# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-14 00:10:08 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:58736: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.177
country_id: 6252001
description:
Dec 14 00:10:27 host2 pure-ftpd[2009646]: (?@91.230.168.177) [INFO] New connection from 91.230.168.177


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.178
country_id: 6252001
description:
Dec 14 00:10:27 host2 pure-ftpd[2009644]: (?@91.230.168.178) [INFO] New connection from 91.230.168.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-14 00:09:51 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:51314: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.101
country_id: 798544
description:
Dec 14 00:10:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=91.246.213.101, lip=66.85.158.91, TLS, session=<vpS0s9lF6ctb9tVl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.70
country_id: 1269750
description:
2025-12-14 00:12:20 dovecot_login authenticator failed for (nsg-corporate-70.116.187.122.airtel.in) [122.187.116.70]:47486: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-12-14 00:12:59 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:40547: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.20.193
country_id: 290557
description:
2025-12-14 00:13:04 dovecot_login authenticator failed for ([94.207.20.193]) [94.207.20.193]:47035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-14 00:13:28 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:37870: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 14 00:12:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<BED6vtlF6NwImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-14 00:15:03 dovecot_plain authenticator failed for (outing) [192.34.128.202]:58162: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-12-14 00:15:39 +0530] info [webmaild] 178.16.55.198 - env_eng@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 14 00:20:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<E+SR2NlF5t/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-14 00:23:44 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:50730: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-14 00:23:03 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:55248: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2025-12-14 00:23:33 dovecot_login authenticator failed for pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:64666: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 00:25:19 host2 sshd[2019356]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-14 00:26:01 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:48585: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-14 00:26:16 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:41202: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 00:29:13 host2 sshd[2022437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-14 00:29:03 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:60378: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-14 00:29:57 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:52356: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-14 00:30:30 dovecot_plain authenticator failed for (norher) [65.20.164.137]:60970: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-14 00:30:33 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (diabizoaed) [71.224.169.28]:41574: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-14 00:30:46 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:48100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-14 00:31:14 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:50811: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-14 00:31:29 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [136.232.73.130]:41318: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-14 00:31:44 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:32963: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.162
country_id: 1733045
description:
2025-12-14 00:32:19 dovecot_login authenticator failed for ([49.124.154.162]) [49.124.154.162]:36950: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-14 00:32:55 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:61332: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 14 00:33:32 host2 pure-ftpd[2025175]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 14 00:33:39 host2 pure-ftpd[2025250]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.223
country_id: 3017382
description:
Dec 14 00:34:21 host2 pure-ftpd[2025585]: (?@91.196.152.223) [INFO] New connection from 91.196.152.223


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.216
country_id: 3017382
description:
Dec 14 00:34:21 host2 pure-ftpd[2025589]: (?@91.196.152.216) [INFO] New connection from 91.196.152.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-14 00:35:13 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:35815: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-14 00:35:40 dovecot_login authenticator failed for ([84.211.13.171]) [84.211.13.171]:34417: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-14 00:36:30 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:60545: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-14 00:36:50 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12135: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-14 00:37:57 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:42858: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-14 00:38:30 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:42258: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-14 00:39:00 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:53072: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Dec 14 00:39:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, session=<tnFTHdpFqpe4aYtF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 00:39:36 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (nuntip) [51.195.117.220]:59207: 535 Incorrect authentication data (set_id=root@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.85.44.247
country_id: 6252001
description:
2025-12-14 00:40:33 dovecot_plain authenticator failed for (mutan) [73.85.44.247]:49754: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-14 00:40:46 dovecot_plain authenticator failed for (renna) [102.53.15.18]:43149: 535 Incorrect authentication data (set_id=root@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 00:42:53 host2 sshd[2030688]: Disconnected from invalid user admin 2.57.121.112 port 11953 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-12-14 00:42:56 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (eacheawks) [95.229.5.248]:42920: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 00:44:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6WNGLtpFKJw+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 00:45:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<P0niNNpFYtKB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-12-14 00:46:33 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:45023: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-14 00:46:47 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:54875: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 00:46:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<mSulONpFWKanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-14 00:48:54 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (intils) [24.127.53.61]:50816: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-14 00:50:16 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:43967: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-14 00:50:28 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:41060: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.29.19
country_id: 933860
description:
Dec 14 00:54:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=83.143.29.19, lip=66.85.158.91, TLS, session=<S9+OUdpFjsJTjx0T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.36
country_id: 798544
description:
Dec 14 00:54:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=91.228.33.36, lip=66.85.158.91, TLS, session=<c6jPUtpFvdVb5CEk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-14 00:56:31 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:44392: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-14 00:56:49 dovecot_login authenticator failed for (201.173.250.36-clientes-izzi.mx) [201.173.250.36]:42075: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.137.70
country_id: 99237
description:
Dec 14 00:58:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=65.20.137.70, lip=66.85.158.91, TLS, session=<Kw8/YtpF9ZBBFIlG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.121.161
country_id: 3865483
description:
Dec 14 00:59:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info>, method=PLAIN, rip=190.181.121.161, lip=66.85.158.91, TLS, session=<GdyCY9pFuZ2+tXmh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-14 01:00:50 dovecot_login authenticator failed for (cm-84.211.11.216.get.no) [84.211.11.216]:39366: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-12-14 01:02:14 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:56194: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-14 01:01:51 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:47584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-14 01:05:07 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:45212: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-14 01:04:46 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:54144: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 01:04:58 host2 sshd[2047489]: Disconnected from invalid user user 2.57.121.25 port 9741 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-14 01:05:39 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:48379: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-14 01:05:55 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:34935: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-14 01:10:54 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:34706: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-14 01:10:58 +0530] info [cpaneld] 197.147.233.193 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-14 01:10:51 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (unbowdous) [73.183.74.177]:48706: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-14 01:15:05 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:38018: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-14 01:15:16 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:55225: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-14 01:19:43 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:55798: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-14 01:20:02 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:38550: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2025-12-14 01:20:26 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:53144: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-14 01:20:41 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:53818: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-14 01:20:59 dovecot_login authenticator failed for (nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:56016: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-14 01:21:21 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:57588: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.145.27
country_id: 290557
description:
2025-12-14 01:21:22 dovecot_login authenticator failed for ([91.74.145.27]) [91.74.145.27]:42674: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.238.221.65
country_id: 3996063
description:
2025-12-14 01:21:37 dovecot_login authenticator failed for ([177.238.221.65]) [177.238.221.65]:48364: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:22:55 host2 sshd[2059834]: Disconnected from invalid user pc 202.184.134.84 port 47312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-14 01:25:22 dovecot_plain authenticator failed for (azizedly) [91.72.153.110]:36809: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:24:43 host2 sshd[2060849]: Disconnected from invalid user appuser 49.49.231.208 port 36174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-14 01:25:11 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:60344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-14 01:25:38 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:53070: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-14 01:26:14 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:37396: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-14 01:25:28 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:10805: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:26:34 host2 sshd[2062130]: Disconnected from invalid user jorge 202.184.134.84 port 50954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:26:56 host2 sshd[2062387]: Disconnected from invalid user zenith 49.49.231.208 port 54158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-14 01:27:01 dovecot_login authenticator failed for (80.130.83.103.static.rapidnet.in) [103.83.130.80]:35257: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:27:17 host2 sshd[2062587]: Disconnected from invalid user ts3 202.184.134.84 port 46650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:28:22 host2 sshd[2063236]: Disconnected from invalid user runner 49.49.231.208 port 50516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.178
country_id: 1643084
description:
Dec 14 01:28:45 host2 sshd[2063466]: Disconnected from invalid user testuser 103.250.11.178 port 49342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:29:39 host2 sshd[2064040]: Disconnected from invalid user dimas 49.49.231.208 port 34022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:31:29 host2 sshd[2065529]: Disconnected from invalid user rfas 202.184.134.84 port 50866 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.11.178
country_id: 1643084
description:
Dec 14 01:30:39 host2 sshd[2065028]: Disconnected from invalid user user002 103.250.11.178 port 33558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 14 01:30:55 host2 sshd[2065168]: Disconnected from invalid user ubuntu 49.49.231.208 port 38616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:31:19 host2 sshd[2065449]: Disconnected from invalid user francesco 165.154.200.14 port 42210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-14 01:32:23 dovecot_plain authenticator failed for (manatalize) [105.114.21.51]:51947: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 14 01:33:16 host2 sshd[2066594]: Disconnected from invalid user jenkins 103.117.56.152 port 51438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-14 01:33:37 dovecot_plain authenticator failed for (uithmon) [105.114.21.51]:55394: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-14 01:33:40 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (huthea) [73.0.235.30]:35248: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 14 01:33:51 host2 sshd[2066920]: Disconnected from invalid user francesco 158.174.210.161 port 18730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-14 01:34:00 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (poredis) [73.197.194.98]:43610: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec 14 01:35:04 host2 sshd[2067782]: Disconnected from invalid user itadmin 202.184.134.84 port 42774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-14 01:35:19 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:36346: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2025-12-14 01:35:48 dovecot_login authenticator failed for (nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:45755: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 14 01:35:57 host2 sshd[2068509]: Disconnected from invalid user jack 158.174.210.161 port 37063 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 14 01:36:34 host2 sshd[2068956]: Disconnected from invalid user yzh 158.174.210.161 port 18342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 14 01:37:45 host2 sshd[2069712]: Disconnected from invalid user admin 158.174.210.161 port 8271 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 14 01:38:16 host2 sshd[2070045]: Disconnected from invalid user monika 103.117.56.152 port 51914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 14 01:39:10 host2 sshd[2070610]: Disconnected from invalid user tpaterni 103.117.56.152 port 41338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 14 01:39:40 host2 sshd[2070883]: Disconnected from invalid user vyos 45.78.224.217 port 35566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-14 01:39:44 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:51951: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
country_id: 1819730
description:
2025-12-14 01:39:33 dovecot_login authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:59265: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 14 01:40:29 host2 sshd[2071652]: Disconnected from invalid user administrator 103.117.56.152 port 35012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-12-14 01:40:33 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:60032: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-14 01:40:57 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:49557: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.200.197
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.202.200.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-14 01:44:16 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:60548: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-14 01:43:40 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:40771: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-14 01:43:56 dovecot_login authenticator failed for ([182.95.58.130]) [182.95.58.130]:57740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.78
country_id: 2542007
description:
2025-12-14 01:43:59 dovecot_login authenticator failed for ([105.73.190.78]) [105.73.190.78]:49819: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:45:04 host2 sshd[2074990]: Disconnected from invalid user jack 165.154.200.14 port 57298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 01:45:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<CgiTCNtFULo+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 01:45:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=</AhPCdtFzr2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2025-12-14 01:45:22 dovecot_login authenticator failed for (2-55-126-88.orange.net.il) [2.55.126.88]:49837: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:45:52 host2 sshd[2075743]: Disconnected from invalid user userftp 165.154.200.14 port 41312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.227
country_id: 3469034
description:
Dec 14 01:45:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=187.120.73.227, lip=66.85.158.91, TLS, session=<yaRpCttF7sK7eEnj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-14 01:46:01 dovecot_login authenticator failed for (cm-84.213.188.130.get.no) [84.213.188.130]:56461: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.141
country_id: 3175395
description:
Dec 14 01:45:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.63.132.141, lip=66.85.158.91, TLS, session=<V9pCCdtFW9K5P4SN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-14 01:45:50 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:37029: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:47:26 host2 sshd[2076824]: Disconnected from invalid user sonarr 83.229.122.23 port 48418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-14 01:47:01 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (anted) [37.150.8.174]:44476: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:47:23 host2 sshd[2076707]: Disconnected from invalid user yzh 165.154.200.14 port 47888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-14 01:48:57 dovecot_plain authenticator failed for (noidic) [5.11.143.72]:49986: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 01:49:08 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (noncruct) [174.166.153.20]:59508: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:48:28 host2 sshd[2077746]: Disconnected from invalid user proxyuser 36.255.66.28 port 55344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 14 01:48:53 host2 sshd[2078070]: Disconnected from invalid user ubuntu 165.154.200.14 port 39374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-14 01:50:02 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:40611: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-14 01:49:44 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:40044: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 14 01:49:48 host2 sshd[2078912]: Disconnected from invalid user admin 45.78.224.217 port 41188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:49:53 host2 sshd[2078977]: Disconnected from invalid user es_user 83.229.122.23 port 59492 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-12-14 01:50:34 1vUW6U-00000008j5N-0Er6 <= wordpress@venee.lk U=veneelk P=local S=36240 id=8dG1b2Qbq5zBsJRE4h0dBQEUDSUwKnynDIyyyngE@coatrent.venee.lk T="Failed login by IP 139.59.224.138 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:51:05 host2 sshd[2080418]: Disconnected from invalid user wp 83.229.122.23 port 56412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-14 01:50:44 dovecot_login authenticator failed for (cm-84.215.110.96.get.no) [84.215.110.96]:33172: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-14 01:51:06 dovecot_login authenticator failed for (nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:54320: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:51:39 host2 sshd[2080882]: Disconnected from invalid user www-data 83.229.122.23 port 51922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 14 01:51:44 host2 sshd[2080961]: Disconnected from invalid user www-data 198.245.55.32 port 40616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:51:49 host2 sshd[2081020]: Disconnected from invalid user rajesh 36.255.66.28 port 42810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.202
country_id: 1643084
description:
Dec 14 01:53:12 host2 sshd[2082193]: Disconnected from invalid user webadmin 103.67.78.202 port 52016 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 14 01:53:22 host2 sshd[2082281]: Disconnected from invalid user bpadmin 198.245.55.32 port 39428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 01:52:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<WmfDI9tFSIE+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 14 01:52:49 host2 sshd[2081893]: Disconnected from invalid user ubuntu 198.245.55.32 port 43410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.202
country_id: 1643084
description:
Dec 14 01:53:54 host2 sshd[2082580]: Disconnected from invalid user afa 103.67.78.202 port 53522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.213
country_id: 6252001
description:
Dec 14 01:53:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=198.235.24.213, lip=66.85.158.91, TLS, session=<YERUKNtFiPzG6xjV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 01:54:25 host2 sshd[2083211]: Disconnected from invalid user admin 2.57.121.112 port 22841 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 14 01:53:30 host2 sshd[2082330]: Disconnected from invalid user rajesh 83.229.122.23 port 40418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 14 01:53:35 host2 sshd[2082366]: Disconnected from invalid user ftpuser 45.78.224.217 port 40624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:53:41 host2 sshd[2082468]: Disconnected from invalid user admin 36.255.66.28 port 45766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 14 01:53:52 host2 sshd[2082571]: Disconnected from invalid user mailtest 198.245.55.32 port 38408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:54:54 host2 sshd[2083517]: Disconnected from invalid user bpadmin 36.255.66.28 port 54750 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 14 01:55:27 host2 sshd[2083933]: Disconnected from invalid user mailtest 36.255.66.28 port 34148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.202
country_id: 1643084
description:
Dec 14 01:55:44 host2 sshd[2084149]: Disconnected from invalid user ceshi 103.67.78.202 port 35636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.202
country_id: 1643084
description:
Dec 14 01:57:31 host2 sshd[2085274]: Disconnected from invalid user admin 103.67.78.202 port 52098 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.83
country_id: 6252001
description:
Dec 14 01:58:48 host2 pure-ftpd[2086121]: (?@198.235.24.83) [INFO] New connection from 198.235.24.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-14 01:59:52 dovecot_login authenticator failed for ([182.95.182.130]) [182.95.182.130]:38358: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-14 02:00:08 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:45237: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-14 02:02:23 dovecot_plain authenticator failed for (overs) [102.53.15.17]:48171: 535 Incorrect authentication data (set_id=service@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-14 02:01:41 dovecot_plain authenticator failed for (urgoiddle) [5.11.140.219]:37282: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 14 02:03:15 host2 sshd[2089293]: Disconnected from invalid user abcd 165.154.97.28 port 35820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-14 02:03:48 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:36656: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-14 02:04:03 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:50466: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.226
country_id: 192950
description:
Dec 14 02:04:21 host2 sshd[2090305]: Disconnected from invalid user me 102.220.23.226 port 38214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Dec 14 02:03:43 host2 sshd[2089839]: Disconnected from invalid user git 187.174.238.116 port 42136 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.174.238.116
country_id: 3996063
description:
Dec 14 02:04:52 host2 sshd[2090650]: Disconnected from invalid user lisi 187.174.238.116 port 38480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 02:04:28 host2 sshd[2090385]: Disconnected from invalid user admin 2.57.121.112 port 22455 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 14 02:06:30 host2 sshd[2092147]: Disconnected from invalid user admin 182.93.7.194 port 62034 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.48
country_id: 6252001
description:
Dec 14 02:07:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.48, lip=66.85.158.91, TLS, session=<tJ8AV9tFdPKTuYQw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.234
country_id: 6252001
description:
Dec 14 02:07:25 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.234, lip=66.85.158.91, TLS, session=<oMp9WNtFeodHBobq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.226
country_id: 192950
description:
Dec 14 02:07:49 host2 sshd[2093472]: Disconnected from invalid user vpn 102.220.23.226 port 51328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Dec 14 02:07:58 host2 sshd[2093610]: Disconnected from invalid user student 78.187.21.105 port 46538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-14 02:08:27 dovecot_login authenticator failed for 94-255-255-26.cust.bredband2.com [94.255.255.26]:34612: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.226
country_id: 192950
description:
Dec 14 02:08:28 host2 sshd[2094080]: Disconnected from invalid user tunnel 102.220.23.226 port 37012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 14 02:08:54 host2 sshd[2094616]: Disconnected from invalid user zjh 182.93.7.194 port 42960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec 14 02:09:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Ty0xX9tFVNaTuYRC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-12-14 02:08:30 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:42454: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-14 02:08:38 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:37757: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-12-14 02:08:51 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:56069: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Dec 14 02:09:33 host2 sshd[2095286]: Disconnected from invalid user slurm 78.187.21.105 port 58238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-14 02:09:36 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:62613: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-14 02:09:49 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:55991: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-12-14 02:10:59 1vUWQF-00000008nTd-0BTI <= wordpress@venee.lk U=veneelk P=local S=36243 id=zIEs8pHzTmUsbRIjGRwZycW3kfnjjWLfLqppsg50s@coatrent.venee.lk T="Failed login by IP 139.59.224.138 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-14 02:10:33 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:35340: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 14 02:10:46 host2 sshd[2096631]: Disconnected from invalid user gitlab-runner 165.154.97.28 port 48844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.187.21.105
country_id: 298795
description:
Dec 14 02:11:11 host2 sshd[2097045]: Disconnected from invalid user zjh 78.187.21.105 port 38448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-14 02:11:15 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:48278: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 14 02:11:24 host2 sshd[2097229]: Disconnected from invalid user s3 182.93.7.194 port 44196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 14 02:11:45 host2 sshd[2097526]: Disconnected from invalid user deposito 165.154.97.28 port 48308 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 78.187.21.105
country_id: 298795
description:
Dec 14 02:11:46 host2 sshd[2097535]: Received disconnect from 78.187.21.105 port 42820:11: Bye Bye [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 02:12:39 host2 sshd[2098394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.22
country_id: 6252001
description:
2025-12-14 02:14:14 dovecot_login authenticator failed for ([98.181.44.22]) [98.181.44.22]:60672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-14 02:14:57 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:55106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-12-14 02:15:07 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:35416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 14 02:15:36 host2 sshd[2100436]: Disconnected from invalid user test 165.154.97.28 port 49786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.20
country_id: 1733045
description:
2025-12-14 02:15:52 dovecot_login authenticator failed for ([49.124.151.20]) [49.124.151.20]:44952: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 02:16:30 host2 sshd[2100883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:17:12 host2 sshd[2101233]: Disconnected from invalid user wanda 107.174.67.188 port 54204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 14 02:19:06 host2 sshd[2102255]: Disconnected from invalid user tunnel 182.93.7.194 port 46114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:19:13 host2 sshd[2102313]: Disconnected from invalid user email 107.174.67.188 port 47220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 14 02:18:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<i+5hgdtFls9og7HN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 14 02:20:21 host2 sshd[2103100]: Disconnected from invalid user dockeradmin 43.245.97.82 port 54790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:21:11 host2 sshd[2103581]: Disconnected from invalid user git2 107.174.67.188 port 36294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:22:11 host2 sshd[2104140]: Disconnected from invalid user mike 107.174.67.188 port 32964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.188
country_id: 6252001
description:
Dec 14 02:24:13 host2 sshd[2105436]: Disconnected from invalid user sammy 107.174.67.188 port 59274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-14 02:24:20 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:50398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Dec 14 02:24:25 host2 sshd[2105533]: Disconnected from invalid user jenkins 202.8.127.134 port 47266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 14 02:23:53 host2 sshd[2105127]: Disconnected from invalid user zhangbin 43.245.97.82 port 60926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 14 02:24:29 host2 sshd[2105555]: Disconnected from invalid user bank 43.245.97.82 port 44826 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.81.42
country_id: 2542007
description:
2025-12-14 02:24:54 dovecot_login authenticator failed for ([105.73.81.42]) [105.73.81.42]:52303: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 14 02:25:39 host2 sshd[2106398]: Disconnected from invalid user dima 43.245.97.82 port 40874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Dec 14 02:26:06 host2 sshd[2106644]: Disconnected from invalid user user 202.8.127.134 port 46624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-14 02:26:11 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (solosin) [174.58.87.108]:55578: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 14 02:27:10 host2 sshd[2107229]: Disconnected from invalid user ubuntu 103.179.56.78 port 42412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-14 02:28:25 dovecot_login authenticator failed for ([177.239.160.152]) [177.239.160.152]:42470: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.8.127.134
country_id: 1269750
description:
Dec 14 02:28:34 host2 sshd[2108214]: Disconnected from invalid user zhaomin 202.8.127.134 port 39162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-14 02:28:44 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (trils) [24.23.125.83]:33070: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2025-12-14 02:28:46 dovecot_login authenticator failed for ([87.200.94.102]) [87.200.94.102]:39974: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 14 02:28:50 host2 sshd[2108450]: Disconnected from invalid user mobile 103.179.56.78 port 44506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 02:31:28 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53818: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 14 02:31:17 host2 sshd[2110180]: Disconnected from invalid user frontend 103.179.56.78 port 37744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-14 02:31:34 dovecot_plain authenticator failed for (theruns) [65.20.164.137]:55224: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-14 02:33:16 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:62301: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-14 02:32:58 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:39115: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-14 02:33:37 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:34082: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-14 02:34:20 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:53732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-14 02:34:44 dovecot_login authenticator failed for 109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:59386: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2025-12-14 02:38:50 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:47883: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-14 02:39:09 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:56092: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 02:41:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<V8PU0NtFdM0+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.88
country_id: 6252001
description:
Dec 14 02:41:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.88, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Zj1h0ttFLd7N0h9Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-14 02:43:20 dovecot_plain authenticator failed for (notics) [96.85.104.2]:33114: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 02:44:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EWob3dtFytunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 02:46:54 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (chury) [51.195.117.220]:23611: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-14 02:47:36 dovecot_plain authenticator failed for (catax) [65.20.250.163]:53626: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-14 02:49:05 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:38074: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 02:49:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<QT1E7ttFKNU+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.169
country_id: 1733045
description:
2025-12-14 02:49:23 dovecot_login authenticator failed for ([49.124.154.169]) [49.124.154.169]:39134: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 14 02:50:25 host2 sshd[2123694]: Disconnected from invalid user administrator 89.126.208.241 port 40634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.97.111
country_id: 3469034
description:
Dec 14 02:52:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=186.224.97.111, lip=66.85.158.91, TLS, session=<tNvQ99tFUuS64GFv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-14 02:53:07 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:39652: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.113
country_id: 1733045
description:
2025-12-14 02:53:14 dovecot_login authenticator failed for ([49.124.147.113]) [49.124.147.113]:58432: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-14 02:52:35 dovecot_login authenticator failed for (dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:56920: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.126
country_id: 3175395
description:
Dec 14 02:52:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.126, lip=66.85.158.91, TLS, session=<nKX/+NtFFYK5D6l+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-14 02:52:47 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:56460: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-14 02:52:51 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:52324: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-14 02:52:54 dovecot_login authenticator failed for (cm-84.211.11.216.get.no) [84.211.11.216]:43593: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-14 02:53:52 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (flaters) [73.224.171.101]:46082: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 14 02:54:24 host2 sshd[2126481]: Disconnected from invalid user user01 89.126.208.241 port 48614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 14 02:55:41 host2 sshd[2127527]: Disconnected from invalid user github 89.126.208.241 port 45210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 02:57:37 host2 sshd[2128641]: Disconnected from invalid user deploy 58.98.199.45 port 56482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.222
country_id: 6252001
description:
2025-12-14 02:58:07 dovecot_login authenticator failed for wsip-184-191-242-222.fv.ks.cox.net [184.191.242.222]:44672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-14 02:59:08 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:60149: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.70.118
country_id: 1168579
description:
2025-12-14 02:58:45 dovecot_login authenticator failed for ([115.42.70.118]) [115.42.70.118]:38760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 02:58:56 host2 sshd[2129463]: Disconnected from invalid user upload 58.98.199.45 port 47366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.66
country_id: 1733045
description:
2025-12-14 03:00:06 dovecot_login authenticator failed for ([49.125.201.66]) [49.125.201.66]:48080: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 03:01:25 host2 sshd[2131138]: Disconnected from invalid user devops 58.98.199.45 port 56144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Dec 14 03:04:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<7+//I9xFGqWnXpI8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-14 03:03:52 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:39438: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-14 03:04:17 dovecot_login authenticator failed for ([125.16.246.121]) [182.95.63.50]:57864: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-14 03:04:35 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:59681: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.50
country_id: 1269750
description:
2025-12-14 03:04:51 dovecot_login authenticator failed for ([128.185.212.50]) [128.185.212.50]:58598: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 03:05:04 host2 sshd[2133698]: Disconnected from invalid user astra 58.98.199.45 port 50353 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 14 03:06:12 host2 sshd[2134393]: Disconnected from invalid user user 58.98.199.45 port 34181 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.20
country_id: 953987
description:
Dec 14 03:08:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.64.32.20, lip=66.85.158.91, TLS, session=<AvtiMdxFl79mQCAU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-14 03:08:37 dovecot_plain authenticator failed for (uniter) [109.226.14.93]:35520: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.139
country_id: 798544
description:
Dec 14 03:08:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=178.216.31.139, lip=66.85.158.91, TLS, session=<ERiRMtxFR4Sy2B+L>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 67.217.228.97
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 67.217.228.97: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-14 03:10:47 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (unnia) [217.215.74.195]:58328: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.248
country_id: 1733045
description:
2025-12-14 03:14:36 dovecot_login authenticator failed for ([49.124.152.248]) [49.124.152.248]:36046: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-14 03:14:50 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:53724: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.48.148.89
country_id: 357994
description:
2025-12-14 03:17:21 dovecot_plain authenticator failed for (6MB1PQ8V7O8RZW8) [197.48.148.89]:60878: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.108
country_id: 3175395
description:
Dec 14 03:19:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.15.170.108, lip=66.85.158.91, TLS, session=<I2l7V9xFH+O5D6ps>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.193.236
country_id: 3865483
description:
Dec 14 03:19:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.96.193.236, lip=66.85.158.91, TLS, session=<dtqgWNxFwY26YMHs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.65
country_id: 2510769
description:
Dec 14 03:21:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=139.28.190.65, lip=66.85.158.91, TLS, session=<2xCdX9xFHK2LHL5B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.243.38.183
country_id: 3469034
description:
Dec 14 03:21:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=191.243.38.183, lip=66.85.158.91, TLS, session=<xBQLYdxFFee/8ya3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.154
country_id: 1733045
description:
2025-12-14 03:23:16 dovecot_login authenticator failed for ([49.124.155.154]) [49.124.155.154]:55662: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-14 03:23:20 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:34119: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-14 03:23:38 dovecot_login authenticator failed for ([182.95.20.115]) [182.95.229.142]:38450: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-14 03:23:47 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:34674: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-14 03:24:50 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:43000: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-14 03:25:15 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:50986: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 03:25:36 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (chnish) [51.195.117.220]:39741: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-14 03:26:37 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:57389: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-12-14 03:27:07 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:9157: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-12-14 03:27:44 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:48415: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-14 03:29:10 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:35432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2025-12-14 03:29:25 dovecot_login authenticator failed for (nsg-corporate-250.250.187.122.airtel.in) [122.187.250.250]:35954: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2025-12-14 03:29:49 dovecot_login authenticator failed for ([103.79.237.54]) [103.79.237.54]:55166: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-14 03:30:02 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:56042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 14 03:31:18 host2 sshd[2153031]: Disconnected from invalid user ftpuser 165.227.3.79 port 41313 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 03:32:10 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (metrilizi) [51.195.117.220]:59147: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:33:07 host2 sshd[2154153]: Disconnected from invalid user tomas 98.213.142.168 port 42192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 14 03:32:50 host2 sshd[2153972]: Disconnected from invalid user fivem 103.160.212.122 port 44762 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 14 03:33:48 host2 sshd[2154604]: Disconnected from invalid user administrador 165.227.3.79 port 42838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Dec 14 03:34:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<HaJgjtxFoGWnXpI1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.73
country_id: 6252001
description:
Dec 14 03:34:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.73, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0JjDjtxFIsOTuYRJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.104.32
country_id: 3175395
description:
Dec 14 03:33:42 host2 sshd[2154535]: Disconnected from invalid user deploy 151.19.104.32 port 50192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 2921044
description:
Dec 14 03:33:46 host2 sshd[2154572]: Disconnected from invalid user fivem 144.31.126.21 port 56822 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 14 03:34:18 host2 sshd[2154864]: Received disconnect from 165.227.3.79 port 48809:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.104.32
country_id: 3175395
description:
Dec 14 03:34:33 host2 sshd[2154983]: Disconnected from invalid user test 151.19.104.32 port 50151 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.52
country_id: 1605651
description:
Dec 14 03:34:14 host2 sshd[2154807]: Disconnected from invalid user es1 110.78.149.52 port 47880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.52
country_id: 1605651
description:
Dec 14 03:35:40 host2 sshd[2155931]: Disconnected from invalid user abc 110.78.149.52 port 40042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.78.237
country_id: 1282988
description:
Dec 14 03:35:44 host2 sshd[2155962]: Disconnected from invalid user igor 202.70.78.237 port 17648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:35:47 host2 sshd[2156022]: Disconnected from invalid user ubuntu 98.213.142.168 port 46348 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 03:35:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<eyMPldxFOs0+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.104.32
country_id: 3175395
description:
Dec 14 03:36:36 host2 sshd[2156513]: Disconnected from invalid user testuser 151.19.104.32 port 50030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 14 03:36:46 host2 sshd[2156597]: Disconnected from invalid user developer1 34.91.0.68 port 54076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:36:49 host2 sshd[2156644]: Disconnected from invalid user fivem 98.213.142.168 port 51406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.24
country_id: 1733045
description:
2025-12-14 03:36:52 dovecot_login authenticator failed for ([49.124.153.24]) [49.124.153.24]:53350: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.78.149.52
country_id: 1605651
description:
Dec 14 03:36:18 host2 sshd[2156342]: Disconnected from invalid user xq 110.78.149.52 port 48054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.111
country_id: 6252001
description:
2025-12-14 03:36:12 dovecot_login authenticator failed for wsip-184-191-250-111.fv.ks.cox.net [184.191.250.111]:52107: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 2921044
description:
Dec 14 03:37:30 host2 sshd[2157195]: Disconnected from invalid user student3 144.31.126.21 port 54094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-14 03:37:46 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:53398: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:37:51 host2 sshd[2157455]: Disconnected from invalid user testuser 98.213.142.168 port 49684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 14 03:38:51 host2 sshd[2158335]: Disconnected from invalid user asdf 34.91.0.68 port 37338 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 144.31.126.21
country_id: 2921044
description:
Dec 14 03:39:02 host2 sshd[2158436]: Received disconnect from 144.31.126.21 port 54466:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-14 03:38:50 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:58168: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.52
country_id: 1605651
description:
Dec 14 03:38:19 host2 sshd[2157793]: Disconnected from invalid user serv 110.78.149.52 port 34746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.213.142.168
country_id: 6252001
description:
Dec 14 03:38:22 host2 sshd[2157831]: Disconnected from invalid user administrator 98.213.142.168 port 39480 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 03:39:14 host2 sshd[2158655]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-14 03:39:24 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:47175: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 03:40:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<FSs+pdxF1r4+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-14 03:42:28 dovecot_login authenticator failed for ([182.79.136.105]) [122.187.60.126]:52462: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 14 03:42:37 host2 sshd[2160773]: Disconnected from invalid user wan 34.91.0.68 port 51510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-14 03:42:47 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:45459: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 14 03:43:37 host2 sshd[2161505]: Disconnected from invalid user frappe 34.91.0.68 port 51524 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-14 03:43:46 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (gredgic) [98.227.25.115]:58056: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 14 03:44:32 host2 pure-ftpd[2162289]: (?@66.132.153.116) [INFO] New connection from 66.132.153.116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 14 03:44:45 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, session=<YYmhtNxFnnFChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-14 03:44:47 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (distion) [73.68.220.15]:45994: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-12-14 03:47:34 dovecot_login authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:36174: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 03:47:50 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (suphea) [51.195.117.220]:46780: 535 Incorrect authentication data (set_id=test@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-14 03:48:02 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:60354: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-14 03:47:18 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:54203: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2025-12-14 03:47:32 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:8215: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-14 03:48:14 dovecot_login authenticator failed for (cm-84.213.189.183.get.no) [84.213.189.183]:53653: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-14 03:48:35 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (gostage) [71.235.225.181]:59974: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-14 03:49:48 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (tiouse) [98.204.134.124]:46608: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.74
country_id: 933860
description:
Dec 14 03:51:47 host2 sshd[2168628]: Disconnected from invalid user user 168.167.228.74 port 33123 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-14 03:53:05 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:52479: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-14 03:52:26 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:50536: 535 Incorrect authentication data (set_id=editor@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Dec 14 03:52:28 host2 sshd[2169087]: Disconnected from invalid user filippo 168.167.228.74 port 33124 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-14 03:52:55 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:57136: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-14 03:53:25 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:43844: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-14 03:53:46 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (albetritte) [68.83.181.181]:38410: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.206.145
country_id: 2921044
description:
Dec 14 03:53:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=161.35.206.145, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<aXjW1NxFebChI86R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.29.119
country_id: 2921044
description:
Dec 14 03:54:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.29.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<i+Lv1txFEPqd5h13>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.34
country_id: 6252001
description:
2025-12-14 03:57:54 dovecot_login authenticator failed for wsip-184-191-250-34.fv.ks.cox.net [184.191.250.34]:45115: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-14 03:58:22 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:58558: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 03:58:36 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (otermite) [73.208.81.125]:37686: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 03:59:13 host2 sshd[2174295]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-14 04:02:00 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:48013: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 04:03:02 host2 sshd[2177335]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.229
country_id: 6252001
description:
2025-12-14 04:02:12 dovecot_login authenticator failed for wsip-184-191-242-229.fv.ks.cox.net [184.191.242.229]:54958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-14 04:04:37 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (hacklar) [73.195.211.98]:44160: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.207.63.102
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.207.63.102 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.224.69.7
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.224.69.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.92.140.213
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 143.92.140.213 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.106.89.244
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.106.89.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.191.76.34
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 190.191.76.34 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.190.22.129
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 101.190.22.129 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.169.252.72
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.169.252.72 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-14 04:06:46 dovecot_login authenticator failed for ([182.79.87.18]) [182.79.87.18]:43812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-12-14 04:06:22 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:56668: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-14 04:06:31 dovecot_plain authenticator failed for (fulgrewed) [5.11.141.74]:57692: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-14 04:06:42 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (ophiete) [174.161.27.82]:60720: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-14 04:10:11 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (reedist) [68.46.148.180]:49738: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-12-14 04:10:47 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:56663: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.37.48.116
country_id: 3865483
description:
2025-12-14 04:10:48 dovecot_plain authenticator failed for ([31.57.166.48]) [179.37.48.116]:53648: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-14 04:11:02 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:35656: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.55.159.90
country_id: 3469034
description:
2025-12-14 04:11:01 dovecot_plain authenticator failed for ([31.57.166.48]) [177.55.159.90]:34129: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-12-14 04:11:11 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:38034: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.179.131
country_id: 3996063
description:
2025-12-14 04:11:12 dovecot_plain authenticator failed for ([31.57.166.48]) [98.97.179.131]:6343: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-14 04:11:26 dovecot_login authenticator failed for (nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:33064: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-14 04:12:51 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:57463: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.17
country_id: 6252001
description:
2025-12-14 04:12:25 dovecot_login authenticator failed for ([98.181.44.17]) [98.181.44.17]:56833: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-14 04:14:20 dovecot_login authenticator failed for (7g75xw) [69.5.189.21]:54635: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 04:15:12 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (forhary) [73.208.81.125]:57240: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-14 04:16:13 dovecot_login authenticator failed for (9CBuIsZEAG) [69.5.189.21]:63506: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-14 04:16:17 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (proost) [73.129.57.71]:57570: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-14 04:16:37 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3789: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.32
country_id: 1733045
description:
2025-12-14 04:16:58 dovecot_login authenticator failed for ([49.124.151.32]) [49.124.151.32]:54128: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.128
country_id: 6252001
description:
2025-12-14 04:17:47 dovecot_login authenticator failed for wsip-184-191-250-128.fv.ks.cox.net [184.191.250.128]:37211: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-14 04:17:58 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:59041: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 14 04:19:42 host2 sshd[2193984]: Disconnected from invalid user it 36.64.68.99 port 54136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-14 04:20:59 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:38542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.81.42
country_id: 2542007
description:
2025-12-14 04:20:48 dovecot_login authenticator failed for ([105.73.81.42]) [105.73.81.42]:33941: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 14 04:22:41 host2 sshd[2196262]: Disconnected from invalid user dev 196.204.240.61 port 55564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 14 04:23:52 host2 sshd[2197298]: Disconnected from invalid user nexus 196.204.240.61 port 38302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 14 04:24:02 host2 sshd[2197428]: Disconnected from invalid user factorio 36.64.68.99 port 49672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 1861060
description:
Dec 14 04:24:17 host2 sshd[2197729]: Disconnected from invalid user admin 203.189.233.12 port 52794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 1861060
description:
Dec 14 04:25:21 host2 sshd[2199233]: Disconnected from invalid user dev 203.189.233.12 port 55894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.189.233.12
country_id: 1861060
description:
Dec 14 04:25:53 host2 sshd[2199714]: Disconnected from invalid user wp 203.189.233.12 port 51696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 14 04:26:04 host2 sshd[2199994]: Disconnected from invalid user newftpuser 36.64.68.99 port 39746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 1861060
description:
Dec 14 04:26:24 host2 sshd[2200471]: Disconnected from invalid user proxyuser 203.189.233.12 port 44212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-14 04:27:07 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:33643: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 14 04:27:23 host2 sshd[2201448]: Disconnected from invalid user admin1 36.64.68.99 port 49812 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.44
country_id: 1733045
description:
2025-12-14 04:27:24 dovecot_login authenticator failed for ([49.124.153.44]) [49.124.153.44]:34532: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 196.204.240.61
country_id: 357994
description:
Dec 14 04:28:53 host2 sshd[2203160]: Received disconnect from 196.204.240.61 port 59014:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 14 04:28:53 host2 sshd[2203160]: Disconnected from invalid user home 196.204.240.61 port 59014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-14 04:30:49 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:43542: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-14 04:30:30 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:40153: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 04:30:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<f8IwWd1Ffos+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.131.111.33
country_id: 290291
description:
2025-12-14 04:31:52 dovecot_plain authenticator failed for ([31.57.166.48]) [37.131.111.33]:31375: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 04:31:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<o4oiXd1FkqA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.111.175.141
country_id: 2635167
description:
2025-12-14 04:31:58 dovecot_plain authenticator failed for ([31.57.166.48]) [185.111.175.141]:62478: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.108.141
country_id: 2017370
description:
2025-12-14 04:32:00 dovecot_plain authenticator failed for ([31.57.166.48]) [146.158.108.141]:48742: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.23.55.24
country_id: 6252001
description:
2025-12-14 04:31:48 dovecot_plain authenticator failed for 184-23-55-24.fiber.dynamic.sonic.net ([31.57.166.48]) [184.23.55.24]:57044: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.255.77.51
country_id: 3469034
description:
2025-12-14 04:31:50 dovecot_plain authenticator failed for ([31.57.166.48]) [138.255.77.51]:21314: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.36.212
country_id: 3469034
description:
2025-12-14 04:32:02 dovecot_plain authenticator failed for ([31.57.166.48]) [45.226.36.212]:10757: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.62.177.128
country_id: 6252001
description:
2025-12-14 04:31:48 dovecot_plain authenticator failed for c-73-62-177-128.hsd1.mn.comcast.net ([31.57.166.48]) [73.62.177.128]:41506: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.253.131.168
country_id: 6252001
description:
2025-12-14 04:32:03 dovecot_plain authenticator failed for ([31.57.166.48]) [67.253.131.168]:46738: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.20.166.128
country_id: 3865483
description:
2025-12-14 04:32:10 dovecot_plain authenticator failed for ([31.57.166.48]) [181.20.166.128]:38459: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.224.184.136
country_id: 3865483
description:
2025-12-14 04:32:14 dovecot_plain authenticator failed for ([31.57.166.48]) [181.224.184.136]:52098: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 04:32:15 host2 sshd[2206743]: Disconnected from invalid user user 2.57.121.25 port 44672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec 14 04:33:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.91, session=<OAcAYt1Fsv8t4/6b>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.33.49
country_id: 2921044
description:
Dec 14 04:33:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=104.248.33.49, lip=66.85.158.91, session=<ZEBMZN1FQRlo+CEx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.29.119
country_id: 2921044
description:
Dec 14 04:33:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.29.119, lip=66.85.158.91, session=<W6RRZN1FvsKd5h13>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-14 04:35:59 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [136.232.73.130]:40434: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 04:36:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<YkPha91FnpynrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-14 04:35:10 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:32816: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-14 04:35:25 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:40118: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-14 04:35:45 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:55864: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-14 04:36:20 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:52496: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-14 04:36:46 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:50648: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.12
country_id: 6252001
description:
Dec 14 04:37:14 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.12, lip=66.85.158.91, session=<IulHcN1FLJKsaYAM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-14 04:40:47 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:43449: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.157
country_id: 3996063
description:
2025-12-14 04:41:00 dovecot_login authenticator failed for (187.161.222.157-clientes-izzi.mx) [187.161.222.157]:37954: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-14 04:41:15 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:47305: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-14 04:41:21 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:54575: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-14 04:41:50 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:60166: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-14 04:42:18 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:56711: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 04:42:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<wZHYg91FZOI+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 04:44:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<9pW1id1Fqtw+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-14 04:46:30 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:54248: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-12-14 04:50:46 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:51194: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-14 04:51:31 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:35024: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.216
country_id: 6252001
description:
Dec 14 04:51:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.216, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<umrdo91FptXN0h/Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.142.46.185
country_id: 3017382
description:
Dec 14 04:53:29 host2 sshd[2224824]: Disconnected from invalid user admin 88.142.46.185 port 53456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.111
country_id: 3469034
description:
Dec 14 04:53:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=191.240.36.111, lip=66.85.158.91, TLS, session=<XC5+qd1FlNC/8CRv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.198.62
country_id: 3865483
description:
Dec 14 04:53:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=181.225.198.62, lip=66.85.158.91, TLS, session=<gQi5qt1FscW14cY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.81
country_id: 3996063
description:
2025-12-14 04:54:20 dovecot_login authenticator failed for ([177.236.144.81]) [177.236.144.81]:45371: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-14 04:54:41 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:38086: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.142.46.185
country_id: 3017382
description:
Dec 14 04:54:59 host2 sshd[2226528]: Disconnected from invalid user ankit 88.142.46.185 port 34122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.142.46.185
country_id: 3017382
description:
Dec 14 04:56:30 host2 sshd[2227983]: Disconnected from invalid user sa 88.142.46.185 port 43026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.142.46.185
country_id: 3017382
description:
Dec 14 04:57:32 host2 sshd[2228570]: Disconnected from invalid user deploy 88.142.46.185 port 39548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2025-12-14 04:58:52 dovecot_plain authenticator failed for c-73-21-28-14.hsd1.ga.comcast.net (lorgizes) [73.21.28.14]:35148: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-14 04:58:56 dovecot_plain authenticator failed for (pired) [94.201.22.158]:34804: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-14 04:59:41 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:50066: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-14 05:00:01 dovecot_plain authenticator failed for (difies) [102.53.15.180]:56750: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-14 05:00:05 dovecot_login authenticator failed for ([122.184.124.46]) [122.184.124.46]:49824: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2025-12-14 04:59:19 dovecot_login authenticator failed for ([49.124.151.71]) [49.124.151.71]:34258: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.211
country_id: 1733045
description:
2025-12-14 05:00:42 dovecot_login authenticator failed for ([49.124.152.211]) [49.124.152.211]:57806: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-14 05:02:02 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:49443: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2025-12-14 05:02:20 dovecot_plain authenticator failed for cm-72-241-202-104.buckeyecom.net (banty) [72.241.202.104]:44761: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-14 05:02:19 dovecot_login authenticator failed for ([85.19.195.12]) [85.19.195.12]:35666: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 05:03:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<CMxXz91FkJc+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.196.214
country_id: 3144096
description:
2025-12-14 05:05:02 dovecot_login authenticator failed for (cm-178.232.196.214.get.no) [178.232.196.214]:36170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Dec 14 05:05:04 host2 sshd[2237386]: Disconnected from invalid user test1 43.163.123.45 port 52458 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-14 05:05:29 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:55068: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-14 05:05:59 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:39066: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 05:05:25 host2 sshd[2237710]: Disconnected from invalid user admin 2.57.121.112 port 45990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-14 05:06:16 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:57278: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Dec 14 05:07:22 host2 sshd[2239150]: Disconnected from invalid user stp 43.163.123.45 port 45528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 14 05:07:56 host2 sshd[2239469]: Disconnected from invalid user test 160.242.96.43 port 58224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.191
country_id: 2750405
description:
2025-12-14 05:08:51 dovecot_login authenticator failed for (oOyiFXX5ey) [178.16.54.191]:51334: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.191
country_id: 2750405
description:
2025-12-14 05:09:21 dovecot_login authenticator failed for (XlHb4B7) [178.16.54.191]:52211: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.133
country_id: 2300660
description:
Dec 14 05:09:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=41.139.47.133, lip=66.85.158.91, TLS, session=<7Ch14t1FRLwpiy+F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.223.250.133
country_id: 2395170
description:
Dec 14 05:09:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=41.223.250.133, lip=66.85.158.91, TLS, session=<UW7E491F39Up3/qF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 14 05:10:04 host2 sshd[2241029]: Disconnected from invalid user certbot 160.242.96.43 port 46378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 05:10:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<v2mm591FaJw+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 14 05:10:45 host2 sshd[2241807]: Disconnected from invalid user mike 160.242.96.43 port 57616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-12-14 05:10:51 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:52238: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-14 05:10:20 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:50752: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Dec 14 05:10:21 host2 sshd[2241510]: Disconnected from invalid user guest 43.163.123.45 port 50994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.191
country_id: 2750405
description:
2025-12-14 05:12:05 dovecot_login authenticator failed for (ncrLd3w) [178.16.54.191]:56444: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.101
country_id: 6252001
description:
Dec 14 05:14:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.101, lip=66.85.158.92, session=<XUUG9d1F6JQs3Lll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-14 05:15:37 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:45270: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.75
country_id: 6252001
description:
Dec 14 05:15:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=98.80.4.75, lip=66.85.158.92, TLS handshaking: Connection closed, session=<54h0+t1FmsViUARL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-14 05:15:59 dovecot_login authenticator failed for ([102.38.3.179]) [102.38.3.179]:42672: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-14 05:16:20 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (pyron) [73.197.194.98]:49100: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 05:18:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<0aicAt5F6NCB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.236
country_id: 1733045
description:
2025-12-14 05:19:25 dovecot_login authenticator failed for ([183.171.53.236]) [183.171.53.236]:48844: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-14 05:19:39 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:41405: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.221
country_id: 3469034
description:
Dec 14 05:19:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=187.120.76.221, lip=66.85.158.91, TLS, session=<Xln7B95F9qG7eEzd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.22.151.143
country_id: 2802361
description:
Dec 14 05:19:24 host2 pure-ftpd[2248412]: (?@34.22.151.143) [INFO] New connection from 34.22.151.143


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.133
country_id: 3175395
description:
Dec 14 05:20:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.124.182.133, lip=66.85.158.91, TLS, session=<4dwjCd5Fcs25fLaF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.250.27.151
country_id: 3077311
description:
Dec 14 05:22:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=80.250.27.151, lip=66.85.158.91, TLS, session=<cHfnD95FYNNQ+huX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.152
country_id: 3865483
description:
Dec 14 05:22:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=190.122.133.152, lip=66.85.158.91, TLS, session=<InAuEd5FO+a+eoWY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 05:24:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<1PXPF95Fjpc+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-14 05:23:55 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:54936: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-12-14 05:24:06 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:40668: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.115
country_id: 1733045
description:
2025-12-14 05:24:15 dovecot_login authenticator failed for ([49.124.147.115]) [49.124.147.115]:55904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-14 05:24:24 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:52073: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-14 05:25:14 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:33606: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-14 05:25:30 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:39449: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.59
country_id: 1733045
description:
2025-12-14 05:27:48 dovecot_login authenticator failed for ([49.124.153.59]) [49.124.153.59]:42916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-14 05:28:00 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:58414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 05:27:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<wJMGI95FIoU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-12-14 05:27:16 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:56061: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-12-14 05:27:27 dovecot_login authenticator failed for ([61.246.205.1]) [125.19.218.2]:53240: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-12-14 05:28:23 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:52892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-12-14 05:29:54 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:48335: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.113
country_id: 2542007
description:
2025-12-14 05:30:27 dovecot_login authenticator failed for ([105.73.203.113]) [105.73.203.113]:60455: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-14 05:30:52 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:52822: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-14 05:30:52 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:52478: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-14 05:31:05 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:45090: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-14 05:31:28 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:40898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-14 05:33:09 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54798: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-14 05:33:23 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:41518: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 05:33:55 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (prazedwirs) [96.230.65.90]:51380: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-14 05:38:41 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:47889: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.148
country_id: 6252001
description:
2025-12-14 05:39:01 dovecot_login authenticator failed for ([70.174.167.148]) [70.174.167.148]:55192: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.20
country_id: 6252001
description:
2025-12-14 05:39:45 dovecot_login authenticator failed for ([98.181.44.20]) [98.181.44.20]:46428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-14 05:39:47 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (hurigifies) [174.58.87.108]:40104: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-14 05:40:01 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:39079: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-14 05:43:03 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:61978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-12-14 05:42:41 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:41714: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-14 05:43:38 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:54382: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-12-14 05:43:58 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:50269: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 05:45:23 host2 sshd[2267619]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2025-12-14 05:48:46 dovecot_login authenticator failed for ([49.124.151.71]) [49.124.151.71]:36078: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-12-14 05:48:58 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:54939: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-14 05:49:03 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:59706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-14 05:48:22 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:47838: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-14 05:48:43 dovecot_login authenticator failed for ([122.184.136.185]) [182.95.181.22]:39312: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 05:48:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<T6Hlb95FNOE+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 05:49:13 host2 sshd[2270159]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 14 05:50:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=</sh2d95Fvt/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2025-12-14 05:54:10 dovecot_login authenticator failed for ([125.19.159.186]) [125.19.159.186]:55966: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-14 05:54:40 dovecot_login authenticator failed for ([14.195.19.75]) [14.195.19.75]:38942: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-14 05:54:46 dovecot_login authenticator failed for (cm-84.211.6.119.get.no) [84.211.6.119]:52365: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-14 05:54:57 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:43160: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-14 05:58:47 dovecot_login authenticator failed for (cm-84.214.63.110.get.no) [84.214.63.110]:55489: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-14 05:59:06 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (glexosper) [174.169.224.27]:38012: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-14 05:58:15 dovecot_login authenticator failed for (cm-178.232.221.194.get.no) [178.232.221.194]:56594: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 06:03:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<MZikpN5FDsM+PIdg>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 208.103.231.222
country_id: 6251999
description:
Dec 14 06:03:35 host2 sshd[2280237]: Disconnecting authenticating user root 208.103.231.222 port 47704: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 208.103.231.222
country_id: 6251999
description:
Dec 14 06:03:35 host2 sshd[2280237]: error: maximum authentication attempts exceeded for root from 208.103.231.222 port 47704 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-14 06:04:38 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:57730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-14 06:04:52 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:60377: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-14 06:07:11 dovecot_plain authenticator failed for (swity) [96.85.104.2]:34930: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 06:07:15 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (undrous) [51.195.117.220]:20130: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-14 06:07:54 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:39596: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-14 06:08:25 dovecot_plain authenticator failed for (petrostos) [187.161.198.68]:57553: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-14 06:08:34 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:46606: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 06:09:29 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (nuodowy) [73.208.81.125]:58154: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-14 06:09:45 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:54360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-14 06:10:14 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:55855: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 14 06:11:55 host2 sshd[2286095]: Disconnected from invalid user stud1 103.100.208.88 port 55053 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 14 06:12:07 host2 sshd[2286235]: Disconnected from invalid user eacadm 45.197.145.10 port 33842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.144.177.200
country_id: 6252001
description:
Dec 14 06:12:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.144.177.200, lip=66.85.158.92, TLS: Connection closed, session=<VlU5xN5FxsASkLHI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-12-14 06:12:59 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:50293: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-14 06:13:15 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:57641: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 14 06:13:22 host2 sshd[2287212]: Disconnected from invalid user abhi 103.100.208.88 port 40094 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.246.109
country_id: 6252001
description:
Dec 14 06:13:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.234.246.109, lip=66.85.158.91, session=<90kuyN5F1Lys6vZt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.234.246.109
country_id: 6252001
description:
Dec 14 06:13:28 host2 pure-ftpd[2287277]: (?@172.234.246.109) [INFO] New connection from 172.234.246.109


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 14 06:14:29 host2 sshd[2288034]: Disconnected from invalid user pm2 45.197.145.10 port 44560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-14 06:14:30 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:43655: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-12-14 06:14:16 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:60344: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 14 06:15:10 host2 sshd[2288585]: Disconnected from invalid user admin 45.197.145.10 port 57102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 14 06:17:13 host2 sshd[2290083]: Disconnected from invalid user java 103.100.208.88 port 49706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 06:18:33 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61057: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-14 06:18:47 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:53128: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-12-14 06:19:00 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:60130: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-12-14 06:19:48 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:51346: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-14 06:20:00 dovecot_login authenticator failed for (mail3.hurst.co.uk) [77.89.143.122]:34034: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 14 06:22:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<FRm36N5FUKrCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-14 06:22:12 dovecot_plain authenticator failed for (wowailos) [81.0.54.119]:56902: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 06:25:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=</iKD895FLrw+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 06:27:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<86oY+t5FSoM+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 06:27:29 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (pered) [51.195.117.220]:52256: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Dec 14 06:27:33 host2 sshd[2298189]: Disconnected from invalid user xiangyu 154.221.27.234 port 34189 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2025-12-14 06:27:46 dovecot_login authenticator failed for ([128.185.194.190]) [128.185.194.190]:51150: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 06:27:58 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57478: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-14 06:28:51 dovecot_login authenticator failed for ([125.20.223.161]) [152.52.236.2]:41318: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-14 06:29:39 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:44586: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.27.234
country_id: 1819730
description:
Dec 14 06:29:54 host2 sshd[2299509]: Disconnected from invalid user old 154.221.27.234 port 51554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Dec 14 06:30:41 host2 sshd[2300255]: Disconnected from invalid user mongouser 154.221.27.234 port 57953 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 06:31:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<M6XZCN9FrIynrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-14 06:31:42 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (chnapub) [76.16.7.82]:37976: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-12-14 06:33:05 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:50626: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-14 06:32:43 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:47235: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.251.189.233
country_id: 6252001
description:
Dec 14 06:34:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.251.189.233, lip=66.85.158.91, TLS: Connection closed, session=<ujrsEt9FSOMs+73p>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.12
country_id: 798549
description:
Dec 14 06:34:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=85.217.140.12, lip=66.85.158.91, TLS: Connection closed, session=<x10TFN9F/NZV2YwM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 14 06:34:48 host2 sshd[2302486]: Disconnected from invalid user test2 103.113.105.228 port 43858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-14 06:36:21 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:34956: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-14 06:36:38 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:42972: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-12-14 06:37:55 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:59930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 14 06:37:15 host2 sshd[2304004]: Disconnected from invalid user jenny 103.113.105.228 port 51177 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-14 06:37:39 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:59920: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-14 06:37:44 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:40674: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-14 06:38:12 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:35540: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2025-12-14 06:39:44 dovecot_login authenticator failed for ([103.111.109.194]) [103.111.109.194]:32864: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 06:42:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<o3+WMN9FQrI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-14 06:43:38 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:43186: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-14 06:44:07 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:55850: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-14 06:44:09 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:40638: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-14 06:44:14 dovecot_plain authenticator failed for (opoids) [199.192.123.12]:39838: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-14 06:44:26 dovecot_login authenticator failed for ([122.185.184.134]) [182.95.226.82]:38016: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-14 06:44:12 dovecot_plain authenticator failed for (comale) [5.11.141.74]:36278: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 06:53:46 host2 sshd[2314677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.126
country_id: 3175395
description:
Dec 14 06:53:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.197.8.126, lip=66.85.158.91, TLS, session=<gaL4Vd9FKqi5xQh+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.44.136.205
country_id: 1269750
description:
2025-12-14 06:53:35 dovecot_login authenticator failed for ([103.44.136.205]) [103.44.136.205]:44901: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 2.136.115.209
country_id: 2510769
description:
Dec 14 06:53:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=2.136.115.209, lip=66.85.158.91, TLS, session=<lIwPV99Fv+wCiHPR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-14 06:53:58 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:57284: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-14 06:54:27 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (exterteast) [66.177.30.53]:52972: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-14 06:57:48 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:38101: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-14 06:57:59 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:44226: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-14 06:57:27 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:42290: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-14 06:57:28 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (asterm) [98.227.25.115]:35986: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-14 06:57:39 dovecot_login authenticator failed for ([182.95.197.193]) [182.79.87.18]:56420: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-14 06:59:15 dovecot_plain authenticator failed for (shipolo) [102.53.15.180]:33858: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 07:01:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<W8yQc99FzrGB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2025-12-14 07:02:21 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:47982: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 07:02:25 host2 sshd[2319327]: Disconnected from invalid user user 2.57.121.25 port 14100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-14 07:02:33 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:58136: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-12-14 07:02:40 dovecot_login authenticator failed for ([207.188.158.216]) [207.188.158.216]:59946: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-14 07:02:13 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:6354: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-14 07:03:34 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:49167: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 14 07:03:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS: Connection closed, session=<aYUwfN9FGJZChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-14 07:04:16 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:55667: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-14 07:06:00 dovecot_plain authenticator failed for (talies) [65.20.184.80]:45884: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 14 07:06:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS: Connection closed, session=<CAjKhN9FQhxChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.60.248.162
country_id: 1819730
description:
Dec 14 07:07:59 host2 sshd[2322437]: Disconnected from invalid user ubuntu 217.60.248.162 port 34656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-14 07:08:45 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:58263: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 07:09:04 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:63334: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-14 07:08:23 dovecot_login authenticator failed for ([125.20.223.161]) [152.52.236.2]:35588: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.223.194.42
country_id: 3469034
description:
Dec 14 07:09:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.223.194.42, lip=66.85.158.91, TLS, session=<f9mcjt9FNZ+x38Iq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.44.136.205
country_id: 1269750
description:
2025-12-14 07:09:22 dovecot_login authenticator failed for ([103.44.136.205]) [103.44.136.205]:60697: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.117
country_id: 3865483
description:
Dec 14 07:09:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=179.0.250.117, lip=66.85.158.91, TLS, session=<uHzVj99FFYizAPp1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-14 07:10:15 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (fenaters) [73.195.211.98]:38720: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-14 07:11:31 dovecot_plain authenticator failed for (devel) [65.20.149.93]:32779: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 07:12:10 host2 sshd[2325064]: Disconnected from invalid user admin 2.57.121.112 port 51114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-14 07:16:51 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (ansia) [68.40.189.43]:32818: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-14 07:17:22 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (inorsemal) [24.23.125.83]:57636: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.110
country_id: 1733045
description:
2025-12-14 07:18:47 dovecot_login authenticator failed for ([49.124.147.110]) [49.124.147.110]:48930: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-14 07:19:08 dovecot_plain authenticator failed for (lairess) [65.20.160.107]:40186: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-14 07:19:07 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:43379: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.253
country_id: 953987
description:
Dec 14 07:19:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.129.53.253, lip=66.85.158.91, TLS, session=<359ItN9FN85mgTX9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.253
country_id: 3469034
description:
Dec 14 07:20:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.189.205.253, lip=66.85.158.91, TLS, session=<DmKatd9F84Gzvc39>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.111
country_id: 3865483
description:
Dec 14 07:22:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.252.111, lip=66.85.158.91, TLS, session=<RT5UvN9FrNmzAPxv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-14 07:23:01 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:54671: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.161.232.82
country_id: 1269750
description:
Dec 14 07:22:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=103.161.232.82, lip=66.85.158.91, TLS, session=<kfy4vd9FdI1noehS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-14 07:22:37 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:38056: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-14 07:23:47 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (nolly) [98.192.74.183]:43490: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-14 07:24:06 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:44500: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 07:24:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<qNojxd9Ffp8+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-14 07:24:21 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:49472: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 07:24:27 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (later) [174.166.153.20]:53080: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-14 07:25:46 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:39344: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-12-14 07:25:55 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:55114: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-12-14 07:25:58 dovecot_plain authenticator failed for (bulumencus) [2.74.194.86]:49591: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.96
country_id: 6252001
description:
Dec 14 07:27:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.96, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5byV0t9FO8tBMQFg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-14 07:27:59 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:59902: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.94
country_id: 6252001
description:
Dec 14 07:28:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.94, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DAmp099FRg5BMQFe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-14 07:28:19 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:35324: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-14 07:28:22 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-14 07:28:27 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (antmalles) [73.68.220.15]:60980: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-12-14 07:28:56 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:37508: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.173
country_id: 1733045
description:
2025-12-14 07:29:26 dovecot_login authenticator failed for ([49.124.152.173]) [49.124.152.173]:52104: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-14 07:31:58 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (alkwanty) [73.68.220.15]:51936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 14 07:33:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<0RBd599FirJog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2025-12-14 07:33:49 dovecot_login authenticator failed for (2-55-126-88.orange.net.il) [2.55.126.88]:39379: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-12-14 07:34:18 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:58789: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-12-14 07:34:27 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:56310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-14 07:34:39 dovecot_login authenticator failed for (221-169-97-62.cust.smartcall.no) [62.97.169.221]:50918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-14 07:34:53 dovecot_plain authenticator failed for (faling) [187.161.198.68]:32966: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.139
country_id: 6252001
description:
2025-12-14 07:37:41 dovecot_login authenticator failed for wsip-184-191-250-139.fv.ks.cox.net [184.191.250.139]:48127: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-14 07:37:54 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:38827: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-14 07:42:02 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (sestes) [78.68.37.25]:33427: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-14 07:42:34 dovecot_plain authenticator failed for (excruing) [65.20.205.197]:48645: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-14 07:43:24 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:40910: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-14 07:43:54 dovecot_login authenticator failed for (nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:47762: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-12-14 07:47:03 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:49688: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-14 07:47:34 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:45722: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 14 07:50:40 host2 sshd[2349746]: Disconnected from invalid user rancid 64.227.102.57 port 36366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-14 07:51:45 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:56661: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-12-14 07:51:56 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:54422: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 14 07:51:18 host2 sshd[2350159]: Disconnected from invalid user hamed 64.227.102.57 port 44482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 14 07:51:26 host2 sshd[2350221]: Disconnected from invalid user milan 137.184.30.179 port 33632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.24
country_id: 6252001
description:
2025-12-14 07:51:31 dovecot_login authenticator failed for ([72.214.133.24]) [72.214.133.24]:57556: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.244.65.106
country_id: 3595528
description:
2025-12-14 07:51:46 dovecot_plain authenticator failed for (E1261D68V5UP6) [74.244.65.106]:29973: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 14 07:53:00 host2 sshd[2351446]: Disconnected from invalid user jake 64.227.102.57 port 41622 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 158.94.210.79 - 2096 "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-14 07:53:04 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:53611: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-12-14 07:52:14 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:35858: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-14 07:53:19 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:51925: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 14 07:55:11 host2 sshd[2353529]: Disconnected from invalid user david 137.184.30.179 port 36014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 14 07:54:15 host2 sshd[2352469]: Disconnected from invalid user hamed 137.184.30.179 port 51674 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 14 07:54:38 host2 sshd[2353046]: Received disconnect from 137.184.30.179 port 42440:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 14 07:56:05 host2 sshd[2354097]: Disconnected from invalid user forge 201.76.120.30 port 35120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 14 07:56:30 host2 sshd[2354409]: Disconnected from invalid user arthur 64.227.102.57 port 58744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-12-14 07:57:26 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:64193: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-12-14 07:57:32 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:62184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-14 07:57:50 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:53771: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-14 07:58:20 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:43614: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 07:59:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<0V7PQ+BFAM2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-14 07:59:51 dovecot_login authenticator failed for ([84.213.188.130]) [84.213.188.130]:59049: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 14 07:59:18 host2 sshd[2356365]: Disconnected from invalid user user1 201.76.120.30 port 41034 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2025-12-14 07:59:29 dovecot_login authenticator failed for ([49.124.152.234]) [49.124.152.234]:48014: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-14 08:01:14 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (preotraced) [24.98.45.238]:59024: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.56.72.74
country_id: 2750405
description:
Dec 14 08:03:18 host2 sshd[2359539]: Disconnected from invalid user base 72.56.72.74 port 37458 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.56.72.74
country_id: 2750405
description:
Dec 14 08:04:36 host2 sshd[2360482]: Disconnected from invalid user ubuntu 72.56.72.74 port 60212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.56.72.74
country_id: 2750405
description:
Dec 14 08:05:37 host2 sshd[2361320]: Disconnected from invalid user logviewer 72.56.72.74 port 46208 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-14 08:07:33 dovecot_login authenticator failed for ([178.232.55.16]) [178.232.55.16]:56120: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-14 08:08:02 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:47970: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.231.145.72
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 45.231.145.72 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-14 08:08:52 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:48794: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-14 08:09:27 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [136.232.73.130]:38574: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-14 08:11:08 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:47110: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.122.69
country_id: 1269750
description:
2025-12-14 08:11:22 dovecot_login authenticator failed for (abts-mp-dynamic-069.122.168.122.airtelbroadband.in) [122.168.122.69]:43323: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.175.126.9
country_id: 1643084
description:
Dec 14 08:11:35 host2 sshd[2365854]: Disconnected from invalid user ftpuser 203.175.126.9 port 49212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.175.126.9
country_id: 1643084
description:
Dec 14 08:13:58 host2 sshd[2368346]: Disconnected from invalid user ubuntu 203.175.126.9 port 34994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-14 08:15:53 dovecot_login authenticator failed for ([128.185.223.36]) [182.95.178.122]:56180: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-14 08:15:54 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:55492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-14 08:16:08 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:36516: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-14 08:16:14 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:60331: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-14 08:17:18 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:43040: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2025-12-14 08:17:30 dovecot_login authenticator failed for 89-67-246-166.dynamic.play.pl [89.67.246.166]:43388: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-14 08:19:32 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (cutlism) [69.123.219.82]:36605: 535 Incorrect authentication data (set_id=backup@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-12-14 08:21:41 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:57408: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.74
country_id: 1149361
description:
2025-12-14 08:21:55 dovecot_login authenticator failed for ([149.54.51.74]) [149.54.51.74]:41701: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-14 08:22:27 dovecot_login authenticator failed for ([128.185.13.33]) [122.184.123.118]:56054: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.73
country_id: 1880251
description:
Dec 14 08:23:36 host2 sshd[2375390]: Disconnected from invalid user logviewer 101.47.162.73 port 59288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.21
country_id: 1733045
description:
2025-12-14 08:23:17 dovecot_login authenticator failed for ([49.124.153.21]) [49.124.153.21]:48578: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 08:23:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<7UQomeBFKO0+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.73
country_id: 1880251
description:
Dec 14 08:26:53 host2 sshd[2377670]: Disconnected from invalid user wfp 101.47.162.73 port 37640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 08:28:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Sjfdq+BFALE+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 08:29:03 host2 sshd[2379086]: Disconnected from invalid user admin 2.57.121.112 port 58473 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.201
country_id: 1733045
description:
2025-12-14 08:31:58 dovecot_login authenticator failed for ([49.124.148.201]) [49.124.148.201]:59956: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-14 08:31:12 dovecot_plain authenticator failed for (hypies) [65.20.205.197]:48495: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.73
country_id: 1880251
description:
Dec 14 08:31:19 host2 sshd[2380624]: Disconnected from invalid user ubuntu 101.47.162.73 port 42416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 08:31:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<wjskt+BFqNanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-14 08:32:13 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:54525: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.48
country_id: 6252001
description:
Dec 14 08:32:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.48, lip=66.85.158.91, TLS: Connection closed, session=<6pF8ueBFrnSnXpIw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-14 08:35:35 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:39790: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-14 08:35:47 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:46421: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.254
country_id: 3175395
description:
Dec 14 08:36:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.197.8.254, lip=66.85.158.91, TLS, session=<44brxeBFd4i5xQj+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.61.153.79
country_id: 2510769
description:
Dec 14 08:36:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.61.153.79, lip=66.85.158.91, TLS, session=<MdVBx+BFmoklPZlP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.222.126.213
country_id: 6252001
description:
2025-12-14 08:40:08 dovecot_login authenticator failed for c-73-222-126-213.hsd1.ca.comcast.net [73.222.126.213]:35371: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2025-12-14 08:40:19 dovecot_login authenticator failed for ([147.235.226.154]) [147.235.226.154]:60538: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-12-14 08:40:27 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:59354: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-14 08:40:47 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:48807: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-14 08:42:05 dovecot_login authenticator failed for (nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:56002: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.182
country_id: 1733045
description:
2025-12-14 08:41:43 dovecot_login authenticator failed for ([49.124.155.182]) [49.124.155.182]:34168: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Dec 14 08:43:57 host2 sshd[2388774]: Disconnected from invalid user ubuntu 152.32.144.167 port 59468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-14 08:43:35 dovecot_plain authenticator failed for (namal) [102.53.15.17]:60675: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec 14 08:44:55 host2 sshd[2389362]: Disconnected from invalid user james 157.245.55.165 port 54194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.87.211
country_id: 3865483
description:
Dec 14 08:44:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=190.181.87.211, lip=66.85.158.91, TLS, session=<Hg4F5eBFV9++tVfT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.149
country_id: 3175395
description:
Dec 14 08:45:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.15.169.149, lip=66.85.158.91, TLS, session=<QIlh5uBFbcq5D6mV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec 14 08:45:36 host2 sshd[2390132]: Disconnected from invalid user hb 157.245.55.165 port 41588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 14 08:45:45 host2 sshd[2390294]: Disconnected from invalid user ansible 190.181.27.22 port 43396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-14 08:46:23 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:49324: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-14 08:46:38 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:33244: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.123
country_id: 2635167
description:
2025-12-14 08:46:37 dovecot_login authenticator failed for (77-89-143-123.fluidata.co.uk) [77.89.143.123]:42278: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-14 08:46:50 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:47780: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.55.165
country_id: 1880251
description:
Dec 14 08:46:16 host2 sshd[2390724]: Disconnected from invalid user gitlab-runner 157.245.55.165 port 38350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Dec 14 08:47:30 host2 sshd[2391835]: Disconnected from invalid user james 152.32.144.167 port 39358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 14 08:48:03 host2 sshd[2392808]: Disconnected from invalid user grafana 190.181.27.22 port 49582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec 14 08:48:17 host2 sshd[2393410]: Disconnected from invalid user ubuntu 157.245.55.165 port 48970 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.11
country_id: 798549
description:
Dec 14 08:48:24 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.11, lip=66.85.158.91, session=<zgKH8uBF0YNV2YwL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 14 08:50:34 host2 sshd[2395472]: Disconnected from invalid user user22 190.181.27.22 port 43670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-12-14 08:55:38 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:32870: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.9
country_id: 1861060
description:
2025-12-14 08:55:59 dovecot_login authenticator failed for p160010-obmd01.osaka.ocn.ne.jp [61.112.103.9]:59712: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-14 08:59:37 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:34938: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.173.59.73
country_id: 1605651
description:
2025-12-14 08:59:49 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.173.59.73]:52825: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-14 09:00:01 dovecot_login authenticator failed for (cm-84.213.189.183.get.no) [84.213.189.183]:39113: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-12-14 09:04:10 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:60144: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.2
country_id: 798549
description:
Dec 14 09:03:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=85.217.140.2, lip=66.85.158.92, TLS: Connection closed, session=<mH2dKOFFtoNV2YwC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.248
country_id: 1733045
description:
2025-12-14 09:04:19 dovecot_login authenticator failed for ([49.124.150.248]) [49.124.150.248]:38580: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-12-14 09:04:32 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:40629: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-14 09:04:50 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:41936: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-14 09:05:40 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:41849: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.182
country_id: 6252001
description:
Dec 14 09:06:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.132.182, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gnazMeFFeNGTuYS2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-12-14 09:06:19 dovecot_login authenticator failed for (nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:51194: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.182
country_id: 6252001
description:
Dec 14 09:07:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.132.182, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3ZqYNeFF+PKTuYS2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-14 09:07:34 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:43680: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 09:07:37 host2 sshd[2408221]: Disconnected from invalid user  62.60.131.157 port 60802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-14 09:07:41 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:44090: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.182
country_id: 6252001
description:
Dec 14 09:07:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.132.182, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<hEqfNeFFBPOTuYS2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 212.73.148.17
country_id: 798549
description:
Dec 14 09:07:18 host2 pure-ftpd[2408061]: (?@212.73.148.17) [INFO] New connection from 212.73.148.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.84.186
country_id: 294640
description:
2025-12-14 09:09:57 dovecot_login authenticator failed for (2-54-84-186.orange.net.il) [2.54.84.186]:39897: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-14 09:11:06 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:56655: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-14 09:10:12 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:39203: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-14 09:10:54 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:58432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-12-14 09:13:22 dovecot_plain authenticator failed for (anplast) [50.217.40.11]:34002: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-14 09:13:35 dovecot_plain authenticator failed for (reately) [65.20.205.197]:58478: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.182
country_id: 6252001
description:
Dec 14 09:14:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.182, lip=66.85.158.91, TLS, session=<kxXUUOFFjPGTuYS2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.182
country_id: 6252001
description:
Dec 14 09:15:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.182, lip=66.85.158.91, TLS, session=<y4q2UuFFUuKTuYS2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 09:16:52 host2 sshd[2414325]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 09:17:13 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (buclarpes) [51.195.117.220]:63867: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-12-14 09:20:47 dovecot_login authenticator failed for ([149.54.33.130]) [149.54.33.130]:44519: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2025-12-14 09:24:47 dovecot_login authenticator failed for ([152.52.227.94]) [152.52.227.94]:50492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 09:28:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Lwslg+FFGrs+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-14 09:29:07 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:56048: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.40.236.31
country_id: 2510769
description:
2025-12-14 09:29:37 dovecot_login authenticator failed for 31.red-83-40-236.dynamicip.rima-tde.net [83.40.236.31]:46851: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-14 09:30:07 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:39536: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.54
country_id: 2186224
description:
2025-12-14 09:29:24 dovecot_login authenticator failed for ([121.73.162.54]) [121.73.162.54]:48134: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-12-14 09:29:37 dovecot_login authenticator failed for ([37.142.173.63]) [37.142.173.63]:57248: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-14 09:31:09 dovecot_login authenticator failed for ([152.52.14.137]) [182.79.89.14]:42648: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.4
country_id: 6252001
description:
Dec 14 09:31:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.4, lip=66.85.158.91, session=<su7CjeFFDMPCpGsE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.209
country_id: 2635167
description:
Dec 14 09:33:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.209, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gmllkuFFsNAjy9LR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.209
country_id: 2635167
description:
Dec 14 09:33:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.210.209, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<rlfzk+FF9vAjy9LR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Dec 14 09:33:45 host2 sshd[2425926]: Disconnected from invalid user fauzi 35.188.112.111 port 36510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-12-14 09:35:42 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:42146: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-14 09:36:05 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:52726: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-14 09:35:30 dovecot_login authenticator failed for (cm-84.211.12.159.get.no) [84.211.12.159]:44747: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-12-14 09:35:35 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:46650: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.94.234.151
country_id: 6252001
description:
Dec 14 09:36:59 host2 sshd[2427882]: Disconnected from invalid user smbuser 74.94.234.151 port 42654 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 14 09:38:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<Ra9cpOFFkIzCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 14 09:37:12 host2 sshd[2428028]: Disconnected from invalid user steam 45.78.221.78 port 53592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Dec 14 09:37:39 host2 sshd[2428330]: Disconnected from invalid user myuser 35.188.112.111 port 56510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Dec 14 09:38:14 host2 sshd[2428783]: Disconnected from invalid user mrodelo 74.94.234.151 port 39644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.209
country_id: 2635167
description:
Dec 14 09:39:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.209, lip=66.85.158.92, TLS, session=<DxMmqeFFfOQjy9LR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.188.112.111
country_id: 6252001
description:
Dec 14 09:39:45 host2 sshd[2429462]: Disconnected from invalid user mrodelo 35.188.112.111 port 55352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 14 09:39:51 host2 sshd[2429493]: Disconnected from invalid user postgres 45.78.221.78 port 35910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Dec 14 09:39:15 host2 sshd[2429283]: Disconnected from invalid user dal 35.188.112.111 port 53184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Dec 14 09:40:43 host2 sshd[2430089]: Disconnected from invalid user steam 35.188.112.111 port 40492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-14 09:40:55 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:39032: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-14 09:41:29 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:49623: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-14 09:41:57 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:37484: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 14 09:42:29 host2 sshd[2430779]: Disconnected from invalid user testuser 45.78.221.78 port 35778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-12-14 09:44:26 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:44424: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-14 09:44:38 dovecot_login authenticator failed for ([128.185.13.33]) [122.184.123.118]:45476: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-14 09:44:13 dovecot_login authenticator failed for (cm-84.213.189.183.get.no) [84.213.189.183]:38491: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-12-14 09:45:23 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:48224: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2025-12-14 09:45:52 dovecot_plain authenticator failed for (ovessuped) [50.215.95.14]:34522: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 09:49:05 host2 sshd[2434573]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-14 09:48:46 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:43126: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.75.158.168
country_id: 6252001
description:
Dec 14 09:48:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=994) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=34.75.158.168, lip=66.85.158.91, session=<kuW8yuFFXuAiS56o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-14 09:48:51 dovecot_plain authenticator failed for (unpose) [12.150.243.22]:31437: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-14 09:48:54 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (sphiprowes) [73.196.144.25]:60808: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-14 09:48:32 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:50088: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-12-14 09:53:19 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:46174: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-14 09:53:27 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:10551: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-14 09:53:40 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:52608: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-14 09:53:56 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:33701: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 09:54:16 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:61836: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-14 09:54:27 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:34542: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 14 09:57:17 host2 sshd[2439306]: Disconnected from invalid user onkar 104.152.40.8 port 46808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 14 09:57:49 host2 sshd[2439475]: Disconnected from invalid user myuser 45.78.221.78 port 37366 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.211.103
country_id: 798544
description:
Dec 14 09:58:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=109.125.211.103, lip=66.85.158.91, TLS, session=<X0g77OFFBq9tfdNn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-14 09:58:45 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:53112: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.172
country_id: 3469034
description:
Dec 14 09:58:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=191.240.96.172, lip=66.85.158.91, TLS, session=<v61Q7eFFk4m/8GCs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-14 09:59:00 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:40880: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.121.205
country_id: 294640
description:
2025-12-14 09:59:33 dovecot_login authenticator failed for ([46.210.121.205]) [46.210.121.205]:49114: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 10:00:23 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60509: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-14 10:00:25 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:41132: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 14 10:00:53 host2 sshd[2441354]: Disconnected from invalid user azure 104.152.40.8 port 45192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 14 10:02:10 host2 sshd[2442145]: Disconnected from invalid user qwe 104.152.40.8 port 42400 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-14 10:03:10 dovecot_login authenticator failed for (200-168-249-9.sconline.com.br) [187.50.226.182]:41478: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.87
country_id: 6252001
description:
Dec 14 10:03:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.87, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yOJY/uFF58bG6xhX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.6
country_id: 1269750
description:
2025-12-14 10:03:31 dovecot_login authenticator failed for ([182.95.85.221]) [182.95.124.6]:59634: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 14 10:04:09 host2 sshd[2443689]: Disconnected from invalid user ali 104.152.40.8 port 52328 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 10:05:06 host2 sshd[2444504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 14 10:04:45 host2 sshd[2444141]: Disconnected from invalid user ops 27.111.32.174 port 45342 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 14 10:06:10 host2 sshd[2445236]: Disconnected from invalid user server 27.111.32.174 port 42080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.17
country_id: 6252001
description:
2025-12-14 10:08:42 dovecot_login authenticator failed for wsip-184-191-243-17.fv.ks.cox.net [184.191.243.17]:54825: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-14 10:09:21 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:44474: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.158.161
country_id: 3932488
description:
Dec 14 10:09:33 host2 sshd[2447467]: Disconnected from invalid user guest 38.19.158.161 port 46100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-14 10:09:11 dovecot_plain authenticator failed for (brinast) [12.150.243.22]:7150: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.158.161
country_id: 3932488
description:
Dec 14 10:10:14 host2 sshd[2448071]: Disconnected from invalid user mutua 38.19.158.161 port 58838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.158.161
country_id: 3932488
description:
Dec 14 10:13:28 host2 sshd[2450208]: Disconnected from invalid user ubuntu 38.19.158.161 port 37960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 10:14:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<fVDtJOJFlNU+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-14 10:14:21 dovecot_plain authenticator failed for (brisarcal) [88.149.153.106]:48787: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Dec 14 10:14:52 host2 sshd[2451225]: Disconnected from invalid user appuser 118.26.36.195 port 59674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 14 10:16:20 host2 sshd[2452373]: Disconnected from invalid user hadoop 103.210.21.178 port 60950 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.36.195
country_id: 1819730
description:
Dec 14 10:16:44 host2 sshd[2452583]: Disconnected from invalid user ubuntu 118.26.36.195 port 47588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Dec 14 10:17:58 host2 sshd[2453366]: Disconnected from invalid user mutua 118.26.36.195 port 38740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2025-12-14 10:18:00 dovecot_login authenticator failed for ([167.250.118.12]) [167.250.118.12]:54858: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-14 10:18:17 dovecot_login authenticator failed for (201.173.250.36-clientes-izzi.mx) [201.173.250.36]:35450: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.168
country_id: 3996063
description:
2025-12-14 10:18:21 dovecot_login authenticator failed for ([177.236.146.168]) [177.236.146.168]:36201: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 14 10:18:37 host2 sshd[2453820]: Disconnected from invalid user f 103.210.21.178 port 60686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-14 10:18:42 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:37610: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-14 10:18:58 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:40934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 14 10:19:44 host2 sshd[2454340]: Disconnected from invalid user liming 103.210.21.178 port 57394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-14 10:20:42 dovecot_plain authenticator failed for (mobens) [176.113.155.132]:42273: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Dec 14 10:20:48 host2 sshd[2455021]: Disconnected from invalid user admin 116.71.135.53 port 49748 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.71.135.53
country_id: 1168579
description:
Dec 14 10:22:46 host2 sshd[2456270]: Disconnected from invalid user admin1 116.71.135.53 port 44680 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 10:23:28 dovecot_login authenticator failed for vps-f9a28e39.vps.ovh.net [51.195.117.220]:11920: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-14 10:23:42 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:34172: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 10:24:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ATffSeJF+NQDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-14 10:25:01 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:34882: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 10:25:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5wGKTuJFAr0DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Dec 14 10:26:21 host2 sshd[2458471]: Disconnected from invalid user myappuser 103.233.206.154 port 34537 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Dec 14 10:26:30 host2 sshd[2458577]: Disconnected from invalid user sai 116.71.135.53 port 34520 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 10:28:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<GGueV+JFSOQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.77.158
country_id: 2921044
description:
Dec 14 10:28:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=68.183.77.158, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rHbTWOJFGEtEt02e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.28
country_id: 3469034
description:
Dec 14 10:30:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=177.44.71.28, lip=66.85.158.91, TLS, session=<vQEqXeJFZeuxLEcc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 10:30:40 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<DpBEYOJFNuQDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-14 10:30:44 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (abing) [69.142.126.37]:57784: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.148
country_id: 3469034
description:
Dec 14 10:30:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.246.148, lip=66.85.158.91, TLS, session=<DTNhXuJF77K60faU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 10:31:41 host2 sshd[2462155]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-14 10:34:12 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:48286: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 10:33:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<w2NTa+JFtOEDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-14 10:34:49 dovecot_plain authenticator failed for (sarke) [65.20.233.110]:47787: 535 Incorrect authentication data (set_id=noreply@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-14 10:34:28 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:51164: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 10:34:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<6ugLb+JF+K8DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 10:34:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<rALXbuJF6I8+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 10:36:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<5Ka1duJFupgDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-14 10:37:36 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:54008: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Dec 14 10:37:39 host2 sshd[2466138]: Disconnected from invalid user wj 103.233.206.154 port 34875 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-12-14 10:37:49 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:58106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 10:39:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=</JE/gOJFeM4+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-14 10:42:35 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:41024: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-14 10:42:51 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:33317: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-14 10:42:55 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:57195: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-12-14 10:43:37 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:35940: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.200.137.70
country_id: 1694008
description:
2025-12-14 10:45:13 dovecot_plain authenticator failed for ([89.116.164.85]) [112.200.137.70]:4394: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.17.51.73
country_id: 3469034
description:
2025-12-14 10:44:57 dovecot_plain authenticator failed for ([89.116.164.85]) [177.17.51.73]:38191: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.72.126
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.117.72.126 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.51.248.183
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.51.248.183 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.5.33.76
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.5.33.76 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.39.4.60
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 186.39.4.60 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.19.142.49
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.19.142.49 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.188.74.198
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.188.74.198 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.67.154
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.189.67.154 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.200.137.70
country_id: 1694008
description:
2025-12-14 10:45:20 dovecot_login authenticator failed for ([89.116.164.85]) [112.200.137.70]:4394: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.57.243
country_id: 1733045
description:
2025-12-14 10:45:28 dovecot_plain authenticator failed for ([89.116.164.85]) [121.121.57.243]:1834: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 10:46:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<dtkqmOJFwpSnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.47.11.11
country_id: 1269750
description:
2025-12-14 10:47:17 dovecot_plain authenticator failed for ([89.116.164.85]) [49.47.11.11]:48359: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.20.190.223
country_id: 1605651
description:
2025-12-14 10:47:32 dovecot_plain authenticator failed for ([89.116.164.85]) [1.20.190.223]:34702: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.180.120.242
country_id: 3469034
description:
2025-12-14 10:47:46 dovecot_plain authenticator failed for ([89.116.164.85]) [187.180.120.242]:50119: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-14 10:49:06 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:40814: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-14 10:49:12 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:56773: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-14 10:49:50 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:43812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Dec 14 10:52:48 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, session=<wZFqr+JFgLRQUk2L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.78.89.25
country_id: 298795
description:
Dec 14 10:53:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=94.78.89.25, lip=66.85.158.91, TLS, session=<Oe3/r+JFFsReTlkZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.6.214
country_id: 3077311
description:
Dec 14 10:53:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=31.222.6.214, lip=66.85.158.91, TLS, session=<baoWseJFwMAf3gbW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.57.91.32
country_id: 1269750
description:
2025-12-14 10:55:18 dovecot_plain authenticator failed for ([89.116.164.85]) [152.57.91.32]:58612: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.63
country_id: 6252001
description:
Dec 14 10:55:28 host2 pure-ftpd[2478899]: (?@167.94.146.63) [INFO] New connection from 167.94.146.63


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.133.201.107
country_id: 3469034
description:
2025-12-14 10:55:32 dovecot_plain authenticator failed for ([89.116.164.85]) [177.133.201.107]:50032: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 10:55:43 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (sweamuls) [96.230.65.90]:56430: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-14 10:55:47 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (kousker) [73.137.7.97]:50336: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.137.1
country_id: 3865483
description:
2025-12-14 10:55:46 dovecot_plain authenticator failed for ([89.116.164.85]) [186.158.137.1]:29585: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.235
country_id: 1880251
description:
Dec 14 10:56:36 host2 sshd[2479686]: Disconnected from invalid user user1 45.78.200.235 port 35892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.230.47.216
country_id: 3996063
description:
Dec 14 10:57:46 host2 sshd[2480463]: Disconnected from invalid user guest 187.230.47.216 port 56502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.57.121
country_id: 3658394
description:
2025-12-14 10:57:59 dovecot_plain authenticator failed for ([89.116.164.85]) [201.183.57.121]:39443: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.65.55
country_id: 1527747
description:
2025-12-14 10:58:12 dovecot_plain authenticator failed for ([89.116.164.85]) [95.87.65.55]:60526: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-14 10:58:43 dovecot_login authenticator failed for ([177.239.160.152]) [177.239.160.152]:35785: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.230.47.216
country_id: 3996063
description:
Dec 14 10:59:09 host2 sshd[2481425]: Disconnected from invalid user ftpupload 187.230.47.216 port 51630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.65.55
country_id: 1527747
description:
2025-12-14 10:58:20 dovecot_login authenticator failed for ([89.116.164.85]) [95.87.65.55]:60526: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-12-14 10:58:20 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:41372: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.36.150.189
country_id: 3865483
description:
2025-12-14 10:58:25 dovecot_plain authenticator failed for ([89.116.164.85]) [179.36.150.189]:52420: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.157
country_id: 6252001
description:
Dec 14 11:00:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=40.124.173.157, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YHjly+JFvNcofK2d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.128.94.19
country_id: 3865483
description:
2025-12-14 11:01:07 dovecot_plain authenticator failed for ([89.116.164.85]) [186.128.94.19]:59702: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.104.1.216
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 200.104.1.216 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-14 11:02:29 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:39840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.37.242
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.114.37.242 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.230.47.216
country_id: 3996063
description:
Dec 14 11:02:37 host2 sshd[2483580]: Disconnected from invalid user ubuntu 187.230.47.216 port 54692 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.19.225
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 51.36.19.225 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.158.115
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.190.158.115 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.48.168.237
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 60.48.168.237 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.163.198.183
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.163.198.183 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.61.124.173
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 196.61.124.173 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.235
country_id: 1880251
description:
Dec 14 11:05:18 host2 sshd[2485751]: Disconnected from invalid user security 45.78.200.235 port 42172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.59.212
country_id: 3469034
description:
2025-12-14 11:05:51 dovecot_plain authenticator failed for ([89.116.164.85]) [138.118.59.212]:29166: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.60.196.218
country_id: 3865483
description:
2025-12-14 11:06:04 dovecot_plain authenticator failed for ([89.116.164.85]) [179.60.196.218]:44572: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-14 11:07:00 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:44744: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-12-14 11:07:08 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:55504: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.128.33
country_id: 3469034
description:
2025-12-14 11:06:19 dovecot_plain authenticator failed for 177-0-128-33.user3p.v-tal.net.br ([89.116.164.85]) [177.0.128.33]:52861: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.200.235
country_id: 1880251
description:
Dec 14 11:06:37 host2 sshd[2486620]: Disconnected from invalid user readarr 45.78.200.235 port 38936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.16
country_id: 1733045
description:
2025-12-14 11:06:55 dovecot_login authenticator failed for ([49.124.151.16]) [49.124.151.16]:32908: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-12-14 11:07:16 dovecot_login authenticator failed for ([195.158.14.232]) [195.158.14.232]:58958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-14 11:07:21 dovecot_plain authenticator failed for (lorgizes) [65.20.133.208]:57966: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.201
country_id: 6252001
description:
Dec 14 11:08:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.201, lip=66.85.158.92, TLS, session=<Nb0F5uJFPvTN0h/J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-14 11:08:28 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:47178: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-14 11:08:50 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:36885: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.228.59
country_id: 1282988
description:
2025-12-14 11:09:51 dovecot_plain authenticator failed for ([89.116.164.85]) [103.176.228.59]:60114: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.188.22.203
country_id: 6252001
description:
2025-12-14 11:10:03 dovecot_plain authenticator failed for c-67-188-22-203.hsd1.ca.comcast.net ([89.116.164.85]) [67.188.22.203]:35774: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.192.4.33
country_id: 3469034
description:
2025-12-14 11:10:15 dovecot_plain authenticator failed for ([89.116.164.85]) [177.192.4.33]:10241: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.192.4.33
country_id: 3469034
description:
2025-12-14 11:10:22 dovecot_login authenticator failed for ([89.116.164.85]) [177.192.4.33]:10241: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-12-14 11:13:12 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:59861: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-14 11:13:25 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:50801: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-14 11:13:47 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:52474: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.216
country_id: 6252001
description:
2025-12-14 11:14:13 dovecot_login authenticator failed for wsip-184-191-242-216.fv.ks.cox.net [184.191.242.216]:46116: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-14 11:14:31 dovecot_login authenticator failed for ([149.232.203.22]) [149.232.203.22]:58562: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 14 11:19:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<HwQ+DeNFGM7BHmEh>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 185.86.244.158
country_id: 298795
description:
Denial of Service (DoS) attack was discovered from 185.86.244.158: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-14 11:20:55 dovecot_plain authenticator failed for (unrefism) [80.227.147.94]:43518: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.183.234
country_id: 3686110
description:
2025-12-14 11:22:12 dovecot_plain authenticator failed for ([89.116.164.85]) [45.238.183.234]:1682: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.183.234
country_id: 3686110
description:
2025-12-14 11:22:19 dovecot_login authenticator failed for ([89.116.164.85]) [45.238.183.234]:1682: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.190.175.237
country_id: 3865483
description:
2025-12-14 11:22:26 dovecot_plain authenticator failed for ([89.116.164.85]) [201.190.175.237]:54872: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.244.152.210
country_id: 99237
description:
2025-12-14 11:22:40 dovecot_plain authenticator failed for ([89.116.164.85]) [185.244.152.210]:46164: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.22
country_id: 1733045
description:
2025-12-14 11:23:54 dovecot_login authenticator failed for ([49.124.148.22]) [49.124.148.22]:36280: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-14 11:23:17 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:60312: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-14 11:26:13 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (miard) [73.213.236.66]:51148: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-14 11:26:43 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com (prion) [24.97.253.246]:58248: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.28
country_id: 1733045
description:
2025-12-14 11:28:03 dovecot_login authenticator failed for ([49.124.151.28]) [49.124.151.28]:36558: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.19.170
country_id: 1269750
description:
2025-12-14 11:27:21 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:57896: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.166.19
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 217.154.166.19 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-14 11:29:02 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (bilee) [24.91.103.202]:40624: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.15
country_id: 6252001
description:
2025-12-14 11:32:13 dovecot_login authenticator failed for wsip-184-191-243-15.fv.ks.cox.net [184.191.243.15]:50932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-14 11:31:21 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (presit) [174.169.224.27]:38836: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 11:31:43 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (pauce) [174.166.153.20]:38568: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-12-14 11:32:06 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:40520: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.243
country_id: 6252001
description:
Dec 14 11:32:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.243, lip=66.85.158.91, session=<xPRNPONFxMAUQGnz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.135.26.64
country_id: 953987
description:
2025-12-14 11:32:15 dovecot_plain authenticator failed for ([89.116.164.85]) [41.135.26.64]:59278: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.33.157
country_id: 3469034
description:
2025-12-14 11:32:36 dovecot_plain authenticator failed for 45-228-33-157.acbinfo.net.br ([89.116.164.85]) [45.228.33.157]:7835: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.95.178.254
country_id: 3469034
description:
2025-12-14 11:32:48 dovecot_plain authenticator failed for ([89.116.164.85]) [200.95.178.254]:65141: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-14 11:33:08 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:44098: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-12-14 11:32:26 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:39114: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.127.23.95
country_id: 1269750
description:
2025-12-14 11:32:35 dovecot_plain authenticator failed for ([89.116.164.85]) [103.127.23.95]:59856: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.0.164.240
country_id: 6252001
description:
2025-12-14 11:33:00 dovecot_plain authenticator failed for h72-0-164-240.bendor.broadband.dynamic.tds.net ([89.116.164.85]) [72.0.164.240]:51200: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-14 11:33:22 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:58894: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.128.83
country_id: 6252001
description:
Dec 14 11:33:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.128.83, lip=66.85.158.92, session=<uTLBQONFpIpK+YBT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.123
country_id: 3865483
description:
Dec 14 11:33:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=45.238.107.123, lip=66.85.158.91, TLS, session=<XNNLQONFHdEt7mt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.23.200.37
country_id: 1643084
description:
Dec 14 11:33:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=103.23.200.37, lip=66.85.158.91, TLS, session=<326gQeNFfZBnF8gl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.62.248.21
country_id: 2921044
description:
[2025-12-14 11:34:14 +0530] info [cpaneld] 194.62.248.21 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.246.144.53
country_id: 3508796
description:
2025-12-14 11:36:01 dovecot_plain authenticator failed for ([89.116.164.85]) [38.246.144.53]:53094: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.51.80.219
country_id: 1282988
description:
2025-12-14 11:36:08 dovecot_plain authenticator failed for ([89.116.164.85]) [202.51.80.219]:41852: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.121.125.2
country_id: 630336
description:
2025-12-14 11:36:12 dovecot_plain authenticator failed for mm-2-125-121-178.mgts.dynamic.pppoe.byfly.by ([89.116.164.85]) [178.121.125.2]:6016: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.133
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.133: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.181.40.26
country_id: 1269750
description:
2025-12-14 11:35:49 dovecot_plain authenticator failed for ([89.116.164.85]) [223.181.40.26]:29185: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.80.207.77
country_id: 3865483
description:
2025-12-14 11:35:52 dovecot_plain authenticator failed for ([89.116.164.85]) [191.80.207.77]:36881: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.172.145.144
country_id: 3351879
description:
2025-12-14 11:36:47 dovecot_plain authenticator failed for ([89.116.164.85]) [105.172.145.144]:43064: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-14 11:36:55 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (bable) [68.40.189.43]:45834: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.118.56
country_id: 1733045
description:
2025-12-14 11:37:02 dovecot_plain authenticator failed for ([89.116.164.85]) [161.142.118.56]:22998: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.121.125.2
country_id: 630336
description:
2025-12-14 11:36:19 dovecot_login authenticator failed for mm-2-125-121-178.mgts.dynamic.pppoe.byfly.by ([89.116.164.85]) [178.121.125.2]:6016: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.15.204.181
country_id: 3624060
description:
2025-12-14 11:36:24 dovecot_plain authenticator failed for ip181-204-15-186.ct.co.cr ([89.116.164.85]) [186.15.204.181]:7649: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 14 11:36:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jHBzS+NFw/4t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.191.62.108
country_id: 3469034
description:
2025-12-14 11:36:32 dovecot_plain authenticator failed for ([89.116.164.85]) [38.191.62.108]:51622: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-14 11:37:47 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:56814: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 11:38:39 host2 sshd[2505710]: Disconnected from invalid user user 2.57.121.25 port 47493 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-14 11:38:46 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:44572: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-14 11:39:13 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:42402: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-14 11:38:32 dovecot_login authenticator failed for ([125.19.248.170]) [125.19.248.170]:39310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.162.180
country_id: 6252001
description:
Dec 14 11:42:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.15.162.180, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EN9PYuNFarwUD6K0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-14 11:43:34 dovecot_plain authenticator failed for (asionility) [5.11.143.72]:35632: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 11:48:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<bRMNduNFpq8+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 11:51:44 host2 sshd[2514108]: Disconnected from invalid user  62.60.131.157 port 6342 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 11:53:57 host2 sshd[2515504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-14 11:53:51 dovecot_plain authenticator failed for (brundes) [65.20.133.4]:56214: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 11:54:38 host2 sshd[2516291]: Disconnected from invalid user admin 2.57.121.112 port 5097 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.160.195.241
country_id: 3895114
description:
2025-12-14 11:55:30 dovecot_plain authenticator failed for 181-160-195-241.fo.baf.movistar.cl ([89.116.164.85]) [181.160.195.241]:49990: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.60.143.247
country_id: 3469034
description:
2025-12-14 11:55:43 dovecot_plain authenticator failed for 179-60-143-247.attentonet.net.br ([89.116.164.85]) [179.60.143.247]:54380: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.47.138.174
country_id: 587116
description:
2025-12-14 11:55:56 dovecot_plain authenticator failed for ([89.116.164.85]) [212.47.138.174]:4304: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-14 11:57:10 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (latertful) [71.230.228.16]:48196: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-14 11:56:23 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:54254: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-14 11:56:39 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:59905: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.19.166
country_id: 290557
description:
2025-12-14 11:56:43 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:37567: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 11:56:49 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (nobibirk) [96.230.65.90]:45346: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-14 11:56:57 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:48284: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Dec 14 11:57:51 host2 sshd[2518169]: Disconnected from invalid user web1 137.184.145.163 port 41698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-12-14 11:57:58 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:55481: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 14 12:01:41 host2 sshd[2520227]: Disconnected from invalid user systemd 187.210.77.100 port 40916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-14 12:01:46 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:50534: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.105.242
country_id: 6252001
description:
Dec 14 12:01:51 host2 pure-ftpd[2520334]: (?@20.64.105.242) [INFO] New connection from 20.64.105.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-12-14 12:02:15 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:60319: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-12-14 12:02:36 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:61605: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Dec 14 12:03:10 host2 sshd[2521260]: Disconnected from invalid user localuser 103.103.245.7 port 60252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.13.134
country_id: 6251999
description:
Dec 14 12:02:15 host2 sshd[2520496]: Disconnected from invalid user adnan 144.217.13.134 port 40912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 14 12:02:24 host2 sshd[2520587]: Disconnected from invalid user oracle 198.46.207.98 port 49860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Dec 14 12:04:06 host2 sshd[2521881]: Disconnected from invalid user admin 178.128.243.225 port 47886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-12-14 12:03:22 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:50406: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Dec 14 12:03:52 host2 sshd[2521756]: Disconnected from invalid user oracle 137.184.145.163 port 45818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 14 12:04:38 host2 sshd[2522075]: Disconnected from invalid user lihui 187.210.77.100 port 48682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.244.25.137
country_id: 3469034
description:
2025-12-14 12:05:10 dovecot_plain authenticator failed for ([89.116.164.85]) [170.244.25.137]:32943: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.63.226.163
country_id: 2510769
description:
2025-12-14 12:05:13 dovecot_plain authenticator failed for ([89.116.164.85]) [47.63.226.163]:57046: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 14 12:05:15 host2 sshd[2522525]: Disconnected from invalid user rsync 198.46.207.98 port 48096 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.244.25.137
country_id: 3469034
description:
2025-12-14 12:05:17 dovecot_login authenticator failed for ([89.116.164.85]) [170.244.25.137]:32943: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 14 12:06:11 host2 sshd[2523092]: Disconnected from invalid user jb 187.210.77.100 port 36484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.202.105.65
country_id: 1694008
description:
2025-12-14 12:05:24 dovecot_plain authenticator failed for ([89.116.164.85]) [112.202.105.65]:18632: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.22.141.235
country_id: 1605651
description:
2025-12-14 12:05:28 dovecot_plain authenticator failed for ([89.116.164.85]) [184.22.141.235]:38710: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.62.102.170
country_id: 3469034
description:
2025-12-14 12:05:41 dovecot_plain authenticator failed for ([89.116.164.85]) [177.62.102.170]:41254: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.63.226.163
country_id: 2510769
description:
2025-12-14 12:05:20 dovecot_login authenticator failed for ([89.116.164.85]) [47.63.226.163]:57046: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Dec 14 12:06:25 host2 sshd[2523253]: Disconnected from invalid user vtatis 137.184.145.163 port 38094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.13.134
country_id: 6251999
description:
Dec 14 12:06:33 host2 sshd[2523323]: Disconnected from invalid user admin 144.217.13.134 port 48450 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 137.184.145.163
country_id: 6252001
description:
Dec 14 12:06:55 host2 sshd[2523491]: Received disconnect from 137.184.145.163 port 35018:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 14 12:06:18 host2 sshd[2523181]: Disconnected from invalid user kibana 198.46.207.98 port 57956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Dec 14 12:07:17 host2 sshd[2523723]: Disconnected from invalid user cloud 103.103.245.7 port 42688 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.145.163
country_id: 6252001
description:
Dec 14 12:07:26 host2 sshd[2523899]: Disconnected from invalid user plexuser 137.184.145.163 port 48356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-14 12:07:32 dovecot_plain authenticator failed for (pannist) [5.11.143.72]:33348: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 14 12:07:39 host2 sshd[2524031]: Disconnected from invalid user sangoma 187.210.77.100 port 49968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.13.134
country_id: 6251999
description:
Dec 14 12:08:49 host2 sshd[2524779]: Disconnected from invalid user localuser 144.217.13.134 port 52516 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 12:08:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4Fidv+NFdJM+PIdf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.63.64.50
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.63.64.50 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.217.13.134
country_id: 6251999
description:
Dec 14 12:10:03 host2 sshd[2525535]: Disconnected from invalid user thor 144.217.13.134 port 53224 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.39.229.123
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 51.39.229.123 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.13.134
country_id: 6251999
description:
Dec 14 12:09:26 host2 sshd[2525139]: Disconnected from invalid user cloud 144.217.13.134 port 60348 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.96.217
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.96.217 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.165.115.230
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 165.165.115.230 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.71.36.177
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.71.36.177 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.127.202.73
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.127.202.73 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.17.167.228
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.17.167.228 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.132
country_id: 3469034
description:
Dec 14 12:10:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.89.137.132, lip=66.85.158.91, TLS, session=</bD6wuNF0pm+WYmE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Dec 14 12:10:39 host2 sshd[2525880]: Disconnected from invalid user thor 178.128.243.225 port 34534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.132
country_id: 3865483
description:
Dec 14 12:10:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.252.132, lip=66.85.158.91, TLS, session=<gZJPxONF9LCzAPyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-14 12:11:40 dovecot_plain authenticator failed for (caurail) [64.53.7.231]:49252: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 14 12:11:49 host2 sshd[2526438]: Disconnected from invalid user dd 187.210.77.100 port 47372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.123.109.153
country_id: 1269750
description:
Dec 14 12:11:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=45.123.109.153, lip=66.85.158.91, TLS, session=<nyMGyeNFSOIte22Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-14 12:11:54 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:33318: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.75.215.245
country_id: 1269750
description:
Dec 14 12:12:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<washeera>, method=PLAIN, rip=182.75.215.245, lip=66.85.158.91, session=<KPvKyuNFZNi2S9f1>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 178.128.243.225
country_id: 2750405
description:
Dec 14 12:12:10 host2 sshd[2526661]: Received disconnect from 178.128.243.225 port 47000:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-14 12:11:39 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:47532: 535 Incorrect authentication data (set_id=infos@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.150.135.19
country_id: 690791
description:
Dec 14 12:11:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=178.150.135.19, lip=66.85.158.91, session=<Vt+9yONFeHmylocT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.105
country_id: 3469034
description:
Dec 14 12:11:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.120.76.105, lip=66.85.158.91, TLS, session=<IXbxyONFkr27eExp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Dec 14 12:12:10 host2 sshd[2526661]: Disconnected from invalid user yogesh 178.128.243.225 port 47000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.29
country_id: 3469034
description:
Dec 14 12:11:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.246.29, lip=66.85.158.91, TLS, session=<fr/Mx+NFTMe60fYd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-14 12:13:25 dovecot_plain authenticator failed for (intica) [5.76.44.40]:38317: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Dec 14 12:14:31 host2 sshd[2528403]: Disconnected from invalid user adnan 103.103.245.7 port 35702 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-14 12:14:55 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (grise) [71.224.169.28]:38046: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-12-14 12:15:13 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:33663: 535 Incorrect authentication data (set_id=infos@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-12-14 12:16:28 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:46945: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Dec 14 12:17:09 host2 sshd[2529785]: Disconnected from invalid user ubuntu 40.74.115.25 port 51178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec 14 12:17:11 host2 sshd[2529790]: Disconnected from invalid user ftpadmin 182.180.57.212 port 34188 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.74.115.25
country_id: 1861060
description:
Dec 14 12:18:41 host2 sshd[2530716]: Disconnected from invalid user postgres 40.74.115.25 port 34380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.6
country_id: 1269750
description:
2025-12-14 12:20:10 dovecot_login authenticator failed for ([182.66.251.185]) [182.95.124.6]:40776: 535 Incorrect authentication data (set_id=infos@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-14 12:20:11 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:45001: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Dec 14 12:19:23 host2 sshd[2531107]: Disconnected from invalid user mehrdad 40.74.115.25 port 52610 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-14 12:19:58 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:47122: 535 Incorrect authentication data (set_id=infos@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 12:20:32 host2 sshd[2531819]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Dec 14 12:20:47 host2 sshd[2531946]: Disconnected from invalid user vpn 40.74.115.25 port 49068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Dec 14 12:21:03 host2 sshd[2532147]: Disconnected from invalid user dev 103.103.245.7 port 44028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec 14 12:21:22 host2 sshd[2532400]: Disconnected from invalid user mehrdad 182.180.57.212 port 46590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2025-12-14 12:21:25 dovecot_login authenticator failed for ([87.200.94.102]) [87.200.94.102]:38199: 535 Incorrect authentication data (set_id=infos@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-14 12:21:38 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:55789: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec 14 12:22:43 host2 sshd[2533215]: Disconnected from invalid user elasticsearch 182.180.57.212 port 60144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.36.177.98
country_id: 3469034
description:
2025-12-14 12:22:46 dovecot_plain authenticator failed for ([89.116.164.85]) [177.36.177.98]:65057: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.94.14
country_id: 3469034
description:
2025-12-14 12:22:59 dovecot_plain authenticator failed for ([89.116.164.85]) [45.173.94.14]:14102: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.32.15
country_id: 3895114
description:
2025-12-14 12:23:12 dovecot_plain authenticator failed for ([89.116.164.85]) [190.114.32.15]:59084: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.180.57.212
country_id: 1168579
description:
Dec 14 12:24:49 host2 sshd[2534470]: Disconnected from invalid user user04 182.180.57.212 port 58972 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 14 12:24:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<xFwh9+NFe//CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.192
country_id: 1269750
description:
2025-12-14 12:25:43 dovecot_login authenticator failed for (nsg-corporate-192.230.187.122.airtel.in) [122.187.230.192]:57573: 535 Incorrect authentication data (set_id=infos@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-14 12:25:56 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:60407: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.248
country_id: 6252001
description:
2025-12-14 12:26:25 dovecot_login authenticator failed for ([98.185.121.248]) [98.185.121.248]:39544: 535 Incorrect authentication data (set_id=infos@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-12-14 12:26:40 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:38312: 535 Incorrect authentication data (set_id=infos)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.249.194.134
country_id: 2960313
description:
[2025-12-14 12:30:56 +0530] info [whostmgrd] 178.249.194.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.94.153.63
country_id: 6251999
description:
[2025-12-14 12:30:47 +0530] info [cpaneld] 65.94.153.63 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.221
country_id: 6252001
description:
Dec 14 12:30:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zkv6DeRFAdPG6xjd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.199.252.173
country_id: 1282988
description:
[2025-12-14 12:30:53 +0530] info [cpaneld] 113.199.252.173 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.255.29
country_id: 99237
description:
[2025-12-14 12:30:54 +0530] info [cpaneld] 62.201.255.29 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.21.232.99
country_id: 3895114
description:
[2025-12-14 12:30:57 +0530] info [cpaneld] 186.21.232.99 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.54.109
country_id: 3865483
description:
[2025-12-14 12:30:59 +0530] info [cpaneld] 186.22.54.109 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.112.111.207
country_id: 1562822
description:
[2025-12-14 12:31:01 +0530] info [cpaneld] 42.112.111.207 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 12:31:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<QvhDEORF6KCB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.224.24.30
country_id: 3469034
description:
2025-12-14 12:32:08 dovecot_plain authenticator failed for ([89.116.164.85]) [186.224.24.30]:18478: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.124.82.37
country_id: 3469034
description:
2025-12-14 12:32:20 dovecot_plain authenticator failed for ([89.116.164.85]) [200.124.82.37]:11909: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.146.79.227
country_id: 298795
description:
2025-12-14 12:32:33 dovecot_plain authenticator failed for ([89.116.164.85]) [159.146.79.227]:5848: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.224.24.30
country_id: 3469034
description:
2025-12-14 12:32:15 dovecot_login authenticator failed for ([89.116.164.85]) [186.224.24.30]:18478: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-12-14 12:35:17 dovecot_login authenticator failed for ([190.223.36.108]) [190.223.36.108]:40290: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-12-14 12:35:21 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:43909: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Dec 14 12:35:27 host2 sshd[2541615]: Disconnected from invalid user timo 152.32.206.160 port 53416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-14 12:35:34 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:58811: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-14 12:35:38 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:51885: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.206.160
country_id: 6252001
description:
Dec 14 12:36:00 host2 sshd[2541940]: Disconnected from invalid user user 152.32.206.160 port 56392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-14 12:36:05 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (boltrus) [73.196.144.25]:53152: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-14 12:37:08 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:41704: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.49
country_id: 6252001
description:
Dec 14 12:37:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.49, lip=66.85.158.91, session=<ZfsDJeRFyvvG6xgx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-14 12:37:30 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:50588: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2025-12-14 12:39:20 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:33291: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-14 12:44:07 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:51946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-14 12:44:16 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:48556: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-14 12:44:35 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:56945: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-14 12:44:44 dovecot_login authenticator failed for ([182.95.197.193]) [182.79.87.18]:50962: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-14 12:45:27 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:50321: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.22.54.28
country_id: 3865483
description:
2025-12-14 12:45:33 dovecot_plain authenticator failed for ([89.116.164.85]) [186.22.54.28]:44266: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.4.133.15
country_id: 3469034
description:
2025-12-14 12:45:47 dovecot_plain authenticator failed for dynamic-45-4-133-15.r2dados.com.br ([89.116.164.85]) [45.4.133.15]:9487: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.183.19.249
country_id: 3865483
description:
2025-12-14 12:46:01 dovecot_plain authenticator failed for ([89.116.164.85]) [190.183.19.249]:50790: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-14 12:45:16 dovecot_login authenticator failed for (dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:42144: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.195
country_id: 6252001
description:
Dec 14 12:48:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oLinS+RFMMPG6xjD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 14 12:48:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<RtPGTeRFZptog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 12:49:35 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (coolfic) [51.195.117.220]:52781: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.20.59.210
country_id: 2510769
description:
2025-12-14 12:49:57 dovecot_login authenticator failed for 210.red-88-20-59.staticip.rima-tde.net [88.20.59.210]:34407: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.20.59.210
country_id: 2510769
description:
2025-12-14 12:50:15 dovecot_login authenticator failed for 210.red-88-20-59.staticip.rima-tde.net [88.20.59.210]:34577: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-14 12:50:32 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:39748: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.211.219.73
country_id: 3175395
description:
2025-12-14 12:51:06 dovecot_login authenticator failed for host-62-211-219-73.retail.telecomitalia.it ([185.196.221.176]) [62.211.219.73]:38394: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 14 12:55:12 host2 sshd[2557716]: Disconnected from invalid user admin 35.210.61.208 port 41246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 12:56:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<vowTaeRFTM8+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 14 12:56:51 host2 sshd[2558841]: Disconnected from invalid user support 35.210.61.208 port 39226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 14 12:57:24 host2 sshd[2559148]: Disconnected from invalid user elasticsearch 35.210.61.208 port 53098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-14 12:59:24 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:44529: 535 Incorrect authentication data (set_id=noreply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.32.121
country_id: 390903
description:
2025-12-14 12:59:35 dovecot_login authenticator failed for (149-210-32-121.mobile.nym.cosmote.net) [149.210.32.121]:49714: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 12:59:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<PmCideRFHI0+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 14 13:00:05 host2 sshd[2560915]: Disconnected from invalid user mayuri 35.210.61.208 port 37786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 14 13:01:47 host2 sshd[2562252]: Disconnected from invalid user admin 196.92.7.249 port 50294 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.59.127.245
country_id: 290557
description:
2025-12-14 13:02:46 dovecot_plain authenticator failed for bba-94-59-127-245.alshamil.net.ae ([89.116.164.85]) [94.59.127.245]:51218: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.34.64.225
country_id: 1282988
description:
2025-12-14 13:03:00 dovecot_plain authenticator failed for ([89.116.164.85]) [27.34.64.225]:22200: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 14 13:03:04 host2 sshd[2563491]: Disconnected from invalid user testuser 196.92.7.249 port 60398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-12-14 13:03:08 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:41187: 535 Incorrect authentication data (set_id=noreply@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 74.235.100.195
country_id: 6252001
description:
Dec 14 13:02:16 host2 pure-ftpd[2562647]: (?@74.235.100.195) [INFO] New connection from 74.235.100.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.132.31.179
country_id: 953987
description:
2025-12-14 13:03:16 dovecot_plain authenticator failed for ([89.116.164.85]) [41.132.31.179]:41160: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-12-14 13:03:31 dovecot_login authenticator failed for ([120.157.80.73]) [120.157.80.73]:56434: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-14 13:03:33 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (scometaut) [73.195.211.98]:52562: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.6
country_id: 6252001
description:
Dec 14 13:03:57 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.91, TLS, session=<Pup5hORFjoHCpGsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-14 13:05:19 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (cysipaeogs) [98.203.34.136]:33716: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-14 13:05:25 dovecot_plain authenticator failed for (acogynchu) [5.26.190.79]:50060: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 14 13:05:37 host2 sshd[2565816]: Disconnected from invalid user dietpi 196.92.7.249 port 34830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 14 13:06:14 host2 sshd[2566309]: Disconnected from invalid user deploy 196.92.7.249 port 39672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Dec 14 13:06:54 host2 sshd[2566808]: Disconnected from invalid user vishnu 196.92.7.247 port 49512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Dec 14 13:07:33 host2 sshd[2567219]: Disconnected from invalid user administrator 196.92.7.247 port 59922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-14 13:07:38 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52830: 535 Incorrect authentication data (set_id=noreply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-14 13:08:03 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:42576: 535 Incorrect authentication data (set_id=noreply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 13:08:16 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (cocione) [96.230.65.90]:47050: 535 Incorrect authentication data (set_id=sysadmin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-14 13:08:30 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (inuings) [73.230.86.50]:47514: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-14 13:08:33 dovecot_plain authenticator failed for (dodical) [12.150.243.22]:42042: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.92.7.247
country_id: 2542007
description:
Dec 14 13:08:50 host2 sshd[2568368]: Disconnected from invalid user test 196.92.7.247 port 60860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-14 13:08:58 dovecot_plain authenticator failed for (radearging) [5.31.23.133]:48293: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-14 13:08:16 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:53554: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-14 13:08:18 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:33826: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-14 13:08:20 dovecot_plain authenticator failed for (heckes) [154.144.243.93]:37192: 535 Incorrect authentication data (set_id=sysadmin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 13:09:00 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (accania) [51.195.117.220]:62869: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-14 13:09:43 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:36682: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-12-14 13:09:14 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:48576: 535 Incorrect authentication data (set_id=noreply@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 14 13:09:30 host2 sshd[2568792]: Disconnected from invalid user ubuntu 196.92.7.246 port 34026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-14 13:11:06 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:38262: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 13:10:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<a3m4muRFQoanrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Dec 14 13:11:22 host2 sshd[2570191]: Disconnected from invalid user backend 196.92.7.247 port 60768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-14 13:11:30 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:45902: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-14 13:11:45 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:33340: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.224
country_id: 6252001
description:
Dec 14 13:12:31 host2 pure-ftpd[2570950]: (?@40.124.173.224) [INFO] New connection from 40.124.173.224


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-14 13:13:20 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:37654: 535 Incorrect authentication data (set_id=noreply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-14 13:13:41 dovecot_login authenticator failed for ([136.232.73.130]) [136.232.73.130]:52070: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-14 13:13:50 dovecot_plain authenticator failed for (subcines) [65.20.184.80]:49711: 535 Incorrect authentication data (set_id=sysadmin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-14 13:13:53 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (glophepelt) [68.38.201.238]:35406: 535 Incorrect authentication data (set_id=sysadmin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-14 13:14:03 dovecot_login authenticator failed for (88.255.189.21.static.ttnet.com.tr) [88.255.189.21]:43846: 535 Incorrect authentication data (set_id=noreply@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 14 13:13:17 host2 sshd[2571548]: Disconnected from invalid user linux 196.92.7.246 port 50886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Dec 14 13:14:34 host2 sshd[2572351]: Disconnected from invalid user debian 196.92.7.247 port 45922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-14 13:14:16 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:34092: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 14 13:14:26 host2 sshd[2572285]: Disconnected from invalid user rac 185.131.53.100 port 44000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.216.143.117
country_id: 1269750
description:
2025-12-14 13:16:05 dovecot_plain authenticator failed for ([89.116.164.85]) [103.216.143.117]:4737: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 13:16:11 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (moiditives) [51.195.117.220]:45909: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.44.135
country_id: 1733045
description:
2025-12-14 13:15:38 dovecot_plain authenticator failed for ([89.116.164.85]) [180.75.44.135]:64058: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.203.116.54
country_id: 3469034
description:
2025-12-14 13:15:50 dovecot_plain authenticator failed for 177-203-116-54.user3p.v-tal.net.br ([89.116.164.85]) [177.203.116.54]:35991: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 14 13:16:04 host2 sshd[2573514]: Disconnected from invalid user development 185.131.53.100 port 53618 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 14 13:16:44 host2 sshd[2574108]: Disconnected from invalid user backend 185.131.53.100 port 56744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.16.238.49
country_id: 3469034
description:
Dec 14 13:16:54 host2 sshd[2574228]: Disconnected from invalid user user1 201.16.238.49 port 37258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 14 13:17:06 host2 sshd[2574367]: Disconnected from invalid user vlad 196.92.7.246 port 42048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.16.238.49
country_id: 3469034
description:
Dec 14 13:17:34 host2 sshd[2574656]: Disconnected from invalid user netadmin 201.16.238.49 port 49338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-14 13:18:40 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (fraposty) [51.195.117.220]:45637: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.16.238.49
country_id: 3469034
description:
Dec 14 13:18:13 host2 sshd[2575080]: Disconnected from invalid user beehive 201.16.238.49 port 33184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.217.173.50
country_id: 1527747
description:
Dec 14 13:18:35 host2 sshd[2575264]: Disconnected from invalid user development 178.217.173.50 port 59204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 13:19:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<xTqBu+RFYsA+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.16.238.49
country_id: 3469034
description:
Dec 14 13:20:10 host2 sshd[2576350]: Disconnected from invalid user azureuser 201.16.238.49 port 41172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Dec 14 13:21:50 host2 sshd[2577244]: Disconnected from invalid user ali 41.33.91.226 port 42502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.31
country_id: 192950
description:
Dec 14 13:21:53 host2 sshd[2577252]: Disconnected from invalid user rdp 197.248.104.31 port 57878 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.85.0.197
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.85.0.197 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.241.200.175
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.241.200.175 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-14 13:22:55 dovecot_plain authenticator failed for (quize) [12.150.243.22]:62671: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.215.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.193.215.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.24.205.81
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.24.205.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.137.252.8
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.137.252.8 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.176.105.64
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 179.176.105.64 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.36.172
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.36.172 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-12-14 13:23:27 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:52594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-14 13:23:43 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:58350: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.33.91.226
country_id: 357994
description:
Dec 14 13:23:43 host2 sshd[2578268]: Disconnected from invalid user deploy 41.33.91.226 port 36754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.218.138
country_id: 130758
description:
Dec 14 13:23:57 host2 sshd[2578364]: Disconnected from invalid user mohammad 62.60.218.138 port 54014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.31
country_id: 192950
description:
Dec 14 13:24:04 host2 sshd[2578455]: Disconnected from invalid user user2 197.248.104.31 port 58142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Dec 14 13:24:18 host2 sshd[2578651]: Disconnected from invalid user pzuser 41.33.91.226 port 40754 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 13:24:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<zl4/zeRFOpo+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.31
country_id: 192950
description:
Dec 14 13:26:17 host2 sshd[2580002]: Disconnected from invalid user steamcmd 197.248.104.31 port 35836 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 13:26:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<hRVA1eRFjM8+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 14 13:26:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<nu9W1uRFBKjCw3NV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.218.138
country_id: 130758
description:
Dec 14 13:27:13 host2 sshd[2580558]: Disconnected from invalid user steamcmd 62.60.218.138 port 43692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-14 13:27:42 dovecot_login authenticator failed for ([183.171.154.31]) [103.174.145.35]:55105: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.36
country_id: 1733045
description:
2025-12-14 13:28:07 dovecot_login authenticator failed for ([49.124.153.36]) [49.124.153.36]:40094: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-14 13:27:22 dovecot_login authenticator failed for ([222.170.88.62]) [182.95.61.114]:53726: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-14 13:27:34 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:44894: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-14 13:27:34 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (subed) [73.144.27.228]:45702: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 62.60.218.138
country_id: 130758
description:
Dec 14 13:27:45 host2 sshd[2580975]: Received disconnect from 62.60.218.138 port 52840:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.164.216
country_id: 3469034
description:
2025-12-14 13:28:02 dovecot_plain authenticator failed for ([89.116.164.85]) [170.79.164.216]:60098: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.191.86.31
country_id: 3865483
description:
2025-12-14 13:28:16 dovecot_plain authenticator failed for ([89.116.164.85]) [190.191.86.31]:52969: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.12.151.79
country_id: 3658394
description:
2025-12-14 13:28:28 dovecot_plain authenticator failed for host-190-12-151-79.one.net.ec ([89.116.164.85]) [190.12.151.79]:49868: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.31
country_id: 192950
description:
Dec 14 13:29:13 host2 sshd[2582089]: Disconnected from invalid user alex 197.248.104.31 port 47024 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 2.59.22.234
country_id: 2782113
description:
Dec 14 13:30:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=2.59.22.234, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<lZj64uRF9s8COxbq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.85.44.247
country_id: 6252001
description:
2025-12-14 13:30:28 dovecot_plain authenticator failed for (zinases) [73.85.44.247]:45154: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 13:30:40 host2 sshd[2583208]: Disconnected from invalid user  62.60.131.157 port 18429 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.165.142
country_id: 3865483
description:
2025-12-14 13:31:34 dovecot_plain authenticator failed for ([89.116.164.85]) [181.117.165.142]:20108: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.24.184.187
country_id: 3439705
description:
2025-12-14 13:31:41 dovecot_plain authenticator failed for r179-24-184-187.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [179.24.184.187]:40442: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.172.70.160
country_id: 3469034
description:
2025-12-14 13:31:49 dovecot_plain authenticator failed for ([89.116.164.85]) [45.172.70.160]:3789: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.106.28.22
country_id: 3996063
description:
2025-12-14 13:31:53 dovecot_plain authenticator failed for ([89.116.164.85]) [201.106.28.22]:57840: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.113.114.204
country_id: 3624060
description:
2025-12-14 13:32:01 dovecot_plain authenticator failed for ([89.116.164.85]) [190.113.114.204]:23603: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.37.43
country_id: 3865483
description:
2025-12-14 13:32:05 dovecot_plain authenticator failed for ([89.116.164.85]) [190.104.37.43]:34606: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-14 13:32:26 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:59142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.175.28.186
country_id: 3469034
description:
2025-12-14 13:32:52 dovecot_plain authenticator failed for 45.175.28.186.maximusinf.com.br ([89.116.164.85]) [45.175.28.186]:30454: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-14 13:33:05 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:42254: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.37.43
country_id: 3865483
description:
2025-12-14 13:32:12 dovecot_login authenticator failed for ([89.116.164.85]) [190.104.37.43]:34606: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.186.215.58
country_id: 2077456
description:
2025-12-14 13:32:12 dovecot_login authenticator failed for ([115.186.215.58]) [115.186.215.58]:46054: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-14 13:32:22 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:35089: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.165.174.94
country_id: 290557
description:
2025-12-14 13:32:24 dovecot_plain authenticator failed for ([89.116.164.85]) [217.165.174.94]:54712: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.97.115.71
country_id: 290557
description:
2025-12-14 13:32:39 dovecot_plain authenticator failed for bba-86-97-115-71.alshamil.net.ae ([89.116.164.85]) [86.97.115.71]:34724: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 14 13:33:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<EWm47ORFgI2LonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.189.73.43
country_id: 3865483
description:
2025-12-14 13:34:10 dovecot_plain authenticator failed for ([89.116.164.85]) [190.189.73.43]:37791: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-14 13:33:52 dovecot_login authenticator failed for (dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:55692: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.209.75.202
country_id: 1694008
description:
2025-12-14 13:34:37 dovecot_plain authenticator failed for ([89.116.164.85]) [112.209.75.202]:28583: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 13:34:59 host2 sshd[2586201]: Disconnected from invalid user admin 2.57.121.112 port 33251 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.189.73.43
country_id: 3865483
description:
2025-12-14 13:34:17 dovecot_login authenticator failed for ([89.116.164.85]) [190.189.73.43]:37791: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.139.113.162
country_id: 3865483
description:
2025-12-14 13:34:23 dovecot_plain authenticator failed for host162.190-139-113.telecom.net.ar ([89.116.164.85]) [190.139.113.162]:36666: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.126.246
country_id: 6252001
description:
2025-12-14 13:36:48 dovecot_login authenticator failed for (nodejs-s-1vcpu-1gb-nyc1-01) [68.183.126.246]:49572: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-14 13:38:16 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:53306: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-12-14 13:38:30 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:51988: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-14 13:39:54 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:58733: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.224.69.8
country_id: 3469034
description:
2025-12-14 13:41:27 dovecot_plain authenticator failed for ([89.116.164.85]) [45.224.69.8]:52933: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 13:41:51 host2 sshd[2591142]: Disconnected from invalid user user 2.57.121.25 port 13236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.139.155.212
country_id: 4566966
description:
2025-12-14 13:41:15 dovecot_plain authenticator failed for ([89.116.164.85]) [24.139.155.212]:44930: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 13:42:53 host2 sshd[2591752]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 204.76.203.231
country_id: 2750405
description:
Dec 14 13:43:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=204.76.203.231, lip=66.85.158.92, session=</NiaEeVFuNnMTMvn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Dec 14 13:43:27 host2 sshd[2592224]: Disconnected from invalid user admin1 45.78.200.2 port 54148 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.33.137
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.114.33.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.147.200.11
country_id: 285570
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 149.147.200.11 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.125.149.67
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.125.149.67 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-14 13:45:00 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (imact) [73.224.171.101]:53690: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-14 13:45:04 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (bulaspist) [85.225.19.144]:48921: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 13:45:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63567: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.208.141.83
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.208.141.83 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.188.64.77
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 191.188.64.77 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.198.97.59
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 112.198.97.59 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.4.131.186
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.4.131.186 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.107.204
country_id: 3895114
description:
2025-12-14 13:47:06 dovecot_plain authenticator failed for ([89.116.164.85]) [186.189.107.204]:38724: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.255.102.116
country_id: 3469034
description:
2025-12-14 13:47:12 dovecot_plain authenticator failed for ([89.116.164.85]) [143.255.102.116]:10127: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.97.187.55
country_id: 3469034
description:
2025-12-14 13:46:40 dovecot_plain authenticator failed for 138-97-187-55.allrede.tec.br ([89.116.164.85]) [138.97.187.55]:3588: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.145.107.153
country_id: 1694008
description:
2025-12-14 13:46:46 dovecot_plain authenticator failed for ([89.116.164.85]) [49.145.107.153]:51083: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.127.88.246
country_id: 3865483
description:
2025-12-14 13:46:53 dovecot_plain authenticator failed for ([89.116.164.85]) [200.127.88.246]:35071: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.19.22.204
country_id: 3865483
description:
2025-12-14 13:46:59 dovecot_plain authenticator failed for ([89.116.164.85]) [186.19.22.204]:38247: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.107.204
country_id: 3895114
description:
2025-12-14 13:47:13 dovecot_login authenticator failed for ([89.116.164.85]) [186.189.107.204]:38724: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.255.102.116
country_id: 3469034
description:
2025-12-14 13:47:19 dovecot_login authenticator failed for ([89.116.164.85]) [143.255.102.116]:10127: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 13:47:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<1Hv1IOVFNKM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-14 13:48:16 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:36701: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-14 13:48:38 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:41328: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 13:49:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Xax9J+VFlNA+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.177.2.55
country_id: 3865483
description:
2025-12-14 13:50:03 dovecot_plain authenticator failed for ([89.116.164.85]) [201.177.2.55]:33066: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.150.165.166
country_id: 6252001
description:
2025-12-14 13:50:14 dovecot_plain authenticator failed for ([89.116.164.85]) [67.150.165.166]:39602: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Dec 14 13:51:12 host2 sshd[2598268]: Disconnected from invalid user incoming 45.78.231.192 port 36704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-14 13:52:07 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:52682: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-14 13:52:35 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:42224: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.248
country_id: 953987
description:
Dec 14 13:53:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<info@v-deploy.com>, method=PLAIN, rip=102.64.37.248, lip=66.85.158.91, TLS, session=<VfilM+VFq4NmQCX4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.56
country_id: 130758
description:
Dec 14 13:53:36 host2 sshd[2600021]: Disconnected from invalid user adminuser 95.38.101.56 port 48158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.77.198
country_id: 3469034
description:
Dec 14 13:53:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=187.120.77.198, lip=66.85.158.91, TLS, session=<YZ9WNeVFTdK7eE3G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Dec 14 13:53:49 host2 sshd[2600131]: Disconnected from invalid user ubuntu 45.78.200.2 port 51382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.175.112.109
country_id: 3469034
description:
2025-12-14 13:54:25 dovecot_plain authenticator failed for ([89.116.164.85]) [45.175.112.109]:64810: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.0.187.23
country_id: 3865483
description:
2025-12-14 13:54:38 dovecot_plain authenticator failed for ([89.116.164.85]) [186.0.187.23]:57604: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.197.248
country_id: 2017370
description:
2025-12-14 13:54:53 dovecot_plain authenticator failed for ([89.116.164.85]) [146.120.197.248]:33028: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Dec 14 13:55:18 host2 sshd[2601825]: Disconnected from invalid user cds 198.98.55.71 port 48762 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.55.71
country_id: 6252001
description:
Dec 14 13:56:23 host2 sshd[2602744]: Disconnected from invalid user test 198.98.55.71 port 35396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-12-14 13:57:02 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:48324: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.56
country_id: 130758
description:
Dec 14 13:57:16 host2 sshd[2603464]: Disconnected from invalid user soheil 95.38.101.56 port 47308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-14 13:57:18 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.179]:37316: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-14 13:57:28 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:53043: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.202.65.160
country_id: 6252001
description:
2025-12-14 13:57:48 dovecot_plain authenticator failed for c-73-202-65-160.hsd1.ca.comcast.net ([89.116.164.85]) [73.202.65.160]:50272: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-12-14 13:58:03 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:49407: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-14 13:57:13 dovecot_login authenticator failed for ([178.239.238.23]) [178.239.238.23]:50572: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.57.64.232
country_id: 3865483
description:
2025-12-14 13:57:30 dovecot_plain authenticator failed for ([89.116.164.85]) [186.57.64.232]:58499: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Dec 14 13:57:11 host2 sshd[2603371]: Disconnected from invalid user joe 45.78.200.2 port 40068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Dec 14 13:58:29 host2 sshd[2604628]: Disconnected from invalid user user5 198.98.55.71 port 53852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.150.205.135
country_id: 6252001
description:
2025-12-14 13:58:34 dovecot_plain authenticator failed for ([135.148.101.248]) [169.150.205.135]:32860: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 169.150.205.135
country_id: 6252001
description:
Dec 14 13:59:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=169.150.205.135, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4zZbSeVFRsypls2H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-14 13:58:16 dovecot_login authenticator failed for (aes-static-177.143.22.125.airtel.in) [128.185.239.182]:42094: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.38.101.56
country_id: 130758
description:
Dec 14 13:58:25 host2 sshd[2604564]: Disconnected from invalid user charan 95.38.101.56 port 41204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 14 13:59:37 host2 sshd[2605570]: Disconnected from invalid user ansadmin 152.32.190.168 port 58872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.69.154.4
country_id: 1643084
description:
Dec 14 13:59:49 host2 sshd[2605741]: Disconnected from invalid user vanessa 36.69.154.4 port 41582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.62.147
country_id: 2661886
description:
2025-12-14 13:59:59 dovecot_plain authenticator failed for c188-150-62-147.bredband.tele2.se ([89.116.164.85]) [188.150.62.147]:54356: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.81.183.137
country_id: 6252001
description:
2025-12-14 14:00:00 dovecot_plain authenticator failed for ([89.116.164.85]) [97.81.183.137]:33098: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Dec 14 13:59:16 host2 sshd[2605289]: Disconnected from invalid user ubuntu 45.78.221.87 port 54356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Dec 14 13:59:32 host2 sshd[2605440]: Disconnected from invalid user myuser 45.78.200.2 port 50056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.174.65
country_id: 1282988
description:
2025-12-14 14:00:13 dovecot_plain authenticator failed for ([89.116.164.85]) [103.182.174.65]:4500: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.194.244
country_id: 174982
description:
2025-12-14 14:00:26 dovecot_plain authenticator failed for ([89.116.164.85]) [5.77.194.244]:4574: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.136.66
country_id: 3865483
description:
2025-12-14 14:00:12 dovecot_plain authenticator failed for ([89.116.164.85]) [181.46.136.66]:37859: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec 14 14:00:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, session=<T6sfTuVFzf4t4/6c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.202.239.169
country_id: 6252001
description:
2025-12-14 14:00:25 dovecot_plain authenticator failed for c-71-202-239-169.hsd1.ca.comcast.net ([89.116.164.85]) [71.202.239.169]:53726: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.69.154.4
country_id: 1643084
description:
Dec 14 14:01:11 host2 sshd[2606944]: Disconnected from invalid user administrator 36.69.154.4 port 49848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 14 14:02:01 host2 sshd[2607508]: Disconnected from invalid user administrator 152.32.190.168 port 43968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.233.179
country_id: 798544
description:
2025-12-14 14:02:55 dovecot_login authenticator failed for apn-87-251-233-179.static.gprs.plus.pl [87.251.233.179]:49039: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-14 14:03:45 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:60875: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.93.114.54
country_id: 6290252
description:
2025-12-14 14:03:40 dovecot_plain authenticator failed for 109-93-114-54.dynamic.isp.telekom.rs (LF21D45A3WC8) [109.93.114.54]:58692: 535 Incorrect authentication data (set_id=httpssmtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-14 14:03:40 dovecot_login authenticator failed for (cm-84.213.188.130.get.no) [84.213.188.130]:53011: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 14 14:03:12 host2 sshd[2608933]: Disconnected from invalid user user1 152.32.190.168 port 53482 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 14 14:03:49 host2 sshd[2609701]: Disconnected from invalid user testadmin 152.32.190.168 port 59914 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2025-12-14 14:03:52 dovecot_login authenticator failed for 236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:44164: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Dec 14 14:04:37 host2 sshd[2610336]: Disconnected from invalid user minecraft 35.240.75.51 port 53208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Dec 14 14:05:18 host2 sshd[2610928]: Disconnected from invalid user cooper 35.240.75.51 port 46900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.224
country_id: 3865483
description:
Dec 14 14:08:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.101.224, lip=66.85.158.91, TLS, session=<mkFRa+VFdaS+tWXg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.69.173.5
country_id: 2661886
description:
2025-12-14 14:09:04 dovecot_plain authenticator failed for 78-69-173-5-no600.tbcn.telia.com ([89.116.164.85]) [78.69.173.5]:55526: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.240
country_id: 798544
description:
Dec 14 14:09:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=178.216.27.240, lip=66.85.158.91, TLS, session=<iu6dbOVFjoKy2Bvw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 14:09:29 host2 sshd[2613883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.254.54.133
country_id: 3469034
description:
2025-12-14 14:09:17 dovecot_plain authenticator failed for ([89.116.164.85]) [170.254.54.133]:44697: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.233.140.6
country_id: 3865483
description:
2025-12-14 14:09:29 dovecot_plain authenticator failed for ([89.116.164.85]) [45.233.140.6]:47361: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 14:11:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<hiKJdeVFDs4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.84.145
country_id: 6252001
description:
2025-12-14 14:12:28 dovecot_plain authenticator failed for ([89.116.164.85]) [172.59.84.145]:51981: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.156.16
country_id: 3469034
description:
2025-12-14 14:12:41 dovecot_plain authenticator failed for 191-241-156-16-reverso.dstech.com.br ([89.116.164.85]) [191.241.156.16]:8535: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.0.24.74
country_id: 3686110
description:
2025-12-14 14:12:53 dovecot_plain authenticator failed for ([89.116.164.85]) [190.0.24.74]:49722: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-14 14:12:52 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:42878: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-14 14:12:54 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (hannable) [76.157.219.158]:41300: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-12-14 14:13:07 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:53308: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.187.41.67
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.187.41.67 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.224.91.16
country_id: 6252001
description:
[2025-12-14 14:14:20 +0530] info [whostmgrd] 98.224.91.16 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.20.15.191
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.20.15.191 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.226.76
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.226.76 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.13.51
country_id: 3865483
description:
[2025-12-14 14:14:24 +0530] info [cpaneld] 186.22.13.51 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.19.223
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.22.19.223 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.52.21.229
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 122.52.21.229 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.228.44
country_id: 3469034
description:
2025-12-14 14:16:12 dovecot_plain authenticator failed for ([89.116.164.85]) [187.95.228.44]:16214: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.83.21.55
country_id: 6252001
description:
2025-12-14 14:16:23 dovecot_plain authenticator failed for ([89.116.164.85]) [97.83.21.55]:36756: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.47.50.47
country_id: 3865483
description:
2025-12-14 14:15:59 dovecot_plain authenticator failed for ([89.116.164.85]) [181.47.50.47]:60456: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-14 14:17:31 dovecot_login authenticator failed for ([182.95.20.31]) [182.95.228.22]:39230: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Dec 14 14:17:41 host2 sshd[2619701]: Disconnected from invalid user developer 172.245.92.99 port 47850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-14 14:17:02 dovecot_login authenticator failed for ([27.123.113.10]) [27.123.113.10]:33120: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.44.149.148
country_id: 3469034
description:
[2025-12-14 14:18:39 +0530] info [cpaneld] 187.44.149.148 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 90.160.139.163
country_id: 2510769
description:
Dec 14 14:18:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<eng@lezzarotech.com>, method=PLAIN, rip=90.160.139.163, lip=66.85.158.91, TLS, session=<lyNsjuVFwNdaoIuj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.212.200.144
country_id: 1880251
description:
Dec 14 14:18:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<enveng@lezzarotech.com>, method=PLAIN, rip=20.212.200.144, lip=66.85.158.91, TLS, session=<5KNzjuVF580U1MiQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.22.173.1
country_id: 3469034
description:
[2025-12-14 14:18:38 +0530] info [whostmgrd] 177.22.173.1 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.174.79.224
country_id: 3895114
description:
[2025-12-14 14:18:33 +0530] info [cpaneld] 152.174.79.224 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.233.140.250
country_id: 3469034
description:
Dec 14 14:18:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<env-eng@lezzarotech.com>, method=PLAIN, rip=181.233.140.250, lip=66.85.158.91, session=<U+v0juVF2c616Yz6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Dec 14 14:18:38 host2 sshd[2619686]: Disconnected from invalid user marco 45.78.221.87 port 40398 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.0.212.58
country_id: 3865483
description:
[2025-12-14 14:18:43 +0530] info [cpaneld] 186.0.212.58 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.143.113
country_id: 3658394
description:
[2025-12-14 14:18:34 +0530] info [cpaneld] 45.236.143.113 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.144.255.208
country_id: 2542007
description:
Dec 14 14:18:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=154.144.255.208, lip=66.85.158.91, TLS, session=<AlhsjuVFyLeakP/Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.235.31.47
country_id: 6252001
description:
Dec 14 14:18:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env@lezzarotech.com>, method=PLAIN, rip=50.235.31.47, lip=66.85.158.91, TLS, session=<bRJojuVFOs8y6x8v>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.159.51
country_id: 1733045
description:
[2025-12-14 14:18:36 +0530] info [cpaneld] 161.142.159.51 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.36.71.116
country_id: 3469034
description:
[2025-12-14 14:18:41 +0530] info [cpaneld] 177.36.71.116 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


