:02:46 host2 sshd[1436453]: Disconnected from invalid user oscar 41.57.65.25 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:02:51 host2 sshd[1436496]: Disconnected from invalid user oscar 190.111.211.81 port 43802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-13 11:02:40 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (tigene) [73.88.196.91]:57264: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 11:03:37 host2 sshd[1437223]: Disconnected from invalid user dev 41.57.65.25 port 48482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-13 11:03:48 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:56694: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:03:53 host2 sshd[1437356]: Disconnected from invalid user user10 190.111.211.81 port 43430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2025-12-13 11:03:59 dovecot_login authenticator failed for adsl-89-217-204-91.adslplus.ch [89.217.204.91]:59354: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-13 11:04:12 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:59614: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-13 11:04:36 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:47124: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.121.114.141
country_id: 3865483
description:
2025-12-13 11:05:54 dovecot_plain authenticator failed for ([31.57.166.48]) [138.121.114.141]:37442: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 13 11:06:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<bDHgwM5F/N42rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.40.161
country_id: 1282988
description:
2025-12-13 11:05:25 dovecot_plain authenticator failed for ([31.57.166.48]) [103.190.40.161]:2548: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.226.153.126
country_id: 3996063
description:
2025-12-13 11:05:38 dovecot_plain authenticator failed for ([31.57.166.48]) [177.226.153.126]:3441: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 11:07:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<6VgNxs5FmrIuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-13 11:09:00 dovecot_login authenticator failed for (aes-static-041.73.22.125.airtel.in) [122.186.201.62]:34916: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-13 11:08:34 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:56188: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-13 11:08:56 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:42440: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-13 11:09:29 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:35628: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 11:10:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<S7hh0M5FiuEro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-13 11:10:36 dovecot_login authenticator failed for (cm-178.232.194.231.get.no) [178.232.194.231]:39220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 11:10:06 host2 sshd[1441453]: Disconnected from invalid user user 2.57.121.25 port 45423 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-13 11:14:07 dovecot_plain authenticator failed for (pling) [65.20.164.137]:46807: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-12-13 11:15:28 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:42148: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 11:15:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Ctre4s5FEtrCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 11:15:38 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:44968: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 11:16:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<xKF75M5FZJsI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-13 11:16:21 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:40704: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-13 11:16:43 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (rheat) [71.62.34.216]:36542: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-13 11:17:01 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (frism) [72.241.202.216]:38170: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 11:20:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<wEhw9M5FHtsv7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 11:21:08 host2 sshd[1448282]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-13 11:21:45 dovecot_plain authenticator failed for (dehyde) [178.250.191.189]:57528: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 11:22:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<yX/u+85F6M1npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-13 11:22:37 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (aultry) [174.58.87.108]:50734: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 11:22:40 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (sedneers) [96.230.65.90]:51372: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 11:22:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<AyW3+85F9qNm1bVi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 11:25:03 host2 sshd[1450712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-13 11:24:45 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (flineal) [69.123.219.82]:51305: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-13 11:25:05 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:48608: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-13 11:25:19 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:58190: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:25:44 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<r1BfB89FLtkDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.22.225.7
country_id: 3865483
description:
2025-12-13 11:25:47 dovecot_plain authenticator failed for ([31.57.166.48]) [186.22.225.7]:22897: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.61.51.166
country_id: 6252001
description:
2025-12-13 11:25:59 dovecot_plain authenticator failed for c-71-61-51-166.hsd1.pa.comcast.net ([31.57.166.48]) [71.61.51.166]:40262: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 13 11:27:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qvkCDM9FBBdChJl8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 11:27:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<QS8iDM9FLtTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.244.51
country_id: 1733045
description:
2025-12-13 11:26:13 dovecot_plain authenticator failed for ([31.57.166.48]) [180.75.244.51]:63505: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec 13 11:26:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UxumCc9Fp9uTuYRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:26:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<TCX3Cs9FuJEDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.219.159
country_id: 3374766
description:
2025-12-13 11:28:59 dovecot_login authenticator failed for ([41.215.219.159]) [41.215.219.159]:32895: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 11:28:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<9jzPEM9FNOKB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-13 11:29:39 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:33690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 11:29:56 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:45060: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-13 11:29:11 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:58304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:29:21 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<y5lPFM9FQosDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-13 11:29:36 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:53032: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 11:30:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<X2cOGc9F1Ipntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.7
country_id: 719819
description:
Dec 13 11:31:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=178.48.181.7, lip=66.85.158.91, TLS, session=<awcPG89FlsqyMLUH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.85
country_id: 3469034
description:
Dec 13 11:31:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.247.85, lip=66.85.158.91, TLS, session=<pF/4G89Fq6i60fdV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.84
country_id: 690791
description:
Dec 13 11:31:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=176.103.2.84, lip=66.85.158.91, TLS, session=<a/OzHM9FiaGwZwJU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 11:33:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<FFVlIc9Fjps+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 11:33:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<fUKaIc9FqIjD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.5
country_id: 3469034
description:
Dec 13 11:32:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=177.8.251.5, lip=66.85.158.91, TLS, session=</yk+Hc9FjKuxCPsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 11:33:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Vdu6Is9Fcrs+PIdf>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:34:45 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<ZiKkJ89FdJUDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-12-13 11:35:02 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:45913: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-13 11:34:17 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:46284: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-13 11:34:20 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:51016: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-13 11:34:38 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (inonspragy) [73.199.161.144]:55952: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.111.140
country_id: 6252001
description:
2025-12-13 11:34:42 dovecot_login authenticator failed for ([75.110.111.140]) [75.110.111.140]:45289: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-13 11:34:57 dovecot_login authenticator failed for ([84.213.189.183]) [84.213.189.183]:56355: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-13 11:35:09 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:61759: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-12-13 11:35:19 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:43361: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-13 11:35:43 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:54042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 11:36:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<MDArLM9Fos+H6yFP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.189.131.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.189.131.45 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 11:36:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<wH1hLs9FioC8pkxr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.20.245.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.20.245.239 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.61.145.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.61.145.91 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:36:22 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<75NtLc9FepMDlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.174.40.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.174.40.35 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.119.96.2
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 52.119.96.2 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.199.220.184
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.199.220.184 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.242.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 107.136.242.37 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 11:38:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=</beINs9FJpal6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 11:38:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Sq1kNM9FCuaKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Dec 13 11:39:59 host2 sshd[1459641]: Disconnected from invalid user smart 115.241.83.2 port 53388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-12-13 11:40:55 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:62639: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-13 11:40:57 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:45536: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.241.83.2
country_id: 1269750
description:
Dec 13 11:40:46 host2 sshd[1460166]: Disconnected from invalid user hadoop 115.241.83.2 port 48312 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 11:41:47 host2 sshd[1460502]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 11:41:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<XexePs9FWJAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-13 11:41:14 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:32939: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-13 11:42:57 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (alnes) [174.161.27.82]:57435: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.149.97
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.168.149.97 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 11:43:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<nagMR89FLOZAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Dec 13 11:44:01 host2 sshd[1461565]: Disconnected from invalid user hieu 115.241.83.2 port 57446 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.12.248.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.12.248.45 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.185.109.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.185.109.176 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.196.96.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.196.96.186 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.180.160.169
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 67.180.160.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.50.52
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.150.50.52 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.54.202.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.54.202.17 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 11:43:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<c9FZR89FSIkImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 11:44:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<vlLiSs9FgpfO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.31.253
country_id: 99237
description:
2025-12-13 11:46:11 dovecot_plain authenticator failed for ([31.57.166.48]) [185.106.31.253]:22867: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 11:46:15 dovecot_plain authenticator failed for (unionil) [12.150.243.22]:63694: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.184.22.178
country_id: 3865483
description:
2025-12-13 11:46:21 dovecot_plain authenticator failed for ([31.57.166.48]) [45.184.22.178]:51042: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.217.180.188
country_id: 6252001
description:
2025-12-13 11:46:22 dovecot_plain authenticator failed for c-98-217-180-188.hsd1.nh.comcast.net ([31.57.166.48]) [98.217.180.188]:45066: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.27.91.52
country_id: 6252001
description:
2025-12-13 11:46:32 dovecot_plain authenticator failed for ([31.57.166.48]) [50.27.91.52]:55112: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.139.159
country_id: 3658394
description:
2025-12-13 11:46:43 dovecot_plain authenticator failed for ([31.57.166.48]) [200.24.139.159]:54166: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 11:46:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<3MLPUs9FdrrAqZl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 13 11:48:00 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<dF8IV89F+pkD7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-13 11:50:26 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:58618: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 11:50:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<9mABYc9FOK+G0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-13 11:51:18 dovecot_login authenticator failed for (aes-static-105.28.22.125.airtel.in) [182.95.228.22]:60324: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 11:53:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kBsybM9F/Ph100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 11:53:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<SM5has9FEsGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 11:53:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<MLaKas9FhuIIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-13 11:54:30 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:43360: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-13 11:54:41 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:53491: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.62.174.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.62.174.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.97.34.136
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.97.34.136 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.232.56.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.232.56.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.55.146.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.55.146.145 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.182.218.90
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.182.218.90 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.219.220.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.219.220.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.20.150.23
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.20.150.23 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 11:55:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<w56vcc9FZKSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 11:56:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<h6dLdM9FMKqnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 11:57:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lrCOeM9FUX1etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 11:58:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<eslJfM9FksgI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 11:59:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<VBWUgM9F7O0uZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-13 11:59:47 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:40710: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-13 12:00:02 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:57294: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-13 11:59:17 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:52257: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-13 11:59:31 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:59536: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-13 12:00:54 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:53652: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.174.85
country_id: 1643084
description:
2025-12-13 12:05:50 dovecot_login authenticator failed for ([36.92.174.85]) [36.92.174.85]:60529: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-13 12:05:54 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (hanageoble) [73.129.57.71]:60390: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 12:05:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<JTKKlM9FnNVo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-12-13 12:05:30 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:53246: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-13 12:05:51 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (sming) [76.97.155.25]:57670: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-13 12:06:08 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:57318: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-13 12:06:20 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:57811: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 12:06:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<dGkCmc9FIsYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.20.179.199
country_id: 3865483
description:
2025-12-13 12:08:42 dovecot_plain authenticator failed for ([31.57.166.48]) [181.20.179.199]:47988: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.129.191.8
country_id: 3469034
description:
2025-12-13 12:09:02 dovecot_plain authenticator failed for ([31.57.166.48]) [177.129.191.8]:42324: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 12:09:19 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (unproaccum) [196.47.172.253]:49998: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.129.191.8
country_id: 3469034
description:
2025-12-13 12:09:08 dovecot_login authenticator failed for ([31.57.166.48]) [177.129.191.8]:42324: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 12:10:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<7i8Cqc9FAOy8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 12:11:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<PpEirM9FyNc+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 12:14:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<ZzUutM9FKJwI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Dec 13 12:13:56 host2 sshd[1480831]: Disconnected from invalid user la 103.210.22.17 port 57570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 12:14:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<V7Q6tc9FrN/CBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Dec 13 12:14:34 host2 sshd[1481284]: Disconnected from invalid user user11 103.210.22.17 port 51168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 12:15:24 host2 sshd[1482076]: Disconnected from invalid user  62.60.131.157 port 59324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-13 12:15:53 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:43738: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.17
country_id: 1880251
description:
Dec 13 12:16:29 host2 sshd[1482933]: Disconnected from invalid user fivem 103.210.22.17 port 53852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 12:16:34 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (buctortis) [85.225.19.144]:40931: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-13 12:16:12 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:48978: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-13 12:16:18 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:49018: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-12-13 12:17:10 dovecot_login authenticator failed for (14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:58378: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 12:17:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<sBAWwM9F/Ihm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Dec 13 12:17:34 host2 sshd[1483742]: Disconnected from invalid user ca 178.128.147.10 port 49696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Dec 13 12:18:11 host2 sshd[1484170]: Disconnected from invalid user syncthing 178.128.147.10 port 53016 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.147.10
country_id: 6252001
description:
Dec 13 12:18:45 host2 sshd[1484478]: Disconnected from invalid user omm 178.128.147.10 port 52798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 12:18:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<D/hQxc9FluVnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Dec 13 12:19:45 host2 sshd[1485183]: Disconnected from invalid user sonar 103.210.22.17 port 45200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-13 12:19:49 dovecot_login authenticator failed for ([1.7.229.162]) [136.232.73.130]:47910: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Dec 13 12:19:52 host2 sshd[1485265]: Disconnected from invalid user newuser 178.128.147.10 port 53404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 12:20:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<HcLWyc9FKqcv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-13 12:22:00 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:45844: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 12:22:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<aq+X0s9FTMDCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.37
country_id: 1733045
description:
2025-12-13 12:22:16 dovecot_login authenticator failed for ([49.124.146.37]) [49.124.146.37]:56480: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-12-13 12:24:07 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:44185: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 12:23:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<u4GV1c9F3qfD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.203
country_id: 6252001
description:
Dec 13 12:23:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.203, lip=66.85.158.92, TLS, session=<hsMk1s9FXv/G6xjL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-12-13 12:23:47 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:63279: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-12-13 12:23:54 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:35286: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 12:23:56 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:43783: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-13 12:25:36 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:51256: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-13 12:27:52 dovecot_plain authenticator failed for (squarremal) [102.53.15.17]:40709: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-13 12:27:55 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (luldst) [73.13.220.220]:54766: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 12:28:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<+6Vg589FztQ+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.119.98
country_id: 3865483
description:
Dec 13 12:28:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=190.181.119.98, lip=66.85.158.91, TLS, session=<r0Cr589F+Li+tXdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 12:28:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<QLYF6c9F5uRntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 12:30:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<mLBa7c9FJr6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.12
country_id: 3469034
description:
Dec 13 12:29:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=186.209.247.12, lip=66.85.158.91, TLS, session=<YTUL6c9FnJi60fcM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 12:29:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<yib+6s9FgNTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-13 12:29:32 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:41558: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-13 12:29:52 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:51088: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-13 12:30:35 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:48926: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-13 12:31:12 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:47082: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 12:31:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<Ln4d8s9F8qo+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 12:33:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<qK3j+s9F8Iu8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 12:34:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<DlVq+89FUKCKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 12:35:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<nLsU/89FYNM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.215.39.32
country_id: 630336
description:
2025-12-13 12:36:14 dovecot_plain authenticator failed for mm-32-39-215-37.mfilial.dynamic.pppoe.byfly.by ([31.57.166.48]) [37.215.39.32]:1547: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.202.149.125
country_id: 6252001
description:
2025-12-13 12:36:25 dovecot_plain authenticator failed for 107-202-149-125.lightspeed.sntcca.sbcglobal.net ([31.57.166.48]) [107.202.149.125]:34676: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.176.117.128
country_id: 99237
description:
2025-12-13 12:36:36 dovecot_plain authenticator failed for ([31.57.166.48]) [198.176.117.128]:28496: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-13 12:37:15 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:48258: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 12:37:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<tSMtB9BFvImH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-13 12:37:29 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:42650: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 12:37:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<uxFHCdBF+OjAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-13 12:39:42 dovecot_plain authenticator failed for (busit) [102.88.10.10]:34394: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 12:39:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<x+QTENBF4OQvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-13 12:40:00 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:39492: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 12:40:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<g24jEdBFisul6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-13 12:39:33 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:47383: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 12:41:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<c075FdBFYLJAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-13 12:41:48 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (miathers) [174.166.153.20]:47482: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 12:42:19 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (emedned) [85.225.19.144]:39650: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 13 12:42:08 host2 sshd[1498798]: Disconnected from invalid user backuppc 205.185.115.224 port 45100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-13 12:42:09 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (salia) [78.66.119.139]:37296: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 12:43:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<dnR1HtBFLpzO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 13 12:43:55 host2 sshd[1499844]: Disconnected from invalid user user 205.185.115.224 port 52604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-13 12:43:57 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:42831: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.92.8.45
country_id: 6252001
description:
2025-12-13 12:44:04 dovecot_plain authenticator failed for ([31.57.166.48]) [23.92.8.45]:47770: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-13 12:43:36 dovecot_login authenticator failed for (80.130.83.103.static.rapidnet.in) [103.83.130.80]:43750: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.92.8.45
country_id: 6252001
description:
2025-12-13 12:44:10 dovecot_login authenticator failed for ([31.57.166.48]) [23.92.8.45]:47770: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.209.87.158
country_id: 3865483
description:
2025-12-13 12:44:17 dovecot_plain authenticator failed for ([31.57.166.48]) [181.209.87.158]:53201: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.183.237.167
country_id: 6252001
description:
2025-12-13 12:44:27 dovecot_plain authenticator failed for ([31.57.166.48]) [65.183.237.167]:58849: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-13 12:44:29 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:44606: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-13 12:47:59 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (lisele) [68.193.149.88]:54513: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-13 12:48:29 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:52784: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2025-12-13 12:48:51 dovecot_login authenticator failed for ([180.94.76.126]) [180.94.76.126]:36808: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-13 12:48:55 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:34643: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-12-13 12:49:09 dovecot_login authenticator failed for ([110.77.148.87]) [110.77.148.87]:47130: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-13 12:49:56 dovecot_login authenticator failed for 14-0-142-131.static.pccw-hkt.com [14.0.142.131]:52262: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 12:50:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<6v7mNNBFStOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-13 12:50:10 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:55719: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 12:50:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<RP8oNtBFxL4ImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-13 12:50:30 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (oungradmed) [68.82.141.145]:41040: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 12:51:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<RB8GOtBF9jt100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-13 12:53:07 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:43630: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-13 12:52:35 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:44088: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 12:52:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<60fLPdBF0L0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 12:52:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<r00lP9BF4J6kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.171
country_id: 1733045
description:
2025-12-13 12:54:33 dovecot_login authenticator failed for ([49.124.152.171]) [49.124.152.171]:35558: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.65
country_id: 1733045
description:
2025-12-13 12:54:56 dovecot_login authenticator failed for ([49.125.201.65]) [49.125.201.65]:53654: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 12:55:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<SBxpSdBFRI2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-13 12:55:33 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:38182: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.123.148
country_id: 1819730
description:
2025-12-13 12:56:11 dovecot_login authenticator failed for (161.81.123.148.hk.chinamobile.com) [161.81.123.148]:46400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 12:56:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<8cnDS9BFSsMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 12:57:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<6m4UUdBFIJRetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 12:58:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<FtMxU9BFhrwIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 12:59:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Sj2xV9BFdrc+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.42
country_id: 3017382
description:
Dec 13 13:01:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.42, lip=66.85.158.92, session=<fOWpXtBFG71bxJgq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.66
country_id: 3017382
description:
Dec 13 13:01:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.66, lip=66.85.158.92, session=<Mx9HX9BFt6NbxJhC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.207
country_id: 3175395
description:
Dec 13 13:01:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=217.26.179.207, lip=66.85.158.91, TLS, session=<ZQrxXdBFt6bZGrPP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.83
country_id: 3017382
description:
Dec 13 13:02:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.83, lip=66.85.158.92, session=<R1GvX9BF19RbxJhT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 13 13:02:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS: Connection closed, session=<oof3X9BFUN9ChJl5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.66
country_id: 3017382
description:
Dec 13 13:02:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.66, lip=66.85.158.92, session=<+7htYNBFhalbxJhC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.134
country_id: 3865483
description:
Dec 13 13:02:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=179.0.251.134, lip=66.85.158.91, TLS, session=<9ndUX9BFsN6zAPuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.58
country_id: 3017382
description:
Dec 13 13:02:27 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.58, lip=66.85.158.92, session=<UM1AYdBFe6hbxJg6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 13:02:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<kFdRYtBFnI0ro2np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.40
country_id: 3017382
description:
Dec 13 13:02:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.40, lip=66.85.158.92, session=<H/s6YNBFv+tbxJgo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.60
country_id: 3017382
description:
Dec 13 13:02:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.60, lip=66.85.158.92, session=<ySVRYNBFF7dbxJg8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-13 13:04:56 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:40251: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-13 13:05:44 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:43000: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 13 13:06:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<OTwYb9BFHMcDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.234
country_id: 2186224
description:
2025-12-13 13:07:22 dovecot_login authenticator failed for ([121.73.169.234]) [121.73.169.234]:58514: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-13 13:07:35 dovecot_login authenticator failed for (201.173.56.28-clientes-izzi.mx) [201.173.56.28]:39921: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2025-12-13 13:08:38 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:64413: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-13 13:08:50 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:18757: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 13:09:37 host2 sshd[1516732]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 13:09:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<BgofedBFLLO8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.54
country_id: 6252001
description:
Dec 13 13:09:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.54, lip=66.85.158.91, TLS, session=</IIAetBF4PXG6xg2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.5.39.49
country_id: 3895114
description:
2025-12-13 13:11:23 dovecot_plain authenticator failed for ([31.57.166.48]) [190.5.39.49]:51811: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.165
country_id: 3175395
description:
Dec 13 13:11:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.197.9.165, lip=66.85.158.91, TLS, session=<rIzpgdBFp+K5xQml>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 13:13:33 host2 sshd[1520160]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.121.205
country_id: 294640
description:
2025-12-13 13:13:35 dovecot_login authenticator failed for ([46.210.121.205]) [46.210.121.205]:41578: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 13:13:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<yxwJidBFqqnCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 13:13:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Ftx5idBFoJpm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-13 13:13:49 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:46686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 13 13:14:21 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, session=<DcLSi9BFesw2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 13:14:45 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:53632: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-13 13:14:58 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:61410: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 13:15:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<OgYtjtBFNO5npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 13:17:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<cI3FldBFuI4+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 13 13:17:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<J+8iltBFouDBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-13 13:19:50 dovecot_plain authenticator failed for (eennaceled) [65.20.250.163]:34786: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 13:19:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<5MpYn9BFatgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 13:19:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Q+h4n9BFpqLD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-13 13:19:26 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:43812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-12-13 13:19:39 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:57570: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-13 13:20:58 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:58986: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-13 13:21:01 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:41159: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-13 13:20:42 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:45153: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-13 13:23:43 dovecot_plain authenticator failed for (nogyropa) [192.81.229.181]:40228: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 13:25:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Wq0MtdBFesTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 13:25:47 host2 sshd[1528574]: Disconnected from invalid user  62.60.131.157 port 51286 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 13:27:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<dsAlu9BFlI5ntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-13 13:27:41 dovecot_plain authenticator failed for (halout) [92.62.243.174]:32965: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-13 13:27:44 dovecot_plain authenticator failed for (preoventic) [176.113.155.132]:44647: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.215
country_id: 3175395
description:
Dec 13 13:29:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.26.179.215, lip=66.85.158.91, TLS, session=<Hns/v9BF6YLZGrPX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-12-13 13:29:29 dovecot_plain authenticator failed for (salkass) [65.20.129.67]:37468: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-13 13:29:30 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:35283: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 13:29:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<+hXSwtBF3p2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.96.213
country_id: 3996063
description:
Dec 13 13:29:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=138.122.96.213, lip=66.85.158.91, TLS, session=<cZdOwNBFbeaKemDV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-13 13:29:23 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:58204: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-12-13 13:30:23 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:43001: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.80
country_id: 6252001
description:
Dec 13 13:30:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.80, lip=66.85.158.92, TLS, session=<Fv4fxdBFUPjG6xhQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 13:31:19 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (packen) [96.230.65.90]:52296: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 13:32:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<SV49zdBFmsiB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-13 13:33:37 dovecot_login authenticator failed for (cm-84.210.149.45.get.no) [84.210.149.45]:48315: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 13:33:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<x62E0dBF0oK8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 13:35:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<HzgU2dBFSLzAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 13:36:11 host2 sshd[1536261]: Disconnected from invalid user admin 2.57.121.112 port 47386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 13:36:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<0Mre2dBF4qM+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 13:38:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<eR7S4tBFhl0vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-13 13:38:44 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:58672: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 13:39:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<7Cii5NBFWr1AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-13 13:38:22 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:47294: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-13 13:38:23 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:53390: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.77
country_id: 1733045
description:
2025-12-13 13:38:40 dovecot_login authenticator failed for ([49.125.201.77]) [49.125.201.77]:60394: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-12-13 13:39:25 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:46130: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 13:40:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<6yit6tBFkKil6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 13:41:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<1kUF69BFVtaB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 13:40:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<tspA6dBFVLyH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 13:43:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<sGgA89BFsKfO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2025-12-13 13:44:03 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:32870: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-13 13:44:44 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:52174: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2025-12-13 13:45:17 dovecot_login authenticator failed for ([177.236.146.149]) [177.236.146.149]:39506: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-13 13:45:33 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:56520: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 13:46:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50087: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 13:46:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<IBLv/9BFDKinrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 13:47:35 dovecot_plain authenticator failed for (subar) [64.72.74.162]:35062: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 13:48:29 host2 sshd[1544298]: Disconnected from invalid user user 2.57.121.25 port 14708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 13:49:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<YaDpCtFFBMSG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 13:50:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<gCaLC9FFwqV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 13:50:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Wp6TDNFFUtkuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-13 13:54:02 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:60800: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 13:53:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<JKlkF9FFnsykXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.154
country_id: 6252001
description:
Dec 13 13:53:34 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.133.154, lip=66.85.158.91, session=<TzgSGNFFYOKTuYWa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-13 13:53:37 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (dindiatine) [217.215.74.195]:56588: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-13 13:53:56 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:55766: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2025-12-13 13:54:19 dovecot_login authenticator failed for ([128.185.194.190]) [128.185.194.190]:44528: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.238.221.65
country_id: 3996063
description:
2025-12-13 13:54:21 dovecot_login authenticator failed for ([177.238.221.65]) [177.238.221.65]:49613: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 13:54:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<ttADHdFFcsMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 13:55:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Z0AnHtFFwsM+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 13:55:25 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (relheted) [96.230.65.90]:46746: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 13:57:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<7qJfJNFF9qEImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 13:56:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<iCRWItFFkKI+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 13:56:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Rhe2ItFFsL2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-13 13:57:51 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:60095: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-13 13:58:06 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:54299: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 13 13:58:14 host2 sshd[1551285]: Disconnected from invalid user bank 103.26.136.173 port 46898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-13 13:57:43 dovecot_plain authenticator failed for (dinop) [187.161.198.68]:41584: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-13 13:59:02 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:55500: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-13 13:59:16 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (unkireps) [67.173.58.47]:47802: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-13 13:58:46 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:35712: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 13:59:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<EivfLdFFaupo1joy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 13 13:59:59 host2 sshd[1552301]: Disconnected from invalid user lighthouse 103.26.136.173 port 42672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 13:59:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<IVWDLdFFQutetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.159.139.26
country_id: 6252001
description:
Dec 13 14:00:26 host2 sshd[1552803]: Disconnected from invalid user gabriel 43.159.139.26 port 44824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.2.208
country_id: 1819730
description:
Dec 13 14:00:43 host2 sshd[1552933]: Disconnected from invalid user rke 103.144.2.208 port 48700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.159.139.26
country_id: 6252001
description:
Dec 13 14:01:41 host2 sshd[1553482]: Disconnected from invalid user steam 43.159.139.26 port 42660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-13 14:02:50 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12173: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2025-12-13 14:03:13 dovecot_login authenticator failed for ([103.79.237.54]) [103.79.237.54]:53136: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.2.208
country_id: 1819730
description:
Dec 13 14:03:17 host2 sshd[1554788]: Disconnected from invalid user ubuntu 103.144.2.208 port 50566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 14:02:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<MnorONFF/uYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-13 14:03:43 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:44144: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-13 14:04:02 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:45036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 14:03:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<TufOOtFFpo4IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-12-13 14:03:21 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:55140: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.44.136.205
country_id: 1269750
description:
2025-12-13 14:04:39 dovecot_login authenticator failed for ([103.44.136.205]) [103.44.136.205]:60110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 13 14:04:58 host2 sshd[1555744]: Disconnected from invalid user app 118.194.231.208 port 58942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 13 14:05:08 host2 sshd[1555954]: Disconnected from invalid user ian 103.26.136.173 port 54966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 13 14:06:15 host2 sshd[1556587]: Disconnected from invalid user sambauser 118.194.231.208 port 59074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 13 14:06:33 host2 sshd[1556733]: Disconnected from invalid user dspace 103.26.136.173 port 54444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-13 14:06:47 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (gamster) [67.173.58.47]:49878: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 13 14:08:10 host2 sshd[1557499]: Disconnected from invalid user guest 118.194.231.208 port 59268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.61
country_id: 6252001
description:
Dec 13 14:08:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.61, lip=66.85.158.91, session=<dExgTNFFBOMUQcM9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 14:08:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<0BFfTNFFLri8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.167.44
country_id: 6252001
description:
Dec 13 14:08:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.84.167.44, lip=66.85.158.92, session=<WotVTdFFXKIUVKcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-13 14:08:57 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:38916: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-13 14:09:20 dovecot_login authenticator failed for ([182.95.119.118]) [182.95.119.118]:54090: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-13 14:09:50 dovecot_login authenticator failed for ([47.247.80.227]) [14.195.19.75]:36146: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 14:10:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<4BgfVdFFUKgI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 14:10:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mAFoVNFFfs9m1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-13 14:11:59 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:50494: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 14:12:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<H23ZWdFFsr9npBQq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 13 14:11:25 host2 sshd[1559317]: Disconnected from invalid user gabriel 118.194.231.208 port 59606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-13 14:11:36 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:45342: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 14:13:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<9gObXtFFbKXCBa8Y>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.203.8.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 168.203.8.68 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 14:14:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<4ny5Y9FFJoM+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 14:16:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<czJIatFFkpQ+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 14:16:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<NZFDa9FFMs3D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 14:19:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Cj02dtFF1pwv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-13 14:21:24 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (inize) [71.224.169.28]:51074: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-13 14:22:40 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:41370: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 14:22:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<GMLlgNFFxLTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-13 14:22:58 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:45842: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 13 14:24:51 host2 sshd[1566263]: Disconnected from invalid user elasticsearch 104.248.245.89 port 39454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 14:26:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<LCETjNFFaumKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-13 14:26:06 dovecot_plain authenticator failed for (zizeng) [176.113.155.132]:41213: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 14:26:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<rntbjtFFuLVntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 13 14:26:19 host2 sshd[1567331]: Disconnected from invalid user transmission 190.60.51.173 port 59694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2025-12-13 14:27:40 dovecot_login authenticator failed for (aes-static-097.188.22.125.airtel.in) [122.184.118.126]:49026: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 13 14:27:51 host2 sshd[1568344]: Disconnected from invalid user a 190.60.51.173 port 52490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-12-13 14:27:51 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:49687: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 14:27:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<q0rwktFFnr4+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Dec 13 14:27:26 host2 sshd[1568111]: Disconnected from invalid user daisy 81.192.46.49 port 41514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-13 14:28:21 dovecot_login authenticator failed for ([182.95.63.50]) [182.95.63.50]:40088: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Dec 13 14:28:36 host2 sshd[1568782]: Disconnected from invalid user r 81.192.46.49 port 38244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-13 14:28:49 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:47034: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 13 14:28:56 host2 sshd[1569020]: Disconnected from invalid user sepehr 27.254.149.199 port 44606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-13 14:29:00 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:37660: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.49
country_id: 2542007
description:
Dec 13 14:29:08 host2 sshd[1569166]: Disconnected from invalid user release 81.192.46.49 port 50724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 13 14:29:12 host2 sshd[1569191]: Disconnected from invalid user sepehr 190.60.51.173 port 42424 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-13 14:29:57 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:59626: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 13 14:29:36 host2 sshd[1569385]: Disconnected from invalid user seal 27.254.149.199 port 57988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Dec 13 14:29:41 host2 sshd[1569432]: Disconnected from invalid user lab 81.192.46.49 port 34968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 13 14:30:22 host2 sshd[1570012]: Disconnected from invalid user esuser 202.165.22.246 port 40932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-12-13 14:30:28 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:42976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.209.254
country_id: 6252001
description:
Dec 13 14:31:56 host2 sshd[1571011]: Disconnected from invalid user winter 107.175.209.254 port 56600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 13 14:31:29 host2 sshd[1570670]: Disconnected from invalid user lab 190.60.51.173 port 45980 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 14:31:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<OSNaoNFFWuy8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 13 14:31:54 host2 sshd[1570994]: Disconnected from invalid user alumno 104.248.245.89 port 33164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 13 14:32:26 host2 sshd[1571325]: Disconnected from invalid user crypto 202.165.22.246 port 50732 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 14:33:04 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (untinal) [196.47.172.253]:58094: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 14:33:09 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (gotymphass) [96.230.65.90]:33362: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-13 14:33:12 dovecot_plain authenticator failed for (eprocy) [178.158.142.39]:32888: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.96
country_id: 2542007
description:
2025-12-13 14:33:54 dovecot_login authenticator failed for ([105.73.203.96]) [105.73.203.96]:41420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-13 14:34:15 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:57198: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 13 14:33:43 host2 sshd[1572117]: Disconnected from invalid user cms 104.248.245.89 port 48074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 14:33:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<dAXEp9FFTo3AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-12-13 14:35:08 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:52770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-13 14:34:31 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:48836: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.191
country_id: 1733045
description:
2025-12-13 14:34:33 dovecot_login authenticator failed for ([49.124.159.191]) [49.124.159.191]:37494: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.209.254
country_id: 6252001
description:
Dec 13 14:34:47 host2 sshd[1572784]: Disconnected from invalid user sammy 107.175.209.254 port 43848 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 14:35:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<b8ggrtFFLJWB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-13 14:35:37 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (muffludes) [68.38.201.238]:54684: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 14:35:27 host2 sshd[1573304]: Disconnected from invalid user odoo 62.60.131.157 port 58717 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 14:35:33 dovecot_plain authenticator failed for (betation) [154.144.243.93]:33312: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 14:36:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<uK30stFFsJyB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 14:37:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<thHetdFFHKdAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 14:37:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<tyy4tdFFXh0vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-13 14:39:19 dovecot_plain authenticator failed for (intables) [24.105.248.218]:57610: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 14:42:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<IdEzxdFFlN2H6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-12-13 14:42:08 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:47195: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-13 14:41:56 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:54006: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 14:42:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<9cGiyNFFIOfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 14:42:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<fOsTx9FF6JSl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Dec 13 14:44:10 host2 sshd[1578957]: Disconnected from invalid user alumno 160.251.251.171 port 41328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-13 14:44:37 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:33812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.61.131.129
country_id: 2510769
description:
2025-12-13 14:44:50 dovecot_login authenticator failed for 129.red-83-61-131.dynamicip.rima-tde.net [83.61.131.129]:33135: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.178
country_id: 3017382
description:
Dec 13 14:45:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.178, lip=66.85.158.91, session=</7+e0tFFba1bxJiy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.215
country_id: 3017382
description:
Dec 13 14:46:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.215, lip=66.85.158.91, session=<7o6209FFF5xbxJjX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.210
country_id: 3017382
description:
Dec 13 14:45:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.210, lip=66.85.158.91, session=<g30B0tFFKatbxJjS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-13 14:45:41 dovecot_plain authenticator failed for (beack) [192.81.229.181]:44408: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.159
country_id: 6252001
description:
2025-12-13 14:49:13 dovecot_login authenticator failed for ([72.214.132.159]) [72.214.132.159]:54759: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-13 14:48:38 dovecot_login authenticator failed for ([89.218.247.234]) [89.218.247.234]:55416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 14:48:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<5sXx3NFFos0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 14:49:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</5qs39FFg0l100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 14:50:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Jecv5NFFBLuG0Wp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Dec 13 14:51:40 host2 sshd[1584233]: Disconnected from invalid user seal 160.251.251.171 port 41796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 14:52:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<VFiO6dFFwog+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 14:53:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<AenC7NFFxIEI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-12-13 14:53:42 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:54525: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-13 14:53:50 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:60267: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2025-12-13 14:53:57 dovecot_login authenticator failed for ([125.19.183.66]) [125.19.183.66]:34160: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-13 14:54:04 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:48798: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 14:54:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<WUaO8NFFgrmkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 14:54:38 host2 sshd[1586983]: Disconnected from invalid user user 2.57.121.25 port 10563 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-12-13 14:54:55 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:54625: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.251.171
country_id: 1861060
description:
Dec 13 14:54:54 host2 sshd[1587326]: Disconnected from invalid user sftpuser 160.251.251.171 port 33288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-13 14:55:10 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:52919: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 14:57:54 host2 sshd[1589996]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 14:57:47 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (etifibele) [85.225.19.144]:52164: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-13 14:57:51 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (seccle) [24.23.125.83]:36580: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 14:57:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<9Sjf/NFFXtSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-13 15:01:04 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:46397: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 15:00:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<y5DABtJF+LEro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-13 15:00:32 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:55783: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-13 15:00:36 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:41336: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 15:01:48 host2 sshd[1592553]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 15:01:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<H80kC9JFl8tetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 15:01:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<6p3iC9JF6OQ+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.136
country_id: 3469034
description:
Dec 13 15:03:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.92.247.136, lip=66.85.158.91, TLS, session=<eEpBEdJFPYGxXPeI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.50
country_id: 3175395
description:
Dec 13 15:03:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=185.15.170.50, lip=66.85.158.91, TLS, session=<AIVkEtJFZ4u5D6oy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 15:04:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<HfIhFtJFsuIImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 15:06:08 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (efooching) [196.47.172.253]:32809: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 15:07:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<byXUH9JFANhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 15:07:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<CzlyIdJFULG8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 15:09:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<yu2xJdJFAL9npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 15:08:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<hG+CI9JF1s0IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 15:08:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<7Sr9JNJFoqUI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.230
country_id: 6252001
description:
Dec 13 15:09:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.230, lip=66.85.158.91, TLS, session=<dE9SKdJFYPvG6xjm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 15:10:25 host2 sshd[1598685]: Disconnected from invalid user debian 62.60.131.157 port 31936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.117.114
country_id: 3865483
description:
2025-12-13 15:10:40 dovecot_login authenticator failed for (red.170.233.117.114.ssservicios.com.ar) [170.233.117.114]:51841: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 15:10:49 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:36020: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.17
country_id: 6252001
description:
2025-12-13 15:11:13 dovecot_login authenticator failed for wsip-184-191-243-17.fv.ks.cox.net [184.191.243.17]:52148: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-13 15:11:18 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:33473: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-13 15:12:15 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (chelly) [73.208.81.125]:34066: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.188.177
country_id: 6252001
description:
Dec 13 15:12:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.232.188.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<teQtM9JFsp2s6Lyx>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.232.188.177
country_id: 6252001
description:
Dec 13 15:12:56 host2 pure-ftpd[1600273]: (?@172.232.188.177) [INFO] New connection from 172.232.188.177


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 15:13:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<paLrNNJFPNPD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 15:13:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<mpAUNdJFpNHCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-12-13 15:14:10 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:44008: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-13 15:14:51 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:42877: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.198.29
country_id: 1522867
description:
2025-12-13 15:14:38 dovecot_login authenticator failed for 2.133.198.29.dynamic.telecom.kz [2.133.198.29]:47133: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-12-13 15:15:19 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:58212: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-13 15:16:42 dovecot_plain authenticator failed for (uperalt) [5.76.44.40]:50965: 535 Incorrect authentication data (set_id=alert@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-13 15:19:07 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:41446: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 15:19:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ido1StJFsL/D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-13 15:19:16 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:61628: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 15:20:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<oZ8kTdJFGtIv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-12-13 15:19:31 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:12209: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.54
country_id: 2186224
description:
2025-12-13 15:19:31 dovecot_login authenticator failed for ([121.73.162.54]) [121.73.162.54]:53866: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-13 15:20:27 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:36802: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-13 15:20:38 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:59618: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 15:23:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Z0DOWNJFNpaKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.162
country_id: 6252001
description:
2025-12-13 15:25:06 dovecot_login authenticator failed for ([72.214.132.162]) [72.214.132.162]:41979: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-13 15:25:39 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:55408: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 15:26:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<RYzFYtJFgpBntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-13 15:26:23 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:45055: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.16
country_id: 3996063
description:
2025-12-13 15:26:42 dovecot_login authenticator failed for (201.166.222.16-clientes-izzi.mx) [201.166.222.16]:45923: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.228.23.212
country_id: 6252001
description:
2025-12-13 15:28:19 dovecot_plain authenticator failed for ec2-34-228-23-212.compute-1.amazonaws.com (EC2AMAZ-RT2IK6U.ec2.internal) [34.228.23.212]:60926: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 15:29:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<eGjkb9JFbuS8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 15:31:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<ph4vd9JFIM/AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 15:32:04 dovecot_plain authenticator failed for (sitartial) [12.150.243.22]:20737: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:36:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<zkXJhtJFrNkDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 15:35:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<lzw2hdJFwtOnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-13 15:36:05 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:37706: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 15:36:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<QNsiiNJF7IhAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 15:37:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1cWYitJFUHcvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:37:41 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<tO9ojNJFxIEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:38:32 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<NUF8j9JFVIIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 15:39:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Q5gLkdJFLr+B4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-13 15:39:34 dovecot_login authenticator failed for ([125.19.174.244]) [128.185.201.138]:59764: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-13 15:39:48 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:43426: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:40:04 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<QuPqlNJFvNYDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-13 15:41:03 dovecot_plain authenticator failed for (acquiseman) [65.20.129.28]:54526: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:40:19 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<RivcldJFaOEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:41:56 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Rrijm9JFUOUDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 15:42:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=</7RentJFxKU+PIMh>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:42:45 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<fOKBntJF4p8DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 15:43:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<v5ypn9JFNNXO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:42:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<gQBcndJFYM8DhBfJ>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.240
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.240: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 15:43:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<VNKTodJFRLeH6yFP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:44:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<RZRBo9JFFugDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-13 15:44:29 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:35671: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:44:35 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<2ysYpdJFKp8DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-13 15:44:41 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3787: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-13 15:45:04 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (foril) [73.213.236.66]:33508: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 15:45:12 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:50298: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:44:23 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<J/pkpNJFYOMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 15:46:07 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<kL+OqtJFPq0DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 15:45:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<Am+3qNJFJt2l6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-13 15:45:39 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:50677: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-13 15:45:54 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:54330: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.47
country_id: 6252001
description:
2025-12-13 15:46:38 dovecot_login authenticator failed for ([98.181.46.47]) [98.181.46.47]:50111: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 15:47:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<RCCirdJFOskuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-13 15:48:19 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (sulged) [73.168.136.150]:44384: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 15:47:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<uxq+sNJFpdV100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 89.249.55.106 - colourma "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourma (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 15:50:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<bQH9utJFOJII3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-12-13 15:51:15 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:40938: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-13 15:50:43 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:48591: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 89.249.55.106 - colperla "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colperla (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-12-13 15:51:25 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:45460: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-13 15:51:37 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:38222: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 15:51:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<SkL5vdJFrsyG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-13 15:54:17 dovecot_plain authenticator failed for (exurownwin) [14.139.107.146]:38454: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 15:55:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<QE/LzNJFBpakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 15:58:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<ND0v1tJFAJEro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 15:58:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=</ycI2NJF0I+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 16:00:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<oi7u3dJFVJo+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.251
country_id: 1733045
description:
2025-12-13 16:00:55 dovecot_login authenticator failed for ([49.124.150.251]) [49.124.150.251]:39370: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-13 16:01:07 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:56780: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.19
country_id: 6252001
description:
Dec 13 16:01:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.118.19, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YgAA4dJFXpasynYT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-13 16:02:40 dovecot_plain authenticator failed for (unnizzin) [24.105.248.218]:42462: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 13 16:02:53 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<DFqO5tJFvrcD7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-12-13 16:03:12 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:41108: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.93.36.83
country_id: 1821275
description:
2025-12-13 16:03:26 dovecot_login authenticator failed for ([182.93.36.83]) [182.93.36.83]:53744: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 16:04:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<MLFc69JFPMpm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 16:04:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<P77l69JFDY9etwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.226
country_id: 1733045
description:
2025-12-13 16:04:55 dovecot_login authenticator failed for ([49.124.152.226]) [49.124.152.226]:46892: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.78.13.13
country_id: 732800
description:
2025-12-13 16:05:14 dovecot_login authenticator failed for inkas.networx-bg.com [77.78.13.13]:40016: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 16:06:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<YOG88tJFjNcI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 16:06:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<Q14l89JF5oVnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-13 16:06:39 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (winat) [76.31.164.124]:34418: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 16:07:13 host2 sshd[1636656]: Disconnected from invalid user admin 2.57.121.112 port 33992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 16:07:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<oEmt+NJFRpa8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.162.240.149
country_id: 1269750
description:
2025-12-13 16:09:39 dovecot_login authenticator failed for (abts-north-dynamic-149.240.162.122.airtelbroadband.in) [122.162.240.149]:53841: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-13 16:09:50 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:51082: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-13 16:10:12 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:58141: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 16:09:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<dsHV/dJForLD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-13 16:10:34 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:57465: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 176.235.182.73
country_id: 298795
description:
Dec 13 16:10:20 host2 sshd[1638695]: Disconnecting authenticating user root 176.235.182.73 port 59688: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 176.235.182.73
country_id: 298795
description:
Dec 13 16:10:20 host2 sshd[1638695]: error: maximum authentication attempts exceeded for root from 176.235.182.73 port 59688 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.235.182.73
country_id: 298795
description:
Dec 13 16:10:31 host2 sshd[1638801]: error: maximum authentication attempts exceeded for invalid user admin from 176.235.182.73 port 33940 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.235.182.73
country_id: 298795
description:
Dec 13 16:10:33 host2 sshd[1638832]: Disconnecting invalid user admin 176.235.182.73 port 34863: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-12-13 16:12:08 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:54372: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 16:11:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<FCs1BtNF1KPCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-13 16:11:49 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:59676: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.178.83.199
country_id: 6252001
description:
Dec 13 16:11:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.178.83.199, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<++qnBtNFiqysslPH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 16:14:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<2C4SD9NFkOTCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-12-13 16:14:23 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:60112: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 16:15:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<r3AcE9NFUuLD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-13 16:15:53 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:55037: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-13 16:16:56 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (subilignag) [68.193.149.88]:52270: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.243.92.96
country_id: 2510769
description:
Dec 13 16:16:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.243.92.96, lip=66.85.158.91, TLS, session=<aqMiFdNFxaK581xg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-13 16:16:32 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:44600: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.109.162.144
country_id: 3469034
description:
Dec 13 16:16:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.109.162.144, lip=66.85.158.91, TLS, session=<fQpBFtNFwsC7baKQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.216.181.233
country_id: 2661886
description:
2025-12-13 16:16:51 dovecot_login authenticator failed for c80-216-181-233.bredband.tele2.se [80.216.181.233]:50786: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 16:16:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<ssBUGNNFoqqB4gum>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 13 16:18:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<7Gj8H9NF2KeLonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 13 16:19:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<PWYcItNFUq2LonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 16:20:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<3GqRJNNFEI0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 16:21:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<yb5BJ9NF0NaKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-13 16:21:22 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (poideryte) [73.13.220.220]:48068: 535 Incorrect authentication data (set_id=backup@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 16:21:57 host2 sshd[1646751]: Disconnected from invalid user user 2.57.121.25 port 5039 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-13 16:23:19 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:57585: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-13 16:23:44 dovecot_login authenticator failed for (nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:35402: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 16:26:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<Do8vOdNF4shntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 13 16:25:20 host2 sshd[1648897]: Disconnected from invalid user terra 152.52.15.214 port 20350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2025-12-13 16:25:41 dovecot_login authenticator failed for ([210.56.28.18]) [210.56.28.18]:46893: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-13 16:26:19 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:60166: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-13 16:27:48 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:33218: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-13 16:28:06 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:35554: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 13 16:28:17 host2 sshd[1650640]: Disconnected from invalid user halo 152.52.15.214 port 21642 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 16:29:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<4JgHRtNFpp/AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-13 16:29:44 dovecot_login authenticator failed for ([125.19.218.50]) [125.19.218.50]:35592: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-13 16:29:58 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:34714: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 13 16:30:36 host2 sshd[1652290]: Disconnected from invalid user almacen 103.172.154.255 port 50568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 13 16:31:49 host2 sshd[1652946]: Disconnected from invalid user jj 152.52.15.214 port 37366 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 16:31:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<QzVES9NF4oa8pkxr>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 13 16:32:39 host2 sshd[1653379]: Received disconnect from 103.172.154.255 port 46904:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.116.208.101
country_id: 6252001
description:
2025-12-13 16:32:56 dovecot_login authenticator failed for 24-116-208-101.cpe.sparklight.net [24.116.208.101]:54224: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 13 16:32:35 host2 sshd[1653346]: Disconnected from invalid user timo 152.52.15.214 port 51802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.43
country_id: 6252001
description:
2025-12-13 16:33:15 dovecot_login authenticator failed for ([98.181.46.43]) [98.181.46.43]:40610: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 13 16:33:47 host2 sshd[1654162]: Disconnected from invalid user newuser 103.172.154.255 port 47064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2025-12-13 16:34:55 dovecot_login authenticator failed for ([38.156.1.127]) [38.156.1.127]:48070: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-13 16:35:26 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:38190: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-13 16:35:31 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:58613: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-13 16:35:57 dovecot_login authenticator failed for (201.173.92.229-clientes-izzi.mx) [201.173.92.229]:59249: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 16:36:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<bV7zXNNFFM9AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2025-12-13 16:35:08 dovecot_login authenticator failed for (2-55-126-88.orange.net.il) [2.55.126.88]:55303: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-13 16:35:12 dovecot_login authenticator failed for ([182.95.227.70]) [182.95.227.70]:47280: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-13 16:36:16 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:49627: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 16:36:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1D+uXtNF/DwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.144.36.234
country_id: 1269750
description:
Dec 13 16:40:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=103.144.36.234, lip=66.85.158.91, TLS, session=<JOTvatNFqaVnkCTq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.16.91.36
country_id: 1269750
description:
Dec 13 16:40:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=210.16.91.36, lip=66.85.158.91, TLS, session=<xUVAbNNF0qDSEFsk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-12-13 16:40:43 dovecot_login authenticator failed for (2-74-194-86.kcell.kz) [2.74.194.86]:40136: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-12-13 16:40:56 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:47460: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-13 16:41:32 dovecot_login authenticator failed for ([182.95.182.130]) [182.95.182.130]:59100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.99.132
country_id: 3057568
description:
Dec 13 16:41:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=31.134.99.132, lip=66.85.158.91, TLS, session=<yx2ocNNFcMsfhmOE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-13 16:41:53 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:39114: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.233
country_id: 3175395
description:
Dec 13 16:42:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.233, lip=66.85.158.91, TLS, session=<MnHBcdNFpYe5D6vp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 16:42:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<hMugddNFupI+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 16:43:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Wq1Xd9NFGuSB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 16:43:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<8SZKdtNF0OrO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Dec 13 16:44:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<K+nFfNNFfKoDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 16:45:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<iqMWftNFXp8uZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-13 16:46:20 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:35939: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 16:46:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<NINAgtNFpNB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-13 16:46:54 dovecot_plain authenticator failed for (coness) [94.206.93.90]:42490: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 16:47:26 host2 sshd[1662995]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-13 16:47:30 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (scoutig) [73.230.86.50]:54786: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2025-12-13 16:47:57 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:33383: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.54
country_id: 2186224
description:
2025-12-13 16:47:07 dovecot_login authenticator failed for ([121.73.162.54]) [121.73.162.54]:33844: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 16:48:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<wVcaiNNFBryl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-13 16:48:14 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:51277: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 16:48:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<4j45idNF0IiH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 16:48:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<cShMidNFQNcI3tq7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 16:51:25 host2 sshd[1665607]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 16:51:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<lBV2k9NFdseG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-13 16:51:27 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:36056: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-13 16:51:40 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:50249: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-13 16:52:37 dovecot_plain authenticator failed for (exilis) [65.20.133.4]:46226: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 16:54:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<myhToNNF2qIro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-13 16:55:36 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (appega) [217.215.74.195]:54413: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-13 16:55:37 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:37349: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-13 16:55:25 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:49682: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-13 16:57:20 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (prograteds) [2.135.31.74]:33465: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2025-12-13 16:57:25 dovecot_plain authenticator failed for (emancted) [185.120.142.233]:58481: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-13 16:57:42 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:59127: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 16:57:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<PXgKq9NFYMSkXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 13 16:57:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<XPZdq9NFLoEjygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-13 16:58:40 dovecot_plain authenticator failed for (bammeness) [41.248.243.181]:56362: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-13 16:58:43 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (uncylously) [71.41.202.12]:58535: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-13 16:58:29 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:56496: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-13 16:58:35 dovecot_plain authenticator failed for (urocy) [65.20.184.80]:39572: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-13 17:00:11 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:33316: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-13 17:00:27 dovecot_login authenticator failed for ([128.185.223.185]) [27.123.114.190]:34670: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-13 17:00:34 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:43452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 17:00:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<x54/tdNFwLyWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-13 17:01:47 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:45582: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 13 17:01:52 host2 sshd[1673284]: Disconnected from invalid user user 103.210.21.242 port 35582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 17:01:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<DFqzttNFsK5m1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-13 17:01:11 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:39938: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-13 17:01:33 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:50859: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.87
country_id: 1643084
description:
Dec 13 17:03:08 host2 sshd[1674304]: Disconnected from invalid user mosquitto 103.23.199.87 port 47542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.228.23.212
country_id: 6252001
description:
2025-12-13 17:03:32 dovecot_plain authenticator failed for ec2-34-228-23-212.compute-1.amazonaws.com (EC2AMAZ-RT2IK6U.ec2.internal) [34.228.23.212]:63415: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 17:03:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<K1kQwNNFQoxnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 17:04:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<7yQiwdNFVuQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-13 17:04:32 dovecot_plain authenticator failed for (confulling) [88.207.210.23]:63666: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 17:05:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<YrPHxtNF0JjD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 13 17:05:46 host2 sshd[1676485]: Disconnected from invalid user autcom 187.140.184.163 port 46302 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-13 17:06:25 dovecot_login authenticator failed for (nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:43110: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-13 17:06:45 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:43979: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-13 17:07:04 dovecot_login authenticator failed for (mail3.hurst.co.uk) [77.89.143.122]:34750: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 13 17:07:44 host2 sshd[1677437]: Disconnected from invalid user foundry 187.140.184.163 port 50876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 13 17:07:48 host2 sshd[1677483]: Disconnected from invalid user kk 167.99.49.89 port 35318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 13 17:07:08 host2 sshd[1677183]: Disconnected from invalid user jellyfin 187.140.184.163 port 38260 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-13 17:07:17 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:58890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 17:07:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<6IAUzdNFUJG8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 13 17:07:35 host2 sshd[1677385]: Disconnected from invalid user frappe 103.210.21.242 port 35604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.87
country_id: 1643084
description:
Dec 13 17:09:05 host2 sshd[1678274]: Disconnected from invalid user db2fenc1 103.23.199.87 port 59368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 13 17:08:51 host2 sshd[1678090]: Disconnected from invalid user mosquitto 167.99.49.89 port 60516 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 13 17:09:57 host2 sshd[1678686]: Disconnected from invalid user hb 167.99.49.89 port 49186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-13 17:10:02 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (dediurnsho) [66.177.30.53]:43500: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 13 17:09:23 host2 sshd[1678436]: Disconnected from invalid user fred 103.210.21.242 port 33412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 13 17:09:32 host2 sshd[1678504]: Disconnected from invalid user rostam 187.140.184.163 port 60518 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 17:09:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9M0G1dNFiIIDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.87
country_id: 1643084
description:
Dec 13 17:09:50 host2 sshd[1678635]: Disconnected from invalid user new 103.23.199.87 port 49830 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 17:10:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WoNs19NFjNADhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.78.29.97
country_id: 2802361
description:
Dec 13 17:10:28 host2 sshd[1679370]: Disconnected from invalid user intel 34.78.29.97 port 60936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 17:11:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<nfcc3NNFcpTD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.49
country_id: 2750405
description:
Dec 13 17:11:34 host2 sshd[1680164]: Disconnected from invalid user admin 45.81.23.49 port 47732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 17:11:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<toEG3NNFSKcDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Dec 13 17:13:42 host2 sshd[1681791]: Disconnected from invalid user h 45.81.23.49 port 48178 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 17:14:00 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<HuLi5NNFupoDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 17:15:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<K61/6NNFnrnCBa8Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 17:14:21 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<Kh8h5tNFkt4DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 153.127.193.71
country_id: 1861060
description:
Dec 13 17:14:40 host2 sshd[1682278]: Disconnected from invalid user ftpuser 153.127.193.71 port 38794 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 17:16:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<x7y57dNFKOkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-12-13 17:16:34 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:53286: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.0.205
country_id: 1605651
description:
Dec 13 17:16:59 host2 sshd[1683841]: Disconnected from invalid user user 122.155.0.205 port 23417 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.202
country_id: 6252001
description:
2025-12-13 17:17:10 dovecot_login authenticator failed for ([72.214.132.202]) [72.214.132.202]:36989: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 17:17:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<aR7S8NNFftADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 17:17:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<fvoj8tNF6MaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 17:17:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<Ykmq8tNF+OQIgeYe>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.155.0.205
country_id: 1605651
description:
Dec 13 17:18:27 host2 sshd[1684663]: Disconnected from invalid user dmdba 122.155.0.205 port 2749 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 13 17:18:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<N6uo9dNFAL8DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 17:20:15 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:39559: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 153.127.193.71
country_id: 1861060
description:
Dec 13 17:20:20 host2 sshd[1685805]: Disconnected from invalid user sonar 153.127.193.71 port 46724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-13 17:20:34 dovecot_login authenticator failed for (static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:42488: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 17:21:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<FzWm/tNFurQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 17:21:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xKUS/9NFTsAv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 153.127.193.71
country_id: 1861060
description:
Dec 13 17:21:39 host2 sshd[1686451]: Disconnected from invalid user developer 153.127.193.71 port 58348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.146.202.174
country_id: 1643084
description:
Dec 13 17:21:43 host2 sshd[1686471]: Disconnected from invalid user valera 103.146.202.174 port 41396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 17:22:00 host2 sshd[1686642]: Disconnected from invalid user admin 2.57.121.112 port 25843 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 153.127.193.71
country_id: 1861060
description:
Dec 13 17:22:18 host2 sshd[1686816]: Disconnected from invalid user sunil 153.127.193.71 port 44586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 17:24:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ntOSCdRFBL+nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 17:24:56 dovecot_plain authenticator failed for (regged) [64.72.74.162]:57282: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-13 17:25:04 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:37140: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2025-12-13 17:25:20 dovecot_login authenticator failed for ([49.124.151.14]) [49.124.151.14]:42854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.100
country_id: 1643084
description:
Dec 13 17:25:41 host2 sshd[1688553]: Disconnected from invalid user arman 116.193.191.100 port 38958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-13 17:26:00 dovecot_login authenticator failed for (cm-84.213.189.183.get.no) [84.213.189.183]:32905: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.228.23.212
country_id: 6252001
description:
2025-12-13 17:26:08 dovecot_plain authenticator failed for ec2-34-228-23-212.compute-1.amazonaws.com (EC2AMAZ-RT2IK6U.ec2.internal) [34.228.23.212]:57394: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.228.23.212
country_id: 6252001
description:
2025-12-13 17:26:14 dovecot_login authenticator failed for ec2-34-228-23-212.compute-1.amazonaws.com (EC2AMAZ-RT2IK6U.ec2.internal) [34.228.23.212]:57394: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 17:26:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<ZuO/EdRFtsZntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 17:27:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<JUhVE9RFtrmB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2025-12-13 17:27:05 dovecot_login authenticator failed for ([182.79.86.54]) [182.79.86.54]:49716: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-13 17:27:18 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:53988: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 17:27:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<9+77FdRFRNXAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 17:28:38 host2 sshd[1690197]: Disconnected from invalid user tech 62.60.131.157 port 9211 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 17:29:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<+BO/HdRF2Li8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 17:30:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ZC+5H9RFkrU+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-13 17:32:03 dovecot_login authenticator failed for ([182.95.226.150]) [182.95.226.150]:54366: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-13 17:31:09 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:61600: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.254.153
country_id: 3469034
description:
2025-12-13 17:31:33 dovecot_login authenticator failed for ([45.173.254.224]) [45.173.254.153]:44434: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-13 17:32:20 dovecot_login authenticator failed for ([122.185.184.134]) [182.95.226.82]:52818: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 17:32:33 host2 sshd[1692689]: Disconnected from invalid user admin 2.57.121.112 port 36472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-13 17:33:15 dovecot_plain authenticator failed for (fershworks) [64.53.7.231]:45898: 535 Incorrect authentication data (set_id=dev@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.129.137
country_id: 290557
description:
2025-12-13 17:34:59 dovecot_plain authenticator failed for ([31.57.166.48]) [5.31.129.137]:15676: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.108.47
country_id: 99237
description:
2025-12-13 17:35:13 dovecot_plain authenticator failed for ([31.57.166.48]) [185.181.108.47]:20581: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 17:35:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<tHCKMtRFPEMvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2025-12-13 17:35:58 dovecot_login authenticator failed for ([49.124.153.35]) [49.124.153.35]:56312: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 17:36:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<FHMSNNRFTLtAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.96.199
country_id: 3996063
description:
Dec 13 17:37:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=138.122.96.199, lip=66.85.158.91, TLS, session=<9DLQN9RF9s+KemDH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.192
country_id: 3865483
description:
Dec 13 17:37:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.192, lip=66.85.158.91, TLS, session=<cyT+ONRFC5+zAPrA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-13 17:42:03 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (tramatermy) [73.199.161.144]:35650: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 17:43:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<DFcCTdRFEr/O7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 17:43:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<0cW8TdRFNo0+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 17:43:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<1ZiWT9RFGocuZXpm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.25.170
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.25.170 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.198.184.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.198.184.105 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.47.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.149.47.55 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.1.39.76
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 69.1.39.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.241.208.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.241.208.60 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.153.177.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.153.177.188 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.171.140.249
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 165.171.140.249 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-13 17:45:50 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [136.232.73.130]:39794: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 17:45:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<EQu8VNRF4Ip100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 17:45:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<4UIRVdRFZtE+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-13 17:45:34 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:59530: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 17:46:18 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (mells) [98.227.25.115]:48856: 535 Incorrect authentication data (set_id=dev@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 17:46:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<EsfYWNRF2JgI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 17:48:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Ubq2XtRFiLuB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 17:50:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<3lZ3ZdRFws6l6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.119.192
country_id: 1733045
description:
2025-12-13 17:50:37 dovecot_plain authenticator failed for ([31.57.166.48]) [60.51.119.192]:56024: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 17:50:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<DQ0oaNRFLumH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-13 17:50:58 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:48110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-13 17:51:02 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (disess) [73.161.96.107]:37998: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-13 17:50:32 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:35319: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.228.23.212
country_id: 6252001
description:
2025-12-13 17:50:20 dovecot_plain authenticator failed for ec2-34-228-23-212.compute-1.amazonaws.com (EC2AMAZ-RT2IK6U.ec2.internal) [34.228.23.212]:56458: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.42.170
country_id: 1821275
description:
2025-12-13 17:50:48 dovecot_login authenticator failed for ([125.31.42.170]) [125.31.42.170]:47142: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-13 17:50:53 dovecot_login authenticator failed for ([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 17:50:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<67P0aNRFhrOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-12-13 17:51:03 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:55460: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.78.244
country_id: 1527747
description:
2025-12-13 17:50:16 dovecot_plain authenticator failed for ([31.57.166.48]) [92.62.78.244]:25558: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.93
country_id: 3175395
description:
Dec 13 17:51:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.15.171.93, lip=66.85.158.91, TLS, session=<FPhgadRFvIC5D6td>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.171
country_id: 6290252
description:
Dec 13 17:51:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=109.207.35.171, lip=66.85.158.91, TLS, session=<cIqFatRFAuhtzyOr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.98.210
country_id: 3057568
description:
Dec 13 17:51:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=31.134.98.210, lip=66.85.158.91, TLS, session=<bSlcadRF1+cfhmLS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.45.162
country_id: 226074
description:
Dec 13 17:51:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=196.0.45.162, lip=66.85.158.91, TLS, session=<od5zadRFsIfEAC2i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-13 17:51:23 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:38752: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.146
country_id: 3865483
description:
Dec 13 17:51:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=45.238.106.146, lip=66.85.158.91, TLS, session=<14BxadRFadst7mqS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.116
country_id: 3865483
description:
Dec 13 17:51:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=190.11.195.116, lip=66.85.158.91, TLS, session=<lrN9atRFnte+C8N0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.97.24
country_id: 6290252
description:
Dec 13 17:51:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=109.206.97.24, lip=66.85.158.91, TLS, session=<tdO5atRF8Z1tzmEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.39
country_id: 798544
description:
Dec 13 17:51:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=91.228.32.39, lip=66.85.158.91, TLS, session=<z7nUatRFhc5b5CAn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.176.50
country_id: 1861060
description:
2025-12-13 17:52:17 dovecot_login authenticator failed for p388051-obmd01.tokyo.ocn.ne.jp [60.45.176.50]:40258: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-13 17:52:19 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.179]:57274: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-13 17:52:33 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:62299: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 17:52:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<crfWbtRFiuUro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.228.23.212
country_id: 6252001
description:
2025-12-13 17:53:09 dovecot_login authenticator failed for ec2-34-228-23-212.compute-1.amazonaws.com (EC2AMAZ-RT2IK6U.ec2.internal) [34.228.23.212]:56458: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.233
country_id: 3469034
description:
Dec 13 17:53:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.89.136.233, lip=66.85.158.91, TLS, session=<h3QBcNRFNM6+WYjp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.45.116.108
country_id: 3469034
description:
Dec 13 17:53:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=187.45.116.108, lip=66.85.158.91, TLS, session=<8cZOcdRFPMq7LXRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 17:54:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53213: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-12-13 17:56:46 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:49291: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-13 17:57:08 dovecot_login authenticator failed for ([46.212.35.53]) [46.212.35.53]:40157: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 17:58:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<PJNwgtRFKp1m1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-13 17:57:39 dovecot_login authenticator failed for ([122.184.136.185]) [182.95.181.22]:36652: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.177.247
country_id: 6252001
description:
Dec 13 17:57:54 host2 sshd[1712941]: Disconnected from invalid user user5 50.37.177.247 port 52558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-13 17:58:23 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:55153: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 17:59:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<NiZyiNRFyqakXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.177.247
country_id: 6252001
description:
Dec 13 18:00:20 host2 sshd[1714775]: Disconnected from invalid user huawei 50.37.177.247 port 57626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.19
country_id: 192950
description:
Dec 13 18:00:36 host2 sshd[1714888]: Disconnected from invalid user hpc 197.248.104.19 port 53524 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 18:00:38 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (barmic) [51.195.117.220]:16053: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.37.177.247
country_id: 6252001
description:
Dec 13 18:00:58 host2 sshd[1715156]: Disconnected from invalid user mytest 50.37.177.247 port 57532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.121.156
country_id: 99237
description:
2025-12-13 18:02:06 dovecot_plain authenticator failed for ([31.57.166.48]) [212.237.121.156]:51797: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 18:01:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<Ey+2jtRFwNpnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.177.247
country_id: 6252001
description:
Dec 13 18:01:33 host2 sshd[1715495]: Disconnected from invalid user ftptest 50.37.177.247 port 43274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Dec 13 18:01:42 host2 sshd[1715538]: Disconnected from invalid user dmdba 103.76.120.106 port 60680 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 18:01:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<MdTmj9RFFpHD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 18:02:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<+qhSkdRFoOkI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.55.168
country_id: 6252001
description:
Dec 13 18:02:43 host2 sshd[1716008]: Disconnected from invalid user alex 64.225.55.168 port 44076 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.47.28
country_id: 6252001
description:
[2025-12-13 18:02:49 +0530] info [cpaneld] 76.39.47.28 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.195.179
country_id: 6252001
description:
[2025-12-13 18:02:54 +0530] info [cpaneld] 47.151.195.179 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.0.202.119
country_id: 6252001
description:
[2025-12-13 18:02:53 +0530] info [cpaneld] 75.0.202.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.121.156
country_id: 99237
description:
2025-12-13 18:02:13 dovecot_login authenticator failed for ([31.57.166.48]) [212.237.121.156]:51797: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.248.230
country_id: 3895114
description:
2025-12-13 18:02:19 dovecot_plain authenticator failed for ([31.57.166.48]) [206.62.248.230]:44686: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.10.135.47
country_id: 6252001
description:
[2025-12-13 18:02:47 +0530] info [cpaneld] 172.10.135.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.132.161.109
country_id: 6252001
description:
[2025-12-13 18:02:55 +0530] info [cpaneld] 69.132.161.109 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.242.53.142
country_id: 3469034
description:
2025-12-13 18:02:32 dovecot_plain authenticator failed for ([31.57.166.48]) [191.242.53.142]:61585: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 18:02:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<4uArk9RF/KuWXx+e>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.118.179.67
country_id: 6252001
description:
[2025-12-13 18:02:48 +0530] info [cpaneld] 137.118.179.67 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.58.19.221
country_id: 6252001
description:
[2025-12-13 18:02:52 +0530] info [whostmgrd] 136.58.19.221 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.106
country_id: 1643084
description:
Dec 13 18:03:53 host2 sshd[1716985]: Disconnected from invalid user selenium 103.76.120.106 port 60772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.45
country_id: 798544
description:
Dec 13 18:03:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=89.231.35.45, lip=66.85.158.91, TLS, session=<aXciltRF0rhZ5yMt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 18:03:12 host2 sshd[1716673]: Disconnected from invalid user  62.60.131.157 port 9742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.182
country_id: 3175395
description:
Dec 13 18:03:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.15.171.182, lip=66.85.158.91, TLS, session=<OHYEldRF26e5D6u2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.55.168
country_id: 6252001
description:
Dec 13 18:04:30 host2 sshd[1717375]: Disconnected from invalid user mohamed 64.225.55.168 port 47144 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.55.168
country_id: 6252001
description:
Dec 13 18:05:40 host2 sshd[1718142]: Disconnected from invalid user postgres 64.225.55.168 port 55350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.245.184.172
country_id: 2264397
description:
Dec 13 18:05:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=195.245.184.172, lip=66.85.158.91, TLS, session=<4ljrnNRFLQrD9bis>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.42
country_id: 3865483
description:
Dec 13 18:06:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=186.64.71.42, lip=66.85.158.91, TLS, session=<w9cHntRFa6O6QEcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.19
country_id: 192950
description:
Dec 13 18:05:24 host2 sshd[1717989]: Disconnected from invalid user user 197.248.104.19 port 54170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Dec 13 18:06:50 host2 sshd[1718929]: Disconnected from invalid user edge 103.76.120.106 port 60878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-13 18:07:16 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:42666: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 18:07:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<cKV3o9RF5uK8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-13 18:07:29 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:46206: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-13 18:07:42 dovecot_login authenticator failed for ([220.246.47.169]) [84.211.19.12]:36685: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 18:07:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<3teTpdRFFrrD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-13 18:08:11 dovecot_login authenticator failed for ([103.249.19.34]) [45.194.26.149]:35975: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.176
country_id: 2635167
description:
Dec 13 18:09:05 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.176, lip=66.85.158.91, TLS, session=<RAriqdRFz9a594mw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.166
country_id: 2635167
description:
Dec 13 18:09:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.166, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<YBvtqdRF97G594mm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.164
country_id: 2635167
description:
Dec 13 18:09:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.164, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7p7oq9RFCeRX7LCk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.151
country_id: 2635167
description:
Dec 13 18:10:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.151, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<m/vmr9RF1Y6594mX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.162.240.149
country_id: 1269750
description:
2025-12-13 18:11:02 dovecot_login authenticator failed for (abts-north-dynamic-149.240.162.122.airtelbroadband.in) [122.162.240.149]:33316: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.161
country_id: 2635167
description:
Dec 13 18:10:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.161, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GNjjrdRF+bi594mh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.163
country_id: 2635167
description:
Dec 13 18:11:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.163, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rETisdRFw+1X7LCj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.179
country_id: 2635167
description:
Dec 13 18:11:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.179, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<y7/bs9RFK6hX7LCz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.70.109.225
country_id: 6252001
description:
[2025-12-13 18:12:04 +0530] info [cpaneld] 173.70.109.225 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.80.81.105
country_id: 6252001
description:
[2025-12-13 18:12:01 +0530] info [cpaneld] 173.80.81.105 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.18.83.242
country_id: 6252001
description:
[2025-12-13 18:12:04 +0530] info [cpaneld] 96.18.83.242 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.136
country_id: 1819730
description:
Dec 13 18:11:25 host2 sshd[1721652]: Disconnected from invalid user admin 152.32.129.136 port 22820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-13 18:11:29 dovecot_login authenticator failed for ([149.54.15.42]) [149.54.15.42]:33760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.65.174.1
country_id: 6252001
description:
[2025-12-13 18:11:58 +0530] info [cpaneld] 108.65.174.1 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.189.40
country_id: 6252001
description:
[2025-12-13 18:12:00 +0530] info [cpaneld] 172.59.189.40 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.168.208.16
country_id: 6252001
description:
[2025-12-13 18:12:03 +0530] info [cpaneld] 146.168.208.16 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 13 18:11:10 host2 sshd[1721411]: Disconnected from invalid user monitoring 209.141.33.240 port 57258 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.209.60.125
country_id: 6252001
description:
[2025-12-13 18:12:02 +0530] info [whostmgrd] 24.209.60.125 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 13 18:12:13 host2 sshd[1722041]: Disconnected from invalid user test01 209.141.33.240 port 36236 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.151
country_id: 2635167
description:
Dec 13 18:12:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.151, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<oBnZtdRFGbG594mX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.166
country_id: 2635167
description:
Dec 13 18:12:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.166, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<k1jWt9RF7YZX7LCm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.136
country_id: 1819730
description:
Dec 13 18:13:09 host2 sshd[1722501]: Disconnected from invalid user mohammad 152.32.129.136 port 32820 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.156
country_id: 2635167
description:
Dec 13 18:13:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<bdTNudRFI+W594mc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 13 18:13:49 host2 sshd[1722932]: Disconnected from invalid user sysadmin 209.141.33.240 port 37838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.169
country_id: 2635167
description:
Dec 13 18:14:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.169, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<8zvJu9RFuY+594mp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 13 18:14:20 host2 sshd[1723208]: Disconnected from invalid user dev 209.141.33.240 port 36280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 18:14:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Ny4WvdRFSq2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 18:15:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Elo3wdRFVIbCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Dec 13 18:15:50 host2 sshd[1724033]: Disconnected from invalid user ali 45.78.203.22 port 37622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.185.164.76
country_id: 2077456
description:
2025-12-13 18:15:57 dovecot_login authenticator failed for (cpe-101-185-164-76.wb06.wa.asp.telstra.net) [101.185.164.76]:33080: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-13 18:16:08 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:56848: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 18:15:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<x1Pdv9RFA6VetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-13 18:17:08 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:33742: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-12-13 18:16:43 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:47023: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-13 18:17:06 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:56456: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-13 18:17:22 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:50424: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.22
country_id: 1880251
description:
Dec 13 18:21:30 host2 sshd[1727291]: Disconnected from invalid user alex 45.78.203.22 port 59188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-12-13 18:21:51 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:34356: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 18:22:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Bhle29RFwIgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-13 18:22:29 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:58269: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-13 18:22:30 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:51244: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-12-13 18:22:37 dovecot_login authenticator failed for (2-55-68-141.orange.net.il) [2.55.68.141]:42958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-13 18:22:50 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:33963: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-13 18:23:10 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:40607: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 18:23:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<t9JY3NRFXLYIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 18:24:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<ZKhh4NRFytCB4gum>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.175.206.22
country_id: 1643084
description:
Dec 13 18:25:40 host2 sshd[1729681]: Disconnected from invalid user maman 103.175.206.22 port 60080 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 18:25:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=43.162.120.170, lip=66.85.158.92, session=<pL/Y5dRFCKwroniq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 18:25:51 host2 pure-ftpd[1729790]: (?@43.162.120.170) [INFO] New connection from 43.162.120.170


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.162.120.170
country_id: 6252001
description:
Dec 13 18:26:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=43.162.120.170, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<qSXv5tRFJN8roniq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 18:26:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<NOu16dRFTuvAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 18:27:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<3iuB69RF8Ow+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 18:28:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<7ped8NRFbMi8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 18:29:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<b/te8tRFXKYImxNM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.175.206.22
country_id: 1643084
description:
Dec 13 18:29:25 host2 sshd[1732371]: Disconnected from invalid user sam 103.175.206.22 port 42522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 13 18:30:45 host2 sshd[1733193]: Disconnected from invalid user webadmin 45.78.220.142 port 45330 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-13 18:30:47 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:41030: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-13 18:30:56 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:36124: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Dec 13 18:31:48 host2 sshd[1733746]: Disconnected from invalid user userftp 161.132.50.86 port 36318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:31:53 host2 sshd[1733793]: Disconnected from invalid user test-user 216.133.148.51 port 49420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-13 18:31:56 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:58534: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 13 18:32:04 host2 sshd[1733843]: Disconnected from invalid user nasrin 45.78.220.142 port 35520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.231.50
country_id: 1269750
description:
2025-12-13 18:32:18 dovecot_login authenticator failed for ([182.95.85.109]) [125.19.231.50]:49562: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.175.206.22
country_id: 1643084
description:
Dec 13 18:32:09 host2 sshd[1734013]: Disconnected from invalid user pavel 103.175.206.22 port 41304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Dec 13 18:33:55 host2 sshd[1734927]: Disconnected from invalid user leon 161.132.50.86 port 60666 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 18:34:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<FTahBdVFkPIvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.247.91
country_id: 241170
description:
Dec 13 18:34:32 host2 sshd[1735244]: Disconnected from invalid user server 156.245.247.91 port 57226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.50.86
country_id: 3932488
description:
Dec 13 18:34:33 host2 sshd[1735277]: Disconnected from invalid user ubuntu 161.132.50.86 port 53824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-13 18:35:42 dovecot_plain authenticator failed for (adder) [41.248.243.181]:52534: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 18:36:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Bl08CtVF/OhAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 18:36:17 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (spoty) [51.195.117.220]:19267: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 13 18:36:24 host2 sshd[1736471]: Disconnected from invalid user test 35.216.63.127 port 40404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:36:58 host2 sshd[1736769]: Disconnected from invalid user ubuntu 216.133.148.51 port 54536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-13 18:36:12 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:42831: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 18:36:38 host2 sshd[1736579]: Disconnected from invalid user admin 2.57.121.112 port 20809 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 18:36:51 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:36752: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-13 18:37:01 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:39609: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 13 18:37:47 host2 sshd[1737217]: Disconnected from invalid user weiqing 35.216.63.127 port 63256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:37:32 host2 sshd[1737092]: Disconnected from invalid user nasrin 216.133.148.51 port 48136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 18:37:40 host2 sshd[1737161]: Disconnected from invalid user  62.60.131.157 port 32576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-12-13 18:38:54 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:36115: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:39:14 host2 sshd[1738087]: Received disconnect from 216.133.148.51 port 40060:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-13 18:39:32 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:41503: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.51
country_id: 6252001
description:
Dec 13 18:40:23 host2 sshd[1738796]: Disconnected from invalid user webadmin 216.133.148.51 port 52438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 18:40:43 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (eprous) [51.195.117.220]:56431: 535 Incorrect authentication data (set_id=hostmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-13 18:41:57 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:50031: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-13 18:42:41 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:41089: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 18:42:56 host2 sshd[1740016]: Disconnected from invalid user user 2.57.121.25 port 35201 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-13 18:43:04 dovecot_login authenticator failed for ([192.252.214.22]) [182.95.115.70]:39002: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-13 18:42:20 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:62825: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-13 18:42:28 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:38714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 13 18:42:32 host2 sshd[1739822]: Disconnected from invalid user devuser 35.216.63.127 port 62628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 18:42:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<XAh1IdVFWOMuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 18:43:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<sos7JNVFGNPO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-12-13 18:43:35 dovecot_login authenticator failed for (111-70-49-182.emome-ip.hinet.net) [196.191.142.67]:52930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.96.124.174
country_id: 290557
description:
2025-12-13 18:43:34 dovecot_plain authenticator failed for bba-92-96-124-174.alshamil.net.ae ([31.57.166.48]) [92.96.124.174]:53612: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.55.152.112
country_id: 3469034
description:
2025-12-13 18:43:48 dovecot_plain authenticator failed for ([31.57.166.48]) [189.55.152.112]:7406: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.121.40.176
country_id: 3469034
description:
2025-12-13 18:44:02 dovecot_plain authenticator failed for ([31.57.166.48]) [168.121.40.176]:26193: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 13 18:44:14 host2 sshd[1740822]: Disconnected from invalid user denis 45.78.220.142 port 52494 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.135.131
country_id: 6252001
description:
Dec 13 18:44:32 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.91, session=<Fq2fKNVFsqBHBoeD>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.135.131
country_id: 6252001
description:
Dec 13 18:44:32 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.91, session=<dVeeKNVFPqBHBoeD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 18:44:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<nr41KdVFUcB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 18:45:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<4a3HK9VFjroI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 13 18:46:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<beqFL9VF+IbBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-13 18:48:01 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:14148: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.63
country_id: 3996063
description:
2025-12-13 18:47:31 dovecot_login authenticator failed for (189.219.138.63-clientes-izzi.mx) [189.219.138.63]:60097: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-13 18:47:52 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:47242: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-13 18:48:56 dovecot_login authenticator failed for ([102.38.3.109]) [102.38.3.109]:54680: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-13 18:48:34 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:54124: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-13 18:49:20 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:38302: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 18:51:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<BtnTP9VFetqB4kCN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 13 18:50:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS: Connection closed, session=<rW9aPdVF6kdChJlz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 18:51:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<sQAnQdVFHsCl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 18:51:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<vHCxQNVFMLAro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.208.184.2
country_id: 149590
description:
Dec 13 18:51:23 host2 sshd[1745260]: Disconnected from invalid user test-user 102.208.184.2 port 47868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 18:52:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<z1ywRdVFMsSG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-12-13 18:52:46 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:57017: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.248.139
country_id: 1562822
description:
Dec 13 18:53:44 host2 pure-ftpd[1746542]: (?@165.154.248.139) [INFO] New connection from 165.154.248.139


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.227.26
country_id: 1668284
description:
Dec 13 18:53:44 host2 pure-ftpd[1746540]: (?@165.154.227.26) [INFO] New connection from 165.154.227.26


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-13 18:53:17 dovecot_login authenticator failed for ([94.207.251.240]) [94.207.251.240]:35355: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 18:53:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<xZY8SNVFLqeH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 18:56:45 host2 sshd[1748610]: Disconnected from invalid user dev 154.221.17.42 port 42402 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 18:57:24 host2 sshd[1748977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.123
country_id: 6252001
description:
2025-12-13 18:58:18 dovecot_login authenticator failed for wsip-184-191-250-123.fv.ks.cox.net [184.191.250.123]:46175: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-13 18:58:31 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:41306: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Dec 13 18:59:56 host2 sshd[1750806]: Disconnected from invalid user rooter 133.117.74.174 port 46152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 19:00:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<2Qn2X9VFdI9npBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 19:00:40 host2 sshd[1751361]: Disconnected from invalid user ubuntu 154.221.17.42 port 39522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 19:00:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<X1oXYdVFCNqkXF7M>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 19:01:21 host2 sshd[1751782]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.243.161
country_id: 1733045
description:
2025-12-13 19:01:19 dovecot_plain authenticator failed for ([31.57.166.48]) [180.75.243.161]:36687: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 19:01:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<QnQ7ZtVFtKQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-13 19:02:40 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:51680: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-13 19:02:44 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:34270: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-13 19:03:12 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:49835: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-13 19:03:11 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:42656: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 19:03:46 host2 sshd[1753388]: Disconnected from invalid user book 154.221.17.42 port 33330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 19:04:29 host2 sshd[1753930]: Disconnected from invalid user wiki 154.221.17.42 port 45756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 19:05:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<4rMrctVF8KuWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Dec 13 19:05:54 host2 sshd[1754803]: Disconnected from invalid user alex 200.89.178.151 port 62754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.42
country_id: 1819730
description:
Dec 13 19:05:57 host2 sshd[1754828]: Disconnected from invalid user yxu 154.221.17.42 port 42268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.210.105
country_id: 6252001
description:
Dec 13 19:06:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.104.210.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Sjk1dtVFQaOsaNJp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.202
country_id: 6252001
description:
Dec 13 19:06:18 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.202, lip=66.85.158.91, TLS, session=<ynSCdtVFxnWs7OTK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Dec 13 19:06:23 host2 sshd[1755101]: Disconnected from invalid user virtualbox 133.117.74.174 port 56312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-13 19:07:52 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:39270: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.171
country_id: 1733045
description:
2025-12-13 19:07:51 dovecot_login authenticator failed for ([49.124.152.171]) [49.124.152.171]:51946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-13 19:08:04 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:46084: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 13 19:08:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XAdOfdVFxC/UZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-13 19:08:14 dovecot_login authenticator failed for (nsg-corporate-126.60.187.122.airtel.in) [122.187.60.126]:38088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 19:08:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<iievf9VFnp68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-13 19:08:56 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:50716: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-13 19:09:09 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:34210: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.89.178.151
country_id: 3865483
description:
Dec 13 19:09:15 host2 sshd[1757109]: Disconnected from invalid user alex 200.89.178.151 port 14542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Dec 13 19:09:25 host2 sshd[1757252]: Disconnected from invalid user alex 133.117.74.174 port 42046 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 19:09:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<o3ZKgtVFLOWnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.246.109.89
country_id: 798544
description:
2025-12-13 19:10:14 dovecot_plain authenticator failed for host-91-246-109-89.hypernet.biz.pl ([31.57.166.48]) [91.246.109.89]:33502: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.211.218.152
country_id: 6252001
description:
2025-12-13 19:10:25 dovecot_plain authenticator failed for c-73-211-218-152.hsd1.il.comcast.net ([31.57.166.48]) [73.211.218.152]:47028: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.200.176
country_id: 3437598
description:
2025-12-13 19:10:38 dovecot_plain authenticator failed for ([31.57.166.48]) [186.158.200.176]:48297: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-13 19:14:23 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:35656: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.222
country_id: 6252001
description:
2025-12-13 19:14:22 dovecot_login authenticator failed for wsip-184-191-242-222.fv.ks.cox.net [184.191.242.222]:50129: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-13 19:15:13 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:55655: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-13 19:15:44 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:56388: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-13 19:16:03 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:37183: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 19:16:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<4qOWm9VFyoM+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 19:16:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<TPAinNVFDChetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.12.84.15
country_id: 1269750
description:
Dec 13 19:20:18 host2 sshd[1765999]: Disconnected from invalid user avinash 61.12.84.15 port 55290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-13 19:22:18 dovecot_plain authenticator failed for (amathafte) [5.26.190.79]:34378: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.26.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.26.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 13 19:23:16 host2 sshd[1767952]: Disconnected from invalid user appuser 129.80.134.10 port 58556 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 61.12.84.15
country_id: 1269750
description:
Dec 13 19:23:47 host2 sshd[1768283]: Disconnected from invalid user alina 61.12.84.15 port 54628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-13 19:24:49 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:60450: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.12.84.15
country_id: 1269750
description:
Dec 13 19:24:30 host2 sshd[1768684]: Disconnected from invalid user dev 61.12.84.15 port 44100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 19:25:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<X3nWu9VFCrrAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 19:25:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<N7TPutVF8sAv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.158.102
country_id: 3017382
description:
Dec 13 19:27:06 host2 sshd[1770651]: Disconnected from invalid user admin1 51.77.158.102 port 42064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 13 19:26:36 host2 sshd[1770375]: Disconnected from invalid user administrator 129.80.134.10 port 52944 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-13 19:26:56 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (supty) [73.195.211.98]:39692: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-13 19:27:46 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:49764: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 19:28:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<mcI4xNVFwKjCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-13 19:28:07 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:38046: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-13 19:27:22 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:62910: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.158.102
country_id: 3017382
description:
Dec 13 19:27:38 host2 sshd[1770932]: Disconnected from invalid user sftptest 51.77.158.102 port 53926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec 13 19:28:18 host2 sshd[1771304]: Disconnected from invalid user wikijs 103.31.39.143 port 44660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-12-13 19:28:26 dovecot_login authenticator failed for ([188.126.240.80]) [188.126.240.80]:34680: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-13 19:28:40 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:37759: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 13 19:28:46 host2 sshd[1771670]: Disconnected from invalid user nabi 129.80.134.10 port 58970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 19:29:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<sxTfx9VFJJgIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 13 19:30:54 host2 sshd[1772955]: Disconnected from invalid user git 129.80.134.10 port 52204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 19:30:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<gsgQzNVFYI68pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.158.102
country_id: 3017382
description:
Dec 13 19:30:23 host2 sshd[1772680]: Disconnected from invalid user parham 51.77.158.102 port 53024 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.31.39.143
country_id: 1643084
description:
Dec 13 19:30:35 host2 sshd[1772788]: Disconnected from invalid user appadmin 103.31.39.143 port 34944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 19:31:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<G/3Lz9VFiu0+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 19:32:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<u+lA09VFqsI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-13 19:32:43 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:34891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-13 19:32:53 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:38452: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-13 19:33:01 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:42783: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-13 19:33:17 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:60470: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 19:34:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pP/F2tVFxNkvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.43
country_id: 1733045
description:
2025-12-13 19:34:25 dovecot_login authenticator failed for ([49.124.146.43]) [49.124.146.43]:59296: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.49
country_id: 798544
description:
Dec 13 19:37:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=89.231.35.49, lip=66.85.158.91, TLS, session=<7vFM5NVFQplZ5yMx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.110.58
country_id: 798544
description:
Dec 13 19:37:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.196.110.58, lip=66.85.158.91, TLS, session=<yll55dVFo6hbxG46>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 19:37:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<lLA559VFDs8ImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2025-12-13 19:38:35 dovecot_login authenticator failed for ([125.18.67.17]) [182.95.112.146]:48568: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-13 19:38:48 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:44592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-13 19:39:21 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:40797: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-13 19:39:39 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:44022: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 19:40:31 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (metana) [98.227.25.115]:44610: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Dec 13 19:40:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.91, session=<Ovrf8dVFgE1KUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 19:40:26 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (ploxillan) [51.195.117.220]:23002: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Dec 13 19:41:14 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.91, session=<rw1x89VF6AlKUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-13 19:41:35 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:36796: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-13 19:42:01 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:46950: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.33.80
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 143.244.33.80 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-13 19:43:29 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:59046: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 19:43:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+ylH/NVFPZR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-12-13 19:43:54 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:38836: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-13 19:44:01 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (boromblen) [73.213.237.28]:45688: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 19:44:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<zlkC/tVFPu7O7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 19:44:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<iRwyANZFrJgI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-13 19:49:23 dovecot_login authenticator failed for (nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:36960: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-12-13 19:49:37 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:36907: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.126.26
country_id: 3865483
description:
2025-12-13 19:50:06 dovecot_plain authenticator failed for ([31.57.166.48]) [170.233.126.26]:53729: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.255.121.2
country_id: 3469034
description:
2025-12-13 19:50:18 dovecot_plain authenticator failed for ([31.57.166.48]) [143.255.121.2]:59273: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 19:50:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<eBLhE9ZFTMsro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.28.199.9
country_id: 2635167
description:
2025-12-13 19:50:30 dovecot_plain authenticator failed for cpc102022-bagu16-2-0-cust776.1-3.cable.virginm.net ([31.57.166.48]) [86.28.199.9]:37586: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 19:52:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<8qJLHNZFWOyl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-13 19:53:02 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:33062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 19:53:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<7THOHdZFRsCG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.100
country_id: 3469034
description:
Dec 13 19:54:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=179.189.201.100, lip=66.85.158.91, TLS, session=<FrYKINZFprSzvclk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 19:53:33 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (detic) [98.227.25.115]:50958: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-12-13 19:53:32 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:57904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.5.108.126
country_id: 2186224
description:
Dec 13 19:53:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.5.108.126, lip=66.85.158.91, TLS, session=<HDyPHtZF/LxnBWx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 19:54:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<wjXVItZFLMKB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.42.26.27
country_id: 3469034
description:
Dec 13 19:55:46 host2 sshd[1792720]: Disconnected from invalid user water 201.42.26.27 port 46618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-13 19:56:48 dovecot_plain authenticator failed for (undillike) [92.62.243.175]:35558: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 13 19:57:43 host2 sshd[1794995]: Disconnected from invalid user oracle 103.136.200.241 port 44372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.147.178
country_id: 2750405
description:
Dec 13 19:57:53 host2 sshd[1795354]: Disconnected from invalid user dbadmin 51.158.147.178 port 43856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-13 19:57:57 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:39328: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2025-12-13 19:58:04 dovecot_login authenticator failed for ([49.124.153.15]) [49.124.153.15]:36170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-13 19:58:12 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:38472: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.75.185.190
country_id: 6252001
description:
2025-12-13 19:59:10 dovecot_login authenticator failed for (149-75-185-190.s445.c3-0.elg-e6k1.nape.il.cable.rcncustomer.com) [149.75.185.190]:60142: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-13 19:58:26 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:53544: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 13 19:58:27 host2 sshd[1796166]: Disconnected from invalid user clouduser 103.136.200.241 port 36898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 19:58:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<dUFUMdZF/tZnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 19:58:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=</dwcMtZF5s6H6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.108.138
country_id: 1269750
description:
2025-12-13 19:59:25 dovecot_login authenticator failed for ([182.76.36.105]) [182.78.108.138]:58252: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 13 20:00:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<r33UNtZF1rcjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.147.178
country_id: 2750405
description:
Dec 13 20:00:16 host2 sshd[1798461]: Disconnected from invalid user oracle 51.158.147.178 port 33528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 20:00:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<+MrKONZFeOYI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 20:01:19 host2 sshd[1799571]: Disconnected from invalid user admin 2.57.121.112 port 10538 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 13 20:02:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<cPquPdZF0uhChJl8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.147.178
country_id: 2750405
description:
Dec 13 20:02:46 host2 sshd[1801345]: Disconnected from invalid user steam 51.158.147.178 port 44608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.42.26.27
country_id: 3469034
description:
Dec 13 20:02:58 host2 sshd[1801584]: Disconnected from invalid user svxlink 201.42.26.27 port 36702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 13 20:02:44 host2 sshd[1801285]: Disconnected from invalid user admin 103.136.200.241 port 33682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-13 20:03:58 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:50288: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.147.178
country_id: 2750405
description:
Dec 13 20:03:21 host2 sshd[1802443]: Disconnected from invalid user aditya 51.158.147.178 port 47748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-13 20:04:50 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:34962: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.5
country_id: 294640
description:
2025-12-13 20:04:17 dovecot_login authenticator failed for ([46.210.95.5]) [46.210.95.5]:60843: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.247.150
country_id: 933860
description:
Dec 13 20:04:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=41.76.247.150, lip=66.85.158.91, TLS, session=<zsgnRdZFAMApTPeW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-13 20:04:28 dovecot_login authenticator failed for host-148-170-156-248.public.eastlink.ca [148.170.156.248]:53986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.23.201
country_id: 798544
description:
Dec 13 20:04:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=80.82.23.201, lip=66.85.158.91, TLS, session=<aVBrRtZFyrFQUhfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.42.26.27
country_id: 3469034
description:
Dec 13 20:06:26 host2 sshd[1805646]: Disconnected from invalid user dev1 201.42.26.27 port 38420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.0.148.241
country_id: 1269750
description:
Dec 13 20:06:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=202.0.148.241, lip=66.85.158.91, TLS, session=<uNBwTdZFpM/KAJTx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.65
country_id: 798544
description:
Dec 13 20:07:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=46.20.58.65, lip=66.85.158.91, TLS, session=<b0vITtZF3sMuFDpB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 20:07:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<efxZUtZFFIKWXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.42.26.27
country_id: 3469034
description:
Dec 13 20:08:15 host2 sshd[1807478]: Disconnected from invalid user foundry 201.42.26.27 port 54166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 20:08:50 host2 sshd[1808153]: Disconnected from invalid user user 2.57.121.25 port 11315 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 20:09:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Z/BdWdZFeNK8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.78.197.236
country_id: 3658394
description:
2025-12-13 20:09:49 dovecot_plain authenticator failed for ([31.57.166.48]) [181.78.197.236]:47329: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-13 20:10:00 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (mangosess) [188.219.104.210]:35699: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.4
country_id: 6252001
description:
Dec 13 20:10:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.4, lip=66.85.158.92, TLS, session=<g1fnWtZFpN9C5DUE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.62.149.171
country_id: 3469034
description:
2025-12-13 20:09:24 dovecot_plain authenticator failed for ([31.57.166.48]) [187.62.149.171]:40464: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.53.187
country_id: 3469034
description:
2025-12-13 20:09:37 dovecot_plain authenticator failed for ip-53-187.zaptche.com.br ([31.57.166.48]) [177.22.53.187]:42502: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 13 20:10:37 host2 sshd[1810065]: Disconnected from invalid user ubuntu 70.54.182.130 port 38020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:11:35 host2 sshd[1810970]: Disconnected from invalid user dspace 179.40.112.10 port 39070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.115
country_id: 3469034
description:
Dec 13 20:12:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<awanish@maximsholdings.com>, method=PLAIN, rip=187.120.72.115, lip=66.85.158.91, TLS, session=<DZpgYNZFuIu7eEhz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-13 20:12:11 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (hentellflo) [73.224.171.101]:60340: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-13 20:13:10 dovecot_login authenticator failed for (221-169-97-62.cust.smartcall.no) [62.97.169.221]:51645: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.54
country_id: 3469034
description:
Dec 13 20:12:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<awanish>, method=PLAIN, rip=177.44.71.54, lip=66.85.158.91, TLS, session=<sWuSYdZFAcSxLEc2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Dec 13 20:12:40 host2 sshd[1812087]: Disconnected from invalid user leandro 172.208.48.177 port 43388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 20:12:52 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (preforath) [73.197.236.163]:33196: 535 Incorrect authentication data (set_id=jobs@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:12:58 host2 sshd[1812375]: Disconnected from invalid user ubuntu 179.40.112.10 port 58258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.173.59.73
country_id: 1605651
description:
2025-12-13 20:14:06 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.173.59.73]:46512: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 20:13:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<yfJaZtZFuLk+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.35
country_id: 6252001
description:
2025-12-13 20:13:23 dovecot_login authenticator failed for ([98.181.46.35]) [98.181.46.35]:47654: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:13:53 host2 sshd[1813421]: Disconnected from invalid user admin 179.40.112.10 port 44148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-13 20:15:21 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:48252: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-13 20:15:28 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:35089: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.11.122.162
country_id: 6252001
description:
2025-12-13 20:15:58 dovecot_plain authenticator failed for c-24-11-122-162.hsd1.ut.comcast.net ([31.57.166.48]) [24.11.122.162]:52733: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.48.80.11
country_id: 3865483
description:
2025-12-13 20:16:10 dovecot_plain authenticator failed for ([31.57.166.48]) [190.48.80.11]:58878: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.48.80.11
country_id: 3865483
description:
2025-12-13 20:16:17 dovecot_login authenticator failed for ([31.57.166.48]) [190.48.80.11]:58878: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Dec 13 20:16:18 host2 sshd[1816081]: Disconnected from invalid user david 172.208.48.177 port 52960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:16:31 host2 sshd[1816234]: Disconnected from invalid user unifi 179.40.112.10 port 58288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-13 20:17:04 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (guele) [51.195.117.220]:22446: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 13 20:17:15 host2 sshd[1816968]: Disconnected from invalid user ahmad 189.112.0.11 port 47056 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 13 20:17:19 host2 sshd[1817063]: Disconnected from invalid user dino 179.40.112.10 port 44170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-13 20:17:36 dovecot_login authenticator failed for (128.102.88.80.sta.ac-net.se) [80.88.102.128]:60842: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Dec 13 20:17:36 host2 sshd[1817311]: Disconnected from invalid user dino 172.208.48.177 port 33206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 13 20:19:06 host2 sshd[1818538]: Disconnected from invalid user john 189.112.0.11 port 43172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-13 20:18:23 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:47287: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 20:18:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<leVIedZFiDpetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 13 20:19:48 host2 sshd[1819219]: Disconnected from invalid user lin 189.112.0.11 port 55200 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.203
country_id: 6252001
description:
Dec 13 20:19:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=147.185.133.203, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<rMqHfdZFT9iTuYXL>


