# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.243.236.86
country_id: 290557
description:
Dec  8 15:06:51 host2 sshd[3781543]: Disconnected from invalid user a2025 74.243.236.86 port 51146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec  8 15:07:06 host2 sshd[3781735]: Disconnected from invalid user admin 52.250.16.220 port 35650 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.222.40.122
country_id: 6252001
description:
Dec  8 15:08:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.222.40.122, lip=66.85.158.91, session=<N+CRjm1FtNaH3ih6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec  8 15:08:58 host2 sshd[3782786]: Disconnected from invalid user middleware 102.88.137.80 port 49844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec  8 15:09:36 host2 sshd[3783123]: Disconnected from invalid user jacob 103.249.84.18 port 46350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.32.186
country_id: 1168579
description:
Dec  8 15:09:57 host2 sshd[3783285]: Disconnected from invalid user ubuntu 175.107.32.186 port 10468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec  8 15:10:05 host2 sshd[3783562]: Disconnected from invalid user username 201.249.192.30 port 8208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.32.186
country_id: 1168579
description:
Dec  8 15:10:54 host2 sshd[3783998]: Disconnected from invalid user tempusr 175.107.32.186 port 60255 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-08 15:11:18 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (underef) [76.16.7.82]:47798: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec  8 15:11:49 host2 sshd[3784645]: Disconnected from invalid user ubuntu 85.18.236.229 port 44090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Dec  8 15:11:54 host2 sshd[3784693]: Disconnected from invalid user jenkins 41.223.40.77 port 40456 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.107.32.186
country_id: 1168579
description:
Dec  8 15:12:58 host2 sshd[3785315]: Disconnected from invalid user jenkins 175.107.32.186 port 38381 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Dec  8 15:14:33 host2 sshd[3786500]: Disconnected from invalid user whatsapp 41.223.40.77 port 56382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.153.196.154
country_id: 3865483
description:
Dec  8 15:15:22 host2 sshd[3787462]: Disconnected from invalid user jacob 186.153.196.154 port 40856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.32.35
country_id: 3175395
description:
Dec  8 15:17:08 host2 sshd[3788188]: Disconnected from invalid user admin 151.19.32.35 port 23120 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.77
country_id: 3351879
description:
Dec  8 15:19:55 host2 sshd[3789396]: Disconnected from invalid user tempusr 41.223.40.77 port 53296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-08 15:21:03 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (derlums) [73.145.107.251]:44218: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.153.33
country_id: 3658394
description:
2025-12-08 15:22:49 dovecot_plain authenticator failed for ([89.116.164.85]) [200.24.153.33]:56842: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.153.202.12
country_id: 6252001
description:
2025-12-08 15:23:00 dovecot_plain authenticator failed for ([89.116.164.85]) [184.153.202.12]:48222: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2025-12-08 15:23:04 dovecot_login authenticator failed for ([208.69.161.214]) [208.69.161.214]:45698: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.185.159.39
country_id: 1733045
description:
2025-12-08 15:23:13 dovecot_plain authenticator failed for ([89.116.164.85]) [202.185.159.39]:48089: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.41
country_id: 1733045
description:
2025-12-08 15:22:53 dovecot_login authenticator failed for ([49.124.146.41]) [49.124.146.41]:34814: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.153.33
country_id: 3658394
description:
2025-12-08 15:22:55 dovecot_login authenticator failed for ([89.116.164.85]) [200.24.153.33]:56842: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.81
country_id: 6252001
description:
Dec  8 15:24:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.81, lip=66.85.158.92, session=<sUalx21FDOEUQcJR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec  8 15:24:57 host2 sshd[3792650]: Disconnected from invalid user tempusr 103.249.84.18 port 45346 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 15:31:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<xx1f321FptEv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-12-08 15:33:20 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net (slaters) [74.90.213.28]:56850: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec  8 15:33:35 host2 sshd[3798489]: Disconnected from invalid user dell 102.88.137.80 port 49420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.209
country_id: 6252001
description:
Dec  8 15:34:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.209, lip=66.85.158.91, TLS, session=<oOKP7W1FAuHG6xjR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.120
country_id: 3996063
description:
2025-12-08 15:35:21 dovecot_login authenticator failed for (201.173.216.120-clientes-izzi.mx) [201.173.216.120]:58539: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-08 15:36:11 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:45671: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 15:37:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<2uJg9W1FDpGqQMFo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 15:41:22 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.61.160.114
country_id: 3017382
description:
Dec  8 15:43:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=72.61.160.114, lip=66.85.158.91, session=<hUQmC25FgJZIPaBy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 15:44:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<mKKwDW5F4K1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 15:44:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<UVPiDW5F6oCeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-08 15:46:12 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (vialmid) [73.197.194.98]:52082: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 15:46:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ckC0F25Fdp0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-12-08 15:47:03 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:38096: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-08 15:47:16 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:55060: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-08 15:48:18 dovecot_plain authenticator failed for (ruthis) [91.73.188.251]:38284: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 15:49:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Qu6DIm5FJJjO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 15:51:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<YXWIJ25F4MSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 15:51:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<XYjBJ25FcoBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.119.20.74
country_id: 298795
description:
2025-12-08 15:52:48 dovecot_plain authenticator failed for ([89.116.164.85]) [188.119.20.74]:48483: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.73.203.19
country_id: 3469034
description:
2025-12-08 15:52:34 dovecot_plain authenticator failed for host-203-19.host.stetnet.com.br ([89.116.164.85]) [187.73.203.19]:8297: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 15:53:29 host2 sshd[3812754]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.52.30.149
country_id: 3469034
description:
2025-12-08 15:53:01 dovecot_plain authenticator failed for ([89.116.164.85]) [177.52.30.149]:40997: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.119.20.74
country_id: 298795
description:
2025-12-08 15:52:55 dovecot_login authenticator failed for ([89.116.164.85]) [188.119.20.74]:48483: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.159.201
country_id: 2510769
description:
Dec  8 15:54:06 host2 sshd[3813322]: Disconnected from invalid user jenkins 187.33.159.201 port 45422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 15:54:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<Egf7M25FUJQ+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.35.25
country_id: 6252001
description:
Dec  8 15:54:47 host2 sshd[3813818]: Disconnected from invalid user jenkins 43.130.35.25 port 41258 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 15:55:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<lx1TN25FcIEv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-08 15:55:43 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (distauts) [69.123.219.82]:41818: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-12-08 15:55:22 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:38091: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-08 15:55:31 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:57965: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 15:55:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<SkYhOG5FUJcv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-08 15:55:54 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (regma) [73.145.107.251]:50926: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-08 15:56:40 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (hemic) [66.177.30.53]:60674: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.194.198.22
country_id: 1694008
description:
2025-12-08 15:58:31 dovecot_plain authenticator failed for ([89.116.164.85]) [180.194.198.22]:27630: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.106.127
country_id: 1269750
description:
2025-12-08 15:58:51 dovecot_plain authenticator failed for ([89.116.164.85]) [103.59.106.127]:15595: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 15:57:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<1ch0P25FbLk+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 15:58:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<0IgUQW5FqtE+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 15:58:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<0SKSQm5FTrtn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 15:59:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<91nSQ25F4ok+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-08 15:59:47 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:46244: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 15:58:54 host2 sshd[3816586]: Disconnected from invalid user user 197.138.129.15 port 52490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.106.127
country_id: 1269750
description:
2025-12-08 15:58:58 dovecot_login authenticator failed for ([89.116.164.85]) [103.59.106.127]:15595: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.114
country_id: 1269750
description:
2025-12-08 16:00:17 dovecot_login authenticator failed for ([182.78.120.220]) [182.95.49.114]:53286: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 16:00:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ukFtSG5FFNw+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 16:00:45 host2 sshd[3818084]: Disconnected from invalid user admin 2.57.121.112 port 58442 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 16:01:04 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 16:01:50 host2 sshd[3818781]: Disconnected from invalid user tempusr 197.138.129.15 port 58088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Dec  8 16:01:54 host2 sshd[3818804]: Disconnected from invalid user apple_store 104.248.17.208 port 50994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 16:03:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ROQuUm5FHMiuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 16:03:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<3jbAUm5FJuo+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-12-08 16:03:50 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:42923: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 16:04:03 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.235
country_id: 1733045
description:
2025-12-08 16:04:19 dovecot_login authenticator failed for ([49.124.152.235]) [49.124.152.235]:45946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 16:05:06 host2 sshd[3822417]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.228
country_id: 953987
description:
Dec  8 16:05:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.64.40.228, lip=66.85.158.91, TLS, session=<LItuWm5F2KBmQCjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.189
country_id: 3175395
description:
Dec  8 16:05:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=171.22.234.189, lip=66.85.158.91, TLS, session=<EixMWW5FpJmrFuq9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-08 16:05:29 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:55088: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-08 16:05:42 dovecot_login authenticator failed for (syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:39110: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-08 16:06:02 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:20958: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 16:06:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7OjhXG5FvtFn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-08 16:06:13 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:39708: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-12-08 16:06:23 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:44754: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-08 16:06:41 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:54453: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 16:06:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<JQFpX25FsKc+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 16:06:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ifbWX25FrrRnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.169.185
country_id: 2635167
description:
Dec  8 16:07:22 host2 sshd[3824376]: Disconnected from invalid user postgres 188.166.169.185 port 42536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.35.25
country_id: 6252001
description:
Dec  8 16:08:22 host2 sshd[3825090]: Disconnected from invalid user user 43.130.35.25 port 37518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Dec  8 16:09:24 host2 sshd[3825980]: Disconnected from invalid user user 104.248.17.208 port 56706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 16:09:39 host2 sshd[3826167]: Disconnected from invalid user admin 2.57.121.112 port 46193 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.134.123
country_id: 2802361
description:
Dec  8 16:10:24 host2 pure-ftpd[3826881]: (?@34.76.134.123) [INFO] New connection from 34.76.134.123


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.130.35.25
country_id: 6252001
description:
Dec  8 16:10:48 host2 sshd[3827124]: Disconnected from invalid user apple_store 43.130.35.25 port 36920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 16:11:10 host2 sshd[3827337]: Disconnected from invalid user apple_store 197.138.129.15 port 35320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.169.185
country_id: 2635167
description:
Dec  8 16:11:24 host2 sshd[3827491]: Disconnected from invalid user jenkins 188.166.169.185 port 50506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-08 16:16:54 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:64854: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec  8 16:17:32 host2 pure-ftpd[3832380]: (?@66.132.153.119) [INFO] New connection from 66.132.153.119


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 16:18:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<billing@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<2BK0h25FgLk+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.159.201
country_id: 2510769
description:
Dec  8 16:19:27 host2 sshd[3833885]: Disconnected from invalid user tempusr 187.33.159.201 port 48176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-08 16:18:44 dovecot_plain authenticator failed for (unonit) [75.97.190.237]:45471: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-08 16:18:57 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:59068: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 16:19:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<yoAdjG5Fru0+PIce>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Dec  8 16:20:14 host2 sshd[3834696]: Disconnected from invalid user apple_store 159.223.8.81 port 60072 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 16:20:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4hj2j25FzqPD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-08 16:19:40 dovecot_plain authenticator failed for (vivier) [65.20.133.4]:45921: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.199.240
country_id: 2921044
description:
Dec  8 16:20:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.154.199.240, lip=66.85.158.92, session=<UFV5kG5FBozPmsfw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec  8 16:21:14 host2 sshd[3835526]: Disconnected from invalid user postgres 159.223.8.81 port 48060 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.165.198
country_id: 2921044
description:
Dec  8 16:20:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=164.90.165.198, lip=66.85.158.92, session=<8RVqkG5F5ZOkWqXG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 16:21:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<CBGKlG5F2MjDhTKl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 16:22:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<oquzlW5FUI8+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 16:22:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<y2Kulm5FTrcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 16:22:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<32bhmG5FJqGLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.159.201
country_id: 2510769
description:
Dec  8 16:24:09 host2 sshd[3837850]: Disconnected from invalid user user 187.33.159.201 port 58474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.159.201
country_id: 2510769
description:
Dec  8 16:25:19 host2 sshd[3838927]: Disconnected from invalid user postgres 187.33.159.201 port 60834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 16:25:24 host2 sshd[3838983]: Disconnected from invalid user user 2.57.121.25 port 35615 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-08 16:25:33 dovecot_plain authenticator failed for (prophotor) [65.20.174.63]:38787: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 16:26:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<WecPpG5FlIYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 16:26:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<pbUMpm5FKOKl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Dec  8 16:27:50 host2 sshd[3840953]: Disconnected from invalid user apple_store 193.122.200.89 port 32996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 16:28:07 host2 sshd[3841166]: Disconnected from invalid user postgres 197.138.129.15 port 35908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 16:29:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<2AQJr25FroE+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-08 16:30:25 dovecot_plain authenticator failed for (strado) [64.72.74.162]:51511: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 16:30:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OPkpsm5FBOpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.9.164.202
country_id: 6252001
description:
2025-12-08 16:35:59 dovecot_plain authenticator failed for ([89.116.164.85]) [73.9.164.202]:33122: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.164.52.31
country_id: 1733045
description:
2025-12-08 16:36:12 dovecot_plain authenticator failed for ([89.116.164.85]) [115.164.52.31]:32830: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.157.13
country_id: 298795
description:
2025-12-08 16:36:26 dovecot_plain authenticator failed for ([89.116.164.85]) [78.188.157.13]:42770: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 16:36:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1Creym5FEscXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 16:37:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<IFbHy25F1OfANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.157.13
country_id: 298795
description:
2025-12-08 16:36:33 dovecot_login authenticator failed for ([89.116.164.85]) [78.188.157.13]:42770: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 16:37:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<notify@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<dNk6zm5Fxss+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.47.243.113
country_id: 6252001
description:
2025-12-08 16:38:07 dovecot_login authenticator failed for ool-182ff371.dyn.optonline.net [24.47.243.113]:50603: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-08 16:38:14 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:41984: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.75.13.194
country_id: 6251999
description:
Dec  8 16:38:19 host2 sshd[3848929]: Disconnected from invalid user engineer 206.75.13.194 port 55318 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-08 16:38:25 dovecot_login authenticator failed for (nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:33126: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-12-08 16:37:43 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:44950: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 16:38:02 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:58718: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2025-12-08 16:38:21 dovecot_login authenticator failed for ([197.251.249.72]) [197.251.249.72]:52965: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-08 16:38:00 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:59704: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-08 16:38:39 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:36566: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 16:38:54 host2 sshd[3849162]: Disconnected from invalid user jenkins 197.138.129.15 port 39560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 16:38:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<OyBS0m5F+L6nYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.95.214
country_id: 6252001
description:
Dec  8 16:40:31 host2 sshd[3850339]: Disconnected from invalid user dell 43.153.95.214 port 38952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 16:40:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<UTdw2G5FfteiAOAm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.75.13.194
country_id: 6251999
description:
Dec  8 16:41:50 host2 sshd[3851126]: Disconnected from invalid user ansible 206.75.13.194 port 38836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.131.133.146
country_id: 6252001
description:
2025-12-08 16:42:06 dovecot_plain authenticator failed for 107-131-133-146.lightspeed.irvnca.sbcglobal.net ([89.116.164.85]) [107.131.133.146]:51548: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.210.86.252
country_id: 3469034
description:
2025-12-08 16:42:20 dovecot_plain authenticator failed for ([89.116.164.85]) [179.210.86.252]:45537: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.222.0.185
country_id: 3469034
description:
2025-12-08 16:42:34 dovecot_plain authenticator failed for ([89.116.164.85]) [181.222.0.185]:33548: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.94
country_id: 1880251
description:
Dec  8 16:42:37 host2 sshd[3851552]: Disconnected from invalid user xiaowk 45.78.221.94 port 37664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 16:43:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<t0Qs4W5F4tgP6yH0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.75.13.194
country_id: 6251999
description:
Dec  8 16:46:17 host2 sshd[3854702]: Disconnected from invalid user dell 206.75.13.194 port 35671 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 16:47:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<upSv8G5F9qsv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.95.214
country_id: 6252001
description:
Dec  8 16:46:36 host2 sshd[3854856]: Disconnected from invalid user tempusr 43.153.95.214 port 37732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Dec  8 16:47:21 host2 sshd[3855370]: Disconnected from invalid user postgres 193.122.200.89 port 32916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-08 16:49:09 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:51782: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.17
country_id: 6252001
description:
2025-12-08 16:49:16 dovecot_login authenticator failed for ([98.181.44.17]) [98.181.44.17]:59803: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.75.13.194
country_id: 6251999
description:
Dec  8 16:48:35 host2 sshd[3856119]: Disconnected from invalid user jenkins 206.75.13.194 port 34106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.153.95.214
country_id: 6252001
description:
Dec  8 16:49:01 host2 sshd[3856600]: Disconnected from invalid user ansible 43.153.95.214 port 37242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec  8 16:49:52 host2 sshd[3857109]: Disconnected from invalid user jacob 67.207.83.103 port 38462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-08 16:49:57 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:50611: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-08 16:50:18 dovecot_login authenticator failed for ([154.208.47.13]) [154.208.47.13]:52164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 16:51:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ZdP9/25FkuIz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 16:51:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<MvnHAG9F8IKG0Wp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.95.214
country_id: 6252001
description:
Dec  8 16:52:35 host2 sshd[3858894]: Disconnected from invalid user xiaowk 43.153.95.214 port 36500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec  8 16:52:59 host2 sshd[3859083]: Disconnected from invalid user devops2025 67.207.83.103 port 41032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.109
country_id: 6252001
description:
Dec  8 16:53:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.109, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cmz3BW9FezRAPpxt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Dec  8 16:53:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yicNB29FNkVAPpxs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.21.83.111
country_id: 3895114
description:
2025-12-08 16:54:19 dovecot_plain authenticator failed for ([89.116.164.85]) [190.21.83.111]:46498: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.86.159.128
country_id: 2510769
description:
2025-12-08 16:54:32 dovecot_plain authenticator failed for static-128-159-86-188.ipcom.comunitel.net ([89.116.164.85]) [188.86.159.128]:57594: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.18.39.77
country_id: 3469034
description:
2025-12-08 16:54:46 dovecot_plain authenticator failed for ([89.116.164.85]) [177.18.39.77]:44799: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 16:55:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ONGwDW9F+NSPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.207.83.103
country_id: 6252001
description:
Dec  8 16:56:19 host2 sshd[3861785]: Disconnected from invalid user jenkins 67.207.83.103 port 40388 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 16:56:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<pVV1EW9FQOg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 16:56:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<jo7mEW9FPtykXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 16:56:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<XjVnEm9Fqusv/lVz>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.254.85.115
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.254.85.115] [Remote Port]=[60330] [Authentication Database]=[mail] [Username]=[test@seyawin.com] (10/10 failures) (blocked until [Tue Dec  9 11:26:52 2025 UTC/Tue Dec  9 16:56:52 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 16:59:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<SRf0HG9Fkoy8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-08 16:59:56 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:41971: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.188
country_id: 3996063
description:
2025-12-08 17:00:11 dovecot_login authenticator failed for ([177.239.164.188]) [177.239.164.188]:33380: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 17:04:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<rzx1LG9FiOeeRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec  8 17:03:42 host2 sshd[3867106]: Disconnected from invalid user ubuntu 67.207.83.103 port 56794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 17:05:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<ijWiL29FPIeqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 17:04:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<XLh4Lm9FpqI+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-08 17:05:01 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (mosion) [68.52.119.193]:44752: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.94
country_id: 1880251
description:
Dec  8 17:06:21 host2 sshd[3868884]: Disconnected from invalid user dell 45.78.221.94 port 50484 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 17:08:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<r72yOm9FPus+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 17:09:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<billing@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<UqWEPm9FFM4+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.218.242.181
country_id: 1819730
description:
Dec  8 17:08:46 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=103.218.242.181, lip=66.85.158.92, TLS, session=<Vk72PG9FCH1n2vK1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-08 17:09:33 dovecot_plain authenticator failed for (menloce) [65.20.160.107]:56622: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 17:09:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<+B0DQW9Fas4+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 17:10:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<bKvkQW9Fkuc+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-08 17:10:55 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:43248: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2025-12-08 17:11:04 dovecot_login authenticator failed for ([5.11.161.152]) [5.11.161.152]:38774: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 17:11:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tatighbont) [87.103.126.54]:54161: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 17:12:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<lMMDS29FeoukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 17:13:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<fXluTm9FOJE+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 17:14:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Ov3QT29FWJrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 17:15:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<UFukVm9FHsw+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2025-12-08 17:16:02 dovecot_plain authenticator failed for (asionatous) [50.215.95.14]:42468: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec  8 17:16:56 host2 sshd[3876145]: Disconnected from invalid user jacob 58.98.199.45 port 40273 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.118.106.53
country_id: 1269750
description:
Dec  8 17:17:41 host2 sshd[3876498]: Disconnected from invalid user admin 45.118.106.53 port 33406 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Dec  8 17:18:51 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<DlP+YG9FxthHBpK5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Dec  8 17:18:51 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<Xgv9YG9FSthHBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 17:18:32 host2 sshd[3876918]: Disconnected from invalid user admin 2.57.121.112 port 33788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 17:18:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<VWHJX29FLsgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 17:20:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<vmwdaG9FIMkv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-08 17:21:32 dovecot_login authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:53341: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.233
country_id: 6252001
description:
2025-12-08 17:21:37 dovecot_login authenticator failed for wsip-184-191-242-233.fv.ks.cox.net [184.191.242.233]:34209: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.188
country_id: 1733045
description:
2025-12-08 17:21:55 dovecot_login authenticator failed for ([49.124.159.188]) [49.124.159.188]:55978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.167
country_id: 3996063
description:
2025-12-08 17:21:54 dovecot_login authenticator failed for ([177.236.146.167]) [177.236.146.167]:44462: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.99.110.136
country_id: 3469034
description:
2025-12-08 17:23:04 dovecot_plain authenticator failed for ([89.116.164.85]) [179.99.110.136]:56558: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.41.0.178
country_id: 6252001
description:
2025-12-08 17:23:15 dovecot_plain authenticator failed for 75-41-0-178.lightspeed.austtx.sbcglobal.net ([89.116.164.85]) [75.41.0.178]:43846: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.41.148.216
country_id: 102358
description:
2025-12-08 17:23:28 dovecot_plain authenticator failed for ([89.116.164.85]) [5.41.148.216]:2987: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 17:22:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<Pv9Ob29FnrA+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 17:22:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<+hqjb29FYsU+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.41.148.216
country_id: 102358
description:
2025-12-08 17:23:35 dovecot_login authenticator failed for ([89.116.164.85]) [5.41.148.216]:2987: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.53
country_id: 1269750
description:
Dec  8 17:23:47 host2 sshd[3879727]: Disconnected from invalid user admin 45.118.106.53 port 39138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 17:24:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<YIjfdW9FOviuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.19.170
country_id: 1269750
description:
2025-12-08 17:25:06 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:33074: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-08 17:25:35 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:57777: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 17:25:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<JwwgeW9F1Ik+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 17:27:27 host2 sshd[3882173]: Disconnected from invalid user admin 2.57.121.112 port 5397 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 17:28:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<rWSpg29FTNY+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.226
country_id: 192950
description:
Dec  8 17:29:04 host2 sshd[3883157]: Disconnected from invalid user username 102.220.23.226 port 34298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 17:29:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<eDqThW9F1I0+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 17:30:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<IU8JiW9Fut5noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 17:29:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<guy3h29FsKo+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.53
country_id: 1269750
description:
Dec  8 17:31:09 host2 sshd[3884997]: Disconnected from invalid user user 45.118.106.53 port 60427 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 17:30:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<D8mQim9F6qc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 17:31:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4AKLjG9FZLQ+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-08 17:32:17 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (frerliths) [68.46.148.180]:51346: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-08 17:31:40 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:43144: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-08 17:32:14 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52490: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 17:33:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<o7r2lW9FjuY+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-12-08 17:34:46 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:43886: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.226
country_id: 192950
description:
Dec  8 17:36:40 host2 sshd[3888516]: Disconnected from invalid user admin 102.220.23.226 port 48498 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 17:37:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<TBqcom9FBu4+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:37:56 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<uoI/pW9FXsEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:40:12 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<g5lYrW9FmoUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 17:39:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<7SW+q29FFujD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-08 17:40:51 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:41575: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.226
country_id: 192950
description:
Dec  8 17:41:24 host2 sshd[3891710]: Disconnected from invalid user username 102.220.23.226 port 57020 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-08 17:41:27 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:35488: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-08 17:41:26 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:50776: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.208.55
country_id: 6252001
description:
2025-12-08 17:40:44 dovecot_login authenticator failed for ([216.21.208.55]) [216.21.208.55]:53113: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 17:42:04 host2 sshd[3892117]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.39.230
country_id: 3202326
description:
2025-12-08 17:41:55 dovecot_login authenticator failed for ([5.59.39.230]) [5.59.39.230]:44246: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:42:10 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Da5ktG9FKIEDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2025-12-08 17:41:42 dovecot_login authenticator failed for (173-31-197-108.client.mchsi.com) [173.31.197.108]:54710: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-08 17:41:55 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (upsinly) [24.23.125.83]:46278: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-12-08 17:41:53 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:36517: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 17:42:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<VHz9s29FtOanYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-08 17:42:08 dovecot_plain authenticator failed for (twiele) [23.30.11.253]:60109: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 17:41:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<HhFHsm9Fir/DhTKl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-08 17:41:44 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:50004: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-08 17:43:28 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (boless) [98.193.112.85]:41184: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 17:44:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<C6AovG9FAMs+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-08 17:44:25 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:56912: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-08 17:44:17 dovecot_login authenticator failed for ([125.19.110.89]) [182.78.107.6]:56930: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:44:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<UDxGvG9FxJsDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-08 17:44:38 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:52164: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:44:37 host2 dovecot[2208013]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<IoslvW9FdpADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-08 17:44:47 dovecot_login authenticator failed for ([124.246.114.111]) [124.246.114.111]:44992: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-08 17:44:48 dovecot_login authenticator failed for ([154.208.47.13]) [154.208.47.13]:41560: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 17:44:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<YwMkvm9FgreLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-12-08 17:45:21 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:57735: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 17:45:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<hdVtwW9FRugrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:46:13 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<2RXewm9FWpUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 17:46:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<1UUAxG9F5OWl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 17:48:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<udHMyW9FOKc+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 17:50:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<qM1k0G9FPqIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 17:53:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Ym1u3G9FKptnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 17:53:35 host2 sshd[3900682]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-08 17:56:13 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:56436: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-08 17:57:00 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (rosid) [71.224.169.28]:49806: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-08 17:57:02 dovecot_plain authenticator failed for (caninur) [65.20.149.93]:48146: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec  8 17:57:56 host2 sshd[3904633]: Disconnected from invalid user agent 58.98.199.45 port 38126 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 17:59:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<YXhw8W9Fwrw+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-08 17:59:34 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (spering) [73.224.171.101]:36234: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.123.101.50
country_id: 3865483
description:
Dec  8 18:00:18 host2 sshd[3906769]: Disconnected from invalid user jacob 186.123.101.50 port 56134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-08 18:02:06 dovecot_plain authenticator failed for (dions) [149.62.239.4]:40492: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-08 18:03:20 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:33704: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 18:02:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<xwgX/m9FpNPANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-08 18:02:58 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:47456: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 18:03:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<k1nuAHBF7LMP6yH0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-08 18:03:49 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (noster) [196.47.172.253]:58931: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-08 18:04:25 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:50831: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-12-08 18:04:44 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:34374: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 18:05:04 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (myines) [87.103.126.54]:22633: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 18:07:09 host2 sshd[3911160]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 18:07:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<9GGVEHBFqqI+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 18:08:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<eTAgEXBFHNAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 18:11:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<d4W0G3BFUM8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 18:16:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<g26NLnBFfLaPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 18:16:41 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 18:16:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<OfhaMHBFxNqG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-08 18:16:58 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (monticalt) [73.213.237.28]:53996: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-08 18:19:31 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:50069: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 18:19:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<dQWNOnBFMpCkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-08 18:19:56 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:59716: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 18:20:30 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 18:22:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<RW16Q3BF/qEv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.127.192
country_id: 2921044
description:
Dec  8 18:23:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.65.127.192, lip=66.85.158.92, TLS, session=<YDHTR3BFbK+fQX/A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 18:23:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<9eRHSXBFSrIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 18:25:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<fTOeTXBF2si8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-08 18:25:37 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:43702: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-08 18:26:34 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:65191: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 18:27:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<OfWHV3BFRtCeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-08 18:26:57 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:50034: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-08 18:29:09 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:39980: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-12-08 18:29:18 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:54287: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.186.46.96
country_id: 6252001
description:
Dec  8 18:31:43 host2 sshd[3929338]: Disconnected from invalid user ubuntu 34.186.46.96 port 44250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec  8 18:33:00 host2 sshd[3930275]: Disconnected from invalid user developer 58.98.199.45 port 47299 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 18:34:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<8xDwbnBFLoOqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 18:36:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<CIZrdnBFyrCkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 18:37:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<BnUceXBF7rY+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-08 18:38:10 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:48711: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-08 18:38:28 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:54821: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-08 18:40:28 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (mooked) [24.15.216.41]:54532: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 18:40:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<RRuThXBFJpzO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 18:40:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<D8vqhXBFuos+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-08 18:40:12 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:52066: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 18:40:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<XhkXhHBFAuI+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-08 18:41:26 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:49967: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-08 18:41:33 dovecot_plain authenticator failed for (krunte) [154.144.255.208]:52194: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 18:41:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<19ePiHBFvLk+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-08 18:41:38 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:39814: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 18:43:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<YOPejXBFOMo+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 18:43:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=</mIFkXBFnKIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 18:46:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<R5HEmXBFdLg+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 18:46:25 host2 sshd[3939988]: Disconnected from invalid user admin 2.57.121.112 port 38714 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 18:48:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<E3Tgn3BFWJgv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 18:48:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<fCvOn3BFYvCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 18:49:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=</O4vpHBFWNmuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 18:49:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<OaAppXBFAMA+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 18:55:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65157: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 18:56:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<C8m0vXBFTs4+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 18:57:30 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (ridflims) [68.60.77.128]:48568: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.9.78
country_id: 3017382
description:
Dec  8 18:57:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.134.9.78, lip=66.85.158.91, TLS: Connection closed, session=</WDFwnBFbt5bhglO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.9.78
country_id: 3017382
description:
Dec  8 18:57:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.134.9.78, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+lBnw3BFBpRbhglO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 18:58:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<NOKEw3BF6J5noNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 19:04:36 host2 sshd[3952960]: Disconnected from invalid user user 2.57.121.25 port 30037 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 19:04:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<rzXv2HBFxOPD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2025-12-08 19:04:10 dovecot_login authenticator failed for ([49.124.146.34]) [49.124.146.34]:51054: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-08 19:04:20 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:45805: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.186.46.96
country_id: 6252001
description:
Dec  8 19:04:23 host2 sshd[3952876]: Disconnected from invalid user tempusr 34.186.46.96 port 60626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.186.46.96
country_id: 6252001
description:
Dec  8 19:05:46 host2 sshd[3953656]: Disconnected from invalid user username 34.186.46.96 port 47724 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 19:06:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<YxF34XBFHq3DhTKl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.32.189.23
country_id: 6252001
description:
2025-12-08 19:06:41 dovecot_plain authenticator failed for ([89.116.164.85]) [76.32.189.23]:31115: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.71.88.125
country_id: 6290252
description:
2025-12-08 19:06:53 dovecot_plain authenticator failed for ([89.116.164.85]) [185.71.88.125]:46384: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.77.254.197
country_id: 6252001
description:
2025-12-08 19:07:08 dovecot_plain authenticator failed for c-73-77-254-197.hsd1.tx.comcast.net ([89.116.164.85]) [73.77.254.197]:51976: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 19:11:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<vJCl83BF9KuLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 19:11:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<v5HA83BFDM8+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 19:13:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=</H+A+XBFRqwrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-08 19:13:11 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:40110: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 19:13:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<tm15+nBF1ryl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 19:17:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Hq/ACnFFrL4v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 19:20:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<+NihE3FFQsM+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 19:21:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lnYPGHFF2r9nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-08 19:24:48 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:52914: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 19:25:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<lnGcJHFFXoA+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-08 19:24:55 dovecot_login authenticator failed for (cm-84.211.12.159.get.no) [84.211.12.159]:39360: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-08 19:28:51 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (vargione) [73.176.157.57]:51352: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 19:30:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<6YAQNnFFCMwP6yH0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 19:31:44 host2 sshd[3975226]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 19:31:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<VVIwOnFF9MTANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-08 19:32:46 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (unmetilic) [24.127.53.61]:39122: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 19:32:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<vc8EP3FFCJQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-08 19:33:11 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:41208: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 19:34:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<WiKRRnFFrs8z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-08 19:35:40 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:54242: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-08 19:35:58 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:33181: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 19:38:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4v3zUnFFRNsjy9Nr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 19:38:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<3r4IVnFFmOIjy9Nr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.107.206.116
country_id: 1733045
description:
Dec  8 19:39:39 host2 sshd[3981113]: Disconnected from invalid user dell 118.107.206.116 port 52186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 19:40:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<QCJBWnFFcNWPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 19:40:34 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.107.206.116
country_id: 1733045
description:
Dec  8 19:41:11 host2 sshd[3982537]: Disconnected from invalid user visitador 118.107.206.116 port 42368 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.107.206.116
country_id: 1733045
description:
Dec  8 19:42:38 host2 sshd[3983619]: Disconnected from invalid user username 118.107.206.116 port 53914 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 19:43:21 host2 sshd[3984396]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.107.206.116
country_id: 1733045
description:
Dec  8 19:44:00 host2 sshd[3984942]: Disconnected from invalid user moodle 118.107.206.116 port 53684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.35.17
country_id: 1819730
description:
Dec  8 19:46:08 host2 sshd[3987438]: Disconnected from invalid user ansible 118.193.35.17 port 59014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 19:46:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<vmFXcXFFRLWkXGTY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 19:45:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS, session=<Jb4nb3FFGuUjy9Nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-08 19:47:43 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:36918: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-08 19:46:52 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:57396: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.47.214
country_id: 1269750
description:
2025-12-08 19:47:21 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:41717: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-08 19:47:26 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:59669: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-08 19:48:43 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (tanely) [73.176.157.57]:50644: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Dec  8 19:50:05 host2 sshd[3990449]: Disconnected from invalid user dummy 185.158.23.150 port 27913 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 19:50:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<vAz5fXFFzIo+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 19:50:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 12 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<EKkhfnFFFr2G0Wp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.35.17
country_id: 1819730
description:
Dec  8 19:50:32 host2 sshd[3990886]: Disconnected from invalid user ansible 118.193.35.17 port 36304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 19:51:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ot/FgXFFNIgv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 19:51:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<yyvrgXFF4OyeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 19:51:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<jw31g3FFDIk+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 19:51:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<p1lsgXFFIL0+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Dec  8 19:52:42 host2 sshd[3992346]: Disconnected from invalid user ubuntu 103.76.120.106 port 45564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-08 19:52:49 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (inabler) [98.227.25.115]:39670: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 19:53:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<jGJciHFFlqM+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 19:53:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<PN3ginFFtKY+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Dec  8 19:53:51 host2 sshd[3993132]: Disconnected from invalid user username 160.251.251.171 port 36622 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 19:54:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<chx0jXFFTEanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 19:55:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<jA1WkXFF4qi8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 19:55:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<TPaqknFF9p4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-12-08 19:57:28 dovecot_login authenticator failed for ([61.246.205.1]) [125.19.218.2]:40986: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2025-12-08 19:57:46 dovecot_login authenticator failed for ([87.200.93.86]) [87.200.93.86]:44585: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 19:59:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<bEBaoHFFBoY+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Dec  8 20:01:23 host2 sshd[3999068]: Disconnected from invalid user ansible 185.158.23.150 port 14414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.121
country_id: 6252001
description:
Dec  8 20:01:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.121, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<jeBdp3FF9NOi2JV5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-08 20:02:31 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:46520: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.121
country_id: 6252001
description:
Dec  8 20:02:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.121, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<eCpCq3FFvuCi2JV5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-12-08 20:02:47 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:60276: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 20:02:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<WOOFqHFF8JakXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-08 20:02:07 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:46368: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 20:02:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<nrSPqXFFEO0+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec  8 20:03:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ml9zrHFFnopChJl5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec  8 20:03:44 host2 sshd[4000748]: Disconnected from invalid user one 141.95.162.162 port 57812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.205.121
country_id: 1880251
description:
Dec  8 20:03:50 host2 sshd[4000790]: Disconnected from invalid user tempusr 8.219.205.121 port 43854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Dec  8 20:03:59 host2 sshd[4000851]: Disconnected from invalid user user 185.158.23.150 port 35515 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 20:04:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<7eQCsnFFPLk+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 20:05:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<rrevtXFFRJaqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec  8 20:06:04 host2 sshd[4002535]: Disconnected from invalid user middleware 141.95.162.162 port 50882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.205.121
country_id: 1880251
description:
Dec  8 20:08:14 host2 sshd[4003877]: Disconnected from invalid user postgres 8.219.205.121 port 38148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-08 20:08:17 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:33276: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.121
country_id: 6252001
description:
Dec  8 20:08:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.121, lip=66.85.158.92, TLS, session=<GFzqwHFFiuSi2JV5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-08 20:08:06 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:53091: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.63.102.97
country_id: 2510769
description:
2025-12-08 20:09:20 dovecot_login authenticator failed for (212-63-102-97.static.electricasollerense.es) [212.63.102.97]:52212: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-08 20:09:32 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:37186: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-08 20:09:46 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:44782: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Dec  8 20:10:10 host2 sshd[4005299]: Disconnected from invalid user ansible 118.194.250.11 port 33696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 20:10:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<vc5+x3FFgMrO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-08 20:10:02 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:50058: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 20:11:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<pqp1y3FF5Osv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec  8 20:11:52 host2 sshd[4006752]: Disconnected from invalid user middleware 103.164.81.65 port 54082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-08 20:12:13 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:34984: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.95.162.162
country_id: 3017382
description:
Dec  8 20:12:28 host2 sshd[4007252]: Disconnected from invalid user tempusr 141.95.162.162 port 49752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.205.121
country_id: 1880251
description:
Dec  8 20:12:47 host2 sshd[4007540]: Disconnected from invalid user one 8.219.205.121 port 42632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 20:13:03 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:46588: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-08 20:13:17 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:50922: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 20:14:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<uXQk1HFFyn+uijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.112
country_id: 6252001
description:
2025-12-08 20:14:32 dovecot_plain authenticator failed for ([124.198.131.112]) [124.198.131.112]:60152: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-08 20:15:02 dovecot_login authenticator failed for (177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:54664: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-08 20:15:46 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:59124: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-08 20:15:50 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:36125: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-08 20:15:03 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:56338: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-08 20:15:07 dovecot_login authenticator failed for ([182.95.227.70]) [182.95.227.70]:35052: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.64
country_id: 1733045
description:
2025-12-08 20:15:25 dovecot_login authenticator failed for ([49.125.201.64]) [49.125.201.64]:58072: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-08 20:15:27 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:51016: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-08 20:15:50 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:60134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 20:17:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<p11c3nFFgqkv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec  8 20:17:51 host2 sshd[4012102]: Disconnected from invalid user vechain 141.95.162.162 port 46718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.205.121
country_id: 1880251
description:
Dec  8 20:17:53 host2 sshd[4012115]: Disconnected from invalid user vechain 8.219.205.121 port 34102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Dec  8 20:18:09 host2 sshd[4012294]: Disconnected from invalid user user 118.194.250.11 port 56778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-08 20:19:08 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:52929: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-12-08 20:19:17 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:47031: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 20:21:05 host2 sshd[4014196]: Disconnected from invalid user user 2.57.121.25 port 15254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-08 20:23:48 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (ecterring) [93.145.118.40]:42002: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 20:23:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<4NIn9nFFpoY+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Dec  8 20:23:58 host2 sshd[4015795]: Disconnected from invalid user moodle 103.76.120.106 port 48130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.106
country_id: 1643084
description:
Dec  8 20:25:31 host2 sshd[4016619]: Disconnected from invalid user win 103.76.120.106 port 48246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 20:26:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<X1OfAHJFLKNnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Dec  8 20:27:43 host2 sshd[4017879]: Disconnected from invalid user dell 118.194.250.11 port 49136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 20:28:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<PqYNCHJFcO0+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 20:28:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<SPY/CHJFbI7D+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 20:29:38 host2 sshd[4019100]: Disconnected from invalid user user 2.57.121.25 port 44256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.205.121
country_id: 1880251
description:
Dec  8 20:29:34 host2 sshd[4019062]: Disconnected from invalid user middleware 8.219.205.121 port 49628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-08 20:30:08 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:33856: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-08 20:30:22 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:58043: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 20:31:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unper) [87.103.126.54]:43594: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-08 20:31:05 dovecot_login authenticator failed for (dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:49384: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 20:31:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<z+wjE3JF1rnDhTKl>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  8 20:34:25 host2 sshd[4022319]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.27
country_id: 6252001
description:
Dec  8 20:34:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.64.104.27, lip=66.85.158.91, TLS, session=<GlNiHHJFrJ0UQGgb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 1819730
description:
Dec  8 20:35:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<5VjCIHJF/KLE+2Qw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.202
country_id: 6252001
description:
Dec  8 20:35:39 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<V/DOIHJF8OKH7X7K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.224.239
country_id: 1880251
description:
Dec  8 20:37:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=15.235.224.239, lip=66.85.158.91, TLS: Connection closed, session=</GuuJXJFT+wP6+Dv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 20:37:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<qRBGKHJFlIiLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 20:39:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<qvwbL3JFar6l6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 20:39:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<6xw4L3JFct8rpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-12-08 20:40:46 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:46774: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec  8 20:40:47 host2 sshd[4027362]: Disconnected from invalid user username 103.31.39.143 port 38048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.8.117
country_id: 1880251
description:
Dec  8 20:40:16 host2 sshd[4027087]: Disconnected from invalid user middleware 159.65.8.117 port 37282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec  8 20:40:40 host2 sshd[4027348]: Disconnected from invalid user app 103.164.81.65 port 21498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-08 20:40:54 dovecot_login authenticator failed for (221-169-97-62.cust.smartcall.no) [62.97.169.221]:37360: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-12-08 20:43:42 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:9770: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 20:46:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<KUjSSHJFeKUv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec  8 20:49:06 host2 sshd[4034586]: Disconnected from invalid user rpm 103.31.39.143 port 37102 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 20:50:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<QwgLVnJFvshnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Dec  8 20:51:28 host2 sshd[4036952]: Disconnected from invalid user dell 152.32.191.75 port 52946 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-12-08 20:52:04 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:48740: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 20:52:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<NCoJXnJFNsoP6yH0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-08 20:51:54 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:57712: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-08 20:54:37 dovecot_plain authenticator failed for (hyple) [14.139.107.146]:44556: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec  8 20:55:14 host2 sshd[4041389]: Disconnected from invalid user azure_vm 103.31.39.143 port 41536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-08 20:55:53 dovecot_plain authenticator failed for (elitbilid) [80.227.102.242]:39656: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 20:56:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<c/O6bHJFPskz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 20:57:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xVwDb3JFIMIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 20:58:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<j/m8c3JF8oE+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-08 20:59:11 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (golus) [73.137.7.97]:42070: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 21:00:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<BfIXeXJFzJHANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 21:00:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<fqxUeXJFSmKnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2025-12-08 21:01:46 dovecot_plain authenticator failed for cm-72-241-202-104.buckeyecom.net (defercus) [72.241.202.104]:51501: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-08 21:02:48 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:42808: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.224.239
country_id: 1880251
description:
Dec  8 21:01:55 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 3 secs): user=<>, rip=15.235.224.239, lip=66.85.158.92, TLS, session=<49a6fnJFPakP6+Dv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-08 21:02:37 dovecot_login authenticator failed for ([182.73.193.249]) [122.187.41.18]:57386: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 21:03:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<iX+8gnJFoOk+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 21:03:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<CExChXJF1JWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 21:04:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<jVPYh3JFXM8+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 21:05:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<HtN4jHJFAsA+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-08 21:06:47 dovecot_plain authenticator failed for (amuslerium) [65.20.160.107]:53783: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 21:06:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<KtBxjXJFwuk+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 21:12:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<kIbxpXJFPK+kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 21:19:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<RsSpvnJFgOGG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 21:19:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Go4jv3JFNOsv/lVz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 21:21:03 host2 sshd[4062613]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.173
country_id: 953987
description:
Dec  8 21:21:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=102.64.39.173, lip=66.85.158.91, TLS, session=<mvI2xXJF08JmQCet>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.190
country_id: 3469034
description:
Dec  8 21:22:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=186.209.251.190, lip=66.85.158.91, TLS, session=<UvCLxnJFQoy60fu+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-12-08 21:23:10 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:47286: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-08 21:23:20 dovecot_login authenticator failed for ([27.123.102.122]) [27.123.102.122]:56194: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-08 21:23:21 dovecot_login authenticator failed for (cm-178.232.153.184.get.no) [178.232.153.184]:41894: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-12-08 21:23:24 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:37682: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-08 21:22:53 dovecot_login authenticator failed for ([84.213.189.159]) [84.213.189.159]:41436: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-08 21:24:02 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:50074: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-08 21:25:36 dovecot_plain authenticator failed for (ectics) [102.53.15.56]:33903: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 21:25:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<AJP40XJF8N28putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-08 21:26:57 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (refeeip) [73.213.237.28]:38840: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec  8 21:27:03 host2 sshd[4067676]: Disconnected from invalid user infocare 103.20.122.54 port 50752 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.177.98.34
country_id: 290557
description:
2025-12-08 21:29:45 dovecot_plain authenticator failed for ([89.116.164.85]) [109.177.98.34]:55356: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.177.98.34
country_id: 290557
description:
2025-12-08 21:29:52 dovecot_login authenticator failed for ([89.116.164.85]) [109.177.98.34]:55356: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.229.170.33
country_id: 294640
description:
2025-12-08 21:29:58 dovecot_plain authenticator failed for ([89.116.164.85]) [176.229.170.33]:59496: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec  8 21:30:23 host2 sshd[4071106]: Disconnected from invalid user xuhao 38.105.25.194 port 54234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.121.233
country_id: 1880251
description:
Dec  8 21:31:25 host2 sshd[4071999]: Disconnected from invalid user mom 47.237.121.233 port 53422 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 21:32:32 host2 sshd[4073075]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.254.126.144
country_id: 6252001
description:
Dec  8 21:32:12 host2 sshd[4072720]: Disconnected from invalid user ubuntu 47.254.126.144 port 49016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec  8 21:32:27 host2 sshd[4072903]: Disconnected from invalid user erik 12.156.67.18 port 46636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec  8 21:32:44 host2 sshd[4073214]: Disconnected from invalid user yx 38.105.25.194 port 38744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.237.121.233
country_id: 1880251
description:
Dec  8 21:32:55 host2 sshd[4073385]: Disconnected from invalid user user1 47.237.121.233 port 35338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 21:34:21 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (imang) [68.60.77.128]:35266: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.121.233
country_id: 1880251
description:
Dec  8 21:34:25 host2 sshd[4074893]: Disconnected from invalid user incoming 47.237.121.233 port 41218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec  8 21:34:46 host2 sshd[4075206]: Disconnected from invalid user zhy 12.156.67.18 port 53404 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.163.61.136
country_id: 6252001
description:
Dec  8 21:33:48 host2 pure-ftpd[4074211]: (?@20.163.61.136) [INFO] New connection from 20.163.61.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-08 21:34:59 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:46090: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.254.126.144
country_id: 6252001
description:
Dec  8 21:34:59 host2 sshd[4075308]: Disconnected from invalid user mbp 47.254.126.144 port 53754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.251.128
country_id: 1819730
description:
Dec  8 21:35:29 host2 sshd[4075780]: Disconnected from invalid user steam 47.239.251.128 port 54246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-08 21:35:33 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:39826: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 21:35:54 host2 sshd[4075977]: Disconnected from invalid user user 2.57.121.25 port 20684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 21:36:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<4XcV+XJFrsA+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec  8 21:35:51 host2 sshd[4075966]: Disconnected from invalid user ubuntu 12.156.67.18 port 39366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec  8 21:37:08 host2 sshd[4076615]: Disconnected from invalid user lukas 38.105.25.194 port 41932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-08 21:37:11 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:42844: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-08 21:37:38 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:34809: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.105.25.194
country_id: 6252001
description:
Dec  8 21:38:08 host2 sshd[4077275]: Disconnected from invalid user web 38.105.25.194 port 49736 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 21:38:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (thopod) [87.103.126.54]:39369: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.121.233
country_id: 1880251
description:
Dec  8 21:38:57 host2 sshd[4077717]: Disconnected from invalid user xuhao 47.237.121.233 port 59116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec  8 21:40:07 host2 sshd[4079302]: Disconnected from invalid user baidu 12.156.67.18 port 33986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.254.126.144
country_id: 6252001
description:
Dec  8 21:40:12 host2 sshd[4079419]: Disconnected from invalid user ttc 47.254.126.144 port 57812 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-08 21:40:25 dovecot_plain authenticator failed for (comally) [75.97.190.237]:41730: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 21:41:04 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 21:41:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (entremes) [87.103.126.54]:59696: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 21:42:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<rdvOEHNFpJ4+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 21:44:19 host2 sshd[4094086]: Disconnected from invalid user user 2.57.121.25 port 26937 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 21:45:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<aFb1GXNF7q0v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.88
country_id: 3996063
description:
2025-12-08 21:45:48 dovecot_login authenticator failed for ([201.173.97.88]) [201.173.97.88]:55791: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.24
country_id: 6252001
description:
2025-12-08 21:45:58 dovecot_login authenticator failed for ([72.214.133.24]) [72.214.133.24]:52221: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  8 21:46:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ytW6HXNFBMiKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  8 21:47:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<1IqcIHNFYKtnJFMP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.89.102
country_id: 3625428
description:
Dec  8 21:47:18 host2 sshd[4096701]: Disconnected from invalid user gokul 201.249.89.102 port 50140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.251.128
country_id: 1819730
description:
Dec  8 21:47:35 host2 sshd[4096840]: Disconnected from invalid user blog 47.239.251.128 port 41160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  8 21:47:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</0gxInNFteZ100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  8 21:47:51 host2 pure-ftpd[4096932]: (?@134.209.173.54) [INFO] New connection from 134.209.173.54


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 21:48:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<nlKII3NFvpWqQMFo>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  8 21:48:14 host2 pure-ftpd[4097136]: (?@134.209.173.54) [INFO] New connection from 134.209.173.54


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.92
country_id: 6252001
description:
Dec  8 21:49:46 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.92, lip=66.85.158.92, TLS handshaking: Connection closed, session=<I57dKXNFDOFAPsVc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.239.251.128
country_id: 1819730
description:
Dec  8 21:50:17 host2 sshd[4098518]: Disconnected from invalid user lukas 47.239.251.128 port 41368 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.92
country_id: 6252001
description:
Dec  8 21:50:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.92, lip=66.85.158.92, TLS handshaking: Connection closed, session=<InUYK3NF7CtAPsVc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 21:52:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<JkT0NHNFPKQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-08 21:54:47 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (boidabst) [24.127.53.61]:53334: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-12-08 21:56:39 dovecot_login authenticator failed for ([190.223.36.108]) [190.223.36.108]:38134: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-12-08 21:56:52 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:55297: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.89.102
country_id: 3625428
description:
Dec  8 21:59:28 host2 sshd[4104346]: Disconnected from invalid user csuser 201.249.89.102 port 60096 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-08 22:01:30 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (oreavora) [73.176.157.57]:55422: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 22:02:12 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-08 22:02:17 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (comiang) [73.183.74.177]:41210: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 22:03:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nADGWnNF3r2PbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.89.102
country_id: 3625428
description:
Dec  8 22:04:25 host2 sshd[4108373]: Disconnected from invalid user ttc 201.249.89.102 port 35842 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.138
country_id: 6252001
description:
Dec  8 22:05:27 host2 pure-ftpd[4109812]: (?@147.185.132.138) [INFO] New connection from 147.185.132.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-08 22:05:31 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:50584: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 22:05:42 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-08 22:05:53 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:55164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  8 22:05:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<CL2AY3NFboKl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-12-08 22:07:27 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:51628: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 22:11:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<vIeCeHNF+IePbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-12-08 22:11:02 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:55679: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-08 22:11:10 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:52499: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-08 22:11:19 +0530] info [cpaneld] 89.249.55.106 - bostonla "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonla (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-08 22:11:53 dovecot_plain authenticator failed for (poldcres) [178.250.191.189]:42856: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  8 22:13:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<Ry4QfXNF4sinR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 22:13:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<cN9WfXNFZp8+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec  8 22:14:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<AAnVgHNFHOBAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 22:15:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<udoThXNFdNAv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 22:17:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<lipri3NFAos+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 22:17:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<AkIBjHNF2Io+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.55.4
country_id: 6252001
description:
Dec  8 22:17:25 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.55.4, lip=66.85.158.92, session=<bR7IjHNFOuSl4zcE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  8 22:17:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<au+zjXNFLOxnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec  8 22:16:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<PkdminNFXqFAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 22:19:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<1aqRk3NF2Ik+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 22:19:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<5OQylHNFJpe8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec  8 22:20:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<m54Cl3NF1JNAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 22:22:16 host2 sshd[4122274]: Disconnected from invalid user admin 2.57.121.112 port 42094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 22:22:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<1w3pnnNFErE+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Dec  8 22:23:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.91, session=<iEMWo3NFHZBAPpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Dec  8 22:23:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.91, TLS: Connection closed, session=<JSu9o3NFpIVAPpze>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.238.243.125
country_id: 1819730
description:
Dec  8 22:25:22 host2 sshd[4124447]: Disconnected from invalid user ec2-user 47.238.243.125 port 36818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  8 22:25:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<yLuYqXNFZOaPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec  8 22:26:19 host2 sshd[4125040]: Disconnected from invalid user chris 103.144.28.85 port 37072 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 22:28:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<UlcAs3NFMIM+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  8 22:28:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<0sDosnNFcOWKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec  8 22:28:46 host2 sshd[4126666]: Disconnected from invalid user exam 103.144.28.85 port 41258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-08 22:28:59 dovecot_plain authenticator failed for (enving) [24.104.225.201]:33583: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 22:29:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<YCBmtnNFgqg+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.238.243.125
country_id: 1819730
description:
Dec  8 22:29:14 host2 sshd[4126973]: Disconnected from invalid user user 47.238.243.125 port 45570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.28.85
country_id: 1819730
description:
Dec  8 22:29:52 host2 sshd[4127336]: Disconnected from invalid user user-backup 103.144.28.85 port 42740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 22:30:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Cu+fuXNFhLqqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  8 22:30:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<7DmJu3NFHs+KxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 22:30:38 host2 sshd[4128151]: Disconnected from invalid user admin 2.57.121.112 port 18768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-08 22:30:38 dovecot_plain authenticator failed for (yosteiongs) [187.161.198.68]:52455: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec  8 22:31:43 host2 sshd[4128821]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 61059


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.24.202.135
country_id: 798544
description:
Dec  8 22:32:14 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=193.24.202.135, lip=66.85.158.91, TLS, session=<VnevwHNFz5DBGMqH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.67
country_id: 3175395
description:
Dec  8 22:32:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.171.67, lip=66.85.158.91, TLS, session=<3CbTwXNFrMi5D6tD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  8 22:32:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<AVVDwXNFCLSl0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec  8 22:33:17 host2 sshd[4130300]: Disconnected from invalid user cacti 103.144.28.85 port 47220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec  8 22:35:32 host2 sshd[4132024]: Disconnected from invalid user demo 103.144.28.85 port 50190 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.54
country_id: 2635167
description:
Dec  8 22:35:45 host2 dovecot[2208013]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.54, lip=66.85.158.92, TLS, session=<96xbznNFW46594k2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.88
country_id: 2635167
description:
Dec  8 22:35:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.88, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+MFrznNFaca594lY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-08 22:35:54 dovecot_login authenticator failed for ([90.161.217.228]) [90.161.217.228]:58493: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  8 22:36:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ykzPz3NFBfV100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-08 22:36:19 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:59220: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.74
country_id: 2635167
description:
Dec  8 22:36:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.74, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<o2pn0HNFd7tX7LBK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.102
country_id: 2635167
description:
Dec  8 22:36:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.102, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Y41i0nNF1dK594lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.76
country_id: 2635167
description:
Dec  8 22:37:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.76, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<MhBe1HNFicFX7LBM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Dec  8 22:38:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<v6NS2HNFx5JX7LBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.239.209
country_id: 1880251
description:
Dec  8 22:38:35 host2 sshd[4134487]: Disconnected from invalid user git 8.219.239.209 port 43594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.83
country_id: 1643084
description:
Dec  8 22:38:37 host2 sshd[4134496]: Disconnected from invalid user akbar 103.172.204.83 port 49288 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec  8 22:37:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<XzxZ1nNF09JX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.92
country_id: 2635167
description:
Dec  8 22:39:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.92, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<aPhP2nNFZcZX7LBc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.238.243.125
country_id: 1819730
description:
Dec  8 22:39:25 host2 sshd[4134993]: Disconnected from invalid user oracle 47.238.243.125 port 44562 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec  8 22:39:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<BCdL3HNFLcRX7LBO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-08 22:39:44 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:34141: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.96
country_id: 2635167
description:
Dec  8 22:40:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.96, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<lo9E3nNFOddX7LBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.109
country_id: 2635167
description:
Dec  8 22:40:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Bew/4HNFide594lt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  8 22:41:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<9atQ5HNF0QF100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 22:43:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<5piK6XNFXqiqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.239.209
country_id: 1880251
description:
Dec  8 22:44:29 host2 sshd[4138306]: Disconnected from invalid user test1 8.219.239.209 port 50470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.83
country_id: 1643084
description:
Dec  8 22:45:12 host2 sshd[4139110]: Disconnected from invalid user david 103.172.204.83 port 40136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-08 22:45:15 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:45238: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-08 22:45:34 dovecot_login authenticator failed for ([49.204.232.244]) [49.204.232.244]:60166: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.83
country_id: 1643084
description:
Dec  8 22:47:05 host2 sshd[4140580]: Disconnected from invalid user ociisprd 103.172.204.83 port 59168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.239.209
country_id: 1880251
description:
Dec  8 22:47:10 host2 sshd[4140615]: Disconnected from invalid user satisfactory 8.219.239.209 port 53816 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.243.135.250
country_id: 6251999
description:
2025-12-08 22:48:37 dovecot_plain authenticator failed for pool-99-243-135-250.cpe.net.cable.rogers.com (mail.euroentertainmentlk.com) [99.243.135.250]:60071: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.71.208.54
country_id: 285570
description:
2025-12-08 22:48:45 dovecot_plain authenticator failed for (66.85.158.91) [188.71.208.54]:20935: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.83
country_id: 1643084
description:
Dec  8 22:48:52 host2 sshd[4141725]: Disconnected from invalid user test 103.172.204.83 port 39212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 22:49:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<lz9X/nNFDL4+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.235.59.6
country_id: 6251999
description:
2025-12-08 22:49:25 dovecot_plain authenticator failed for pool-99-235-59-6.cpe.net.cable.rogers.com (webmail.euroentertainmentlk.com) [99.235.59.6]:57472: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.213.123
country_id: 1733045
description:
2025-12-08 22:49:33 dovecot_plain authenticator failed for (euroentertainmentlk.com) [113.211.213.123]:31131: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 22:49:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=</ktpAHRFdoAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-08 22:50:13 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:39826: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  8 22:50:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<Ul5BA3RFCIhnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-08 22:49:54 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:45465: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.89.73.80
country_id: 3469034
description:
2025-12-08 22:51:34 dovecot_plain authenticator failed for (localhost) [187.89.73.80]:62588: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.24.45.214
country_id: 6252001
description:
2025-12-08 22:51:41 dovecot_plain authenticator failed for c-76-24-45-214.hsd1.nh.comcast.net (localhost) [76.24.45.214]:58361: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.53.248.18
country_id: 3608932
description:
2025-12-08 22:51:25 dovecot_plain authenticator failed for (localhost) [190.53.248.18]:64401: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.195.116.52
country_id: 6252001
description:
2025-12-08 22:51:18 dovecot_plain authenticator failed for 47-195-116-52.fdr01.lutz.fl.frontiernet.net (localhost) [47.195.116.52]:55350: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.239.209
country_id: 1880251
description:
Dec  8 22:51:24 host2 sshd[4143686]: Disconnected from invalid user amine 8.219.239.209 port 58826 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.253.149.43
country_id: 3932488
description:
2025-12-08 22:51:48 dovecot_plain authenticator failed for (localhost) [38.253.149.43]:24390: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.238.243.125
country_id: 1819730
description:
Dec  8 22:52:13 host2 sshd[4144304]: Disconnected from invalid user dev 47.238.243.125 port 49638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.246.113.124
country_id: 3865483
description:
2025-12-08 22:52:56 dovecot_plain authenticator failed for (localhost) [190.246.113.124]:14074: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.195.116.52
country_id: 6252001
description:
2025-12-08 22:53:06 dovecot_plain authenticator failed for 47-195-116-52.fdr01.lutz.fl.frontiernet.net (localhost) [47.195.116.52]:58101: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.84.135
country_id: 3439705
description:
2025-12-08 22:53:15 dovecot_plain authenticator failed for r186-53-84-135.dialup.adsl.anteldata.net.uy (localhost) [186.53.84.135]:55484: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.10.87
country_id: 3469034
description:
2025-12-08 22:53:24 dovecot_plain authenticator failed for 187-40-10-87.user3p.vtal.net.br (localhost) [187.40.10.87]:40251: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 22:54:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<O1x1EXRFsKSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 22:57:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<S1nHHHRF+KA+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  8 23:00:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@venee.lk>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<qz1eJ3RFosOl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  8 23:01:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<Ov+gKnRFsKSl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-08 23:02:25 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (hypted) [76.31.164.124]:55920: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 23:02:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<3UqJL3RFYtWPbtX3>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.52
country_id: 6252001
description:
Dec  8 23:04:07 host2 pure-ftpd[4154456]: (?@205.210.31.52) [INFO] New connection from 205.210.31.52


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 23:04:30 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59049: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  8 23:04:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<Paa7NXRF3uWnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-08 23:05:14 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:55580: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-08 23:05:21 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (prinesoan) [98.204.134.124]:50526: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-12-08 23:05:38 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:55738: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.245.60.230
country_id: 1880251
description:
[2025-12-08 23:06:02 +0530] info [cpaneld] 157.245.60.230 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-08 23:08:08 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (oacting) [98.204.134.124]:37202: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-12-08 23:08:19 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:46984: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-08 23:07:56 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:60947: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 23:09:29 host2 sshd[4158384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec  8 23:09:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<InwiRnRFRuRAF4KF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-08 23:09:39 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (carcubten) [73.145.107.251]:43826: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec  8 23:11:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<OS2zT3RFytBAF4KF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-08 23:17:23 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:61449: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  8 23:17:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<3jaaY3RFsOSPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-08 23:17:38 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:33113: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  8 23:18:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<r8syZnRF5K+KxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec  8 23:18:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xEnraHRFRjDY2s5E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 23:19:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (dinger) [87.103.126.54]:32470: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec  8 23:18:40 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, session=<iqHSZ3RFGsxKUi8F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec  8 23:18:43 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<VCkCaHRF3hO4affD>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 23:20:34 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.93.223.44
country_id: 1269750
description:
[2025-12-08 23:20:48 +0530] info [webmaild] 142.93.223.44 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  8 23:21:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<d+06cHRF1KuKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  8 23:23:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<SIHWd3RF5L1nJFMP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 23:24:58 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 23:26:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<vhmGgnRFgoKqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 23:26:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<8RL6hHRFvNk+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  8 23:27:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<IC/4hnRF+t6LonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2025-12-08 23:29:16 dovecot_login authenticator failed for 180.188.76.219.static.netvigator.com [219.76.188.180]:53716: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  8 23:30:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<iLMaknRFSjR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.196.214
country_id: 3144096
description:
2025-12-08 23:30:33 dovecot_login authenticator failed for (cm-178.232.196.214.get.no) [178.232.196.214]:46091: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 23:31:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<NMZvlHRFppY+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 23:31:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<wCkTlXRFCrU+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-12-08 23:30:44 dovecot_login authenticator failed for ([122.184.89.169]) [125.23.203.114]:53804: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Dec  8 23:31:04 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, session=<TuUtlHRFoC2s7OTF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 23:32:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<EW7dl3RFZtQ+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 23:33:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<hbB8nHRFfME+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-08 23:32:57 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:51786: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-08 23:33:09 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:51492: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-08 23:34:49 dovecot_plain authenticator failed for (denozogri) [102.53.15.17]:52237: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec  8 23:35:28 host2 sshd[4175960]: Disconnected from invalid user walter 103.123.53.88 port 37638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  8 23:36:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jiJxpnRFj/p100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-08 23:37:16 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:40298: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-12-08 23:37:24 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:47895: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec  8 23:36:51 host2 sshd[4176602]: Disconnected from invalid user sysadmin 103.123.53.88 port 38524 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-08 23:36:55 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:59796: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-08 23:36:59 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:37238: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.53.88
country_id: 1269750
description:
Dec  8 23:38:10 host2 sshd[4177178]: Disconnected from invalid user mailuser 103.123.53.88 port 52634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 23:39:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<YRIBsnRFVIeqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 23:43:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<DunovnRF/JE+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 23:43:23 host2 sshd[4179582]: Disconnected from invalid user admin 2.57.121.112 port 22831 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-08 23:43:24 dovecot_plain authenticator failed for (cynous) [65.20.164.137]:59523: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 23:43:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<MuvlwHRFaKw+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 23:45:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<mNTnxXRF9LEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 23:45:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<U9OMyHRFEJWPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec  8 23:46:20 host2 sshd[4182394]: Disconnected from invalid user cent 103.123.53.88 port 45162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec  8 23:46:23 host2 sshd[4182447]: Disconnected from invalid user admin 95.85.114.218 port 59340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-12-08 23:47:20 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:57102: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.129.182
country_id: 3144096
description:
2025-12-08 23:47:14 dovecot_login authenticator failed for ([188.124.129.182]) [188.124.129.182]:55707: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  8 23:48:55 host2 sshd[4184648]: Disconnected from invalid user huawei 45.230.150.7 port 59038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  8 23:49:15 host2 sshd[4185137]: Disconnected from invalid user ubuntu 62.60.193.188 port 44242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.85.114.218
country_id: 1218197
description:
Dec  8 23:50:24 host2 sshd[4186591]: Disconnected from invalid user huawei 95.85.114.218 port 33534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec  8 23:51:13 host2 sshd[4187081]: Disconnected from invalid user ubuntu 95.85.114.218 port 39400 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.89.12.73
country_id: 3469034
description:
2025-12-08 23:51:33 dovecot_plain authenticator failed for 189-89-12-73.jupiterprovedor.com.br ([89.116.164.85]) [189.89.12.73]:11018: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.89.12.73
country_id: 3469034
description:
2025-12-08 23:51:40 dovecot_login authenticator failed for 189-89-12-73.jupiterprovedor.com.br ([89.116.164.85]) [189.89.12.73]:11018: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.215.178
country_id: 2750405
description:
Dec  8 23:51:41 host2 pure-ftpd[4187321]: (?@164.92.215.178) [INFO] New connection from 164.92.215.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.100.101.161
country_id: 3865483
description:
2025-12-08 23:51:47 dovecot_plain authenticator failed for ([89.116.164.85]) [131.100.101.161]:56242: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.70.198.191
country_id: 1643084
description:
2025-12-08 23:52:02 dovecot_plain authenticator failed for ([89.116.164.85]) [36.70.198.191]:43024: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  8 23:52:06 host2 sshd[4187531]: Disconnected from invalid user aaa 8.219.161.97 port 36778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  8 23:52:42 host2 sshd[4187903]: Disconnected from invalid user user 45.230.150.7 port 38096 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 23:54:07 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (zoraticang) [87.103.126.54]:18513: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 23:54:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<isHo5nRFnNKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  8 23:54:25 host2 sshd[4189295]: Disconnected from invalid user ubuntu 8.219.161.97 port 58538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  8 23:55:28 host2 sshd[4189872]: Disconnected from invalid user spark 45.230.150.7 port 35914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  8 23:55:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<av7P63RF6KdnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-08 23:56:21 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:50763: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  8 23:56:23 host2 sshd[4190342]: Disconnected from invalid user httpd 62.60.193.188 port 41862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-08 23:55:59 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:35201: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-08 23:56:07 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:56022: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-08 23:56:18 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:56321: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-08 23:56:19 dovecot_login authenticator failed for ([84.211.12.159]) [84.211.12.159]:34733: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-08 23:56:01 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:51850: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec  8 23:56:08 host2 sshd[4190192]: Disconnected from invalid user ubuntu 95.85.114.218 port 46876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.8.54
country_id: 1880251
description:
Dec  8 23:57:20 host2 sshd[4190810]: Disconnected from invalid user wx 8.219.8.54 port 38818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-08 23:58:15 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:40314: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-08 23:58:30 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (torme) [75.74.211.27]:35703: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-08 23:57:49 dovecot_login authenticator failed for (187.161.136.37-clientes-izzi.mx) [187.161.136.37]:53952: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  8 23:58:48 host2 sshd[4191617]: Disconnected from invalid user rtc 8.219.161.97 port 40376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-12-08 23:59:10 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:43636: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-08 23:59:22 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:56746: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  8 23:59:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<PRSK+XRFtKenR+bm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  8 23:58:46 host2 sshd[4191593]: Disconnected from invalid user debian 62.60.193.188 port 46532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec  9 00:00:24 host2 sshd[4192971]: Disconnected from invalid user walter 45.78.230.104 port 44046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  9 00:00:49 host2 sshd[4193225]: Disconnected from invalid user monitor 45.230.150.7 port 59792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  9 00:01:11 host2 sshd[4193467]: Disconnected from invalid user deployer 62.60.193.188 port 59474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 00:01:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<+pYbAnVF9sM+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  9 00:02:11 host2 sshd[4193978]: Disconnected from invalid user admin 45.230.150.7 port 58700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 00:02:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<BnLtBHVFhoAXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.2.130
country_id: 1880251
description:
Dec  9 00:03:47 host2 sshd[1036]: Disconnected from invalid user monitor 47.236.2.130 port 50316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-09 00:04:05 dovecot_plain authenticator failed for (whalacin) [65.20.184.80]:45288: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.217.245
country_id: 6252001
description:
Dec  9 00:04:33 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=69.164.217.245, lip=66.85.158.92, session=<ImTgC3VF+tBFpNn1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  9 00:04:54 host2 sshd[1669]: Disconnected from invalid user rtc 45.230.150.7 port 56530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  9 00:05:22 host2 sshd[2082]: Disconnected from invalid user ubuntu 8.219.161.97 port 54612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.8.54
country_id: 1880251
description:
Dec  9 00:07:52 host2 sshd[3374]: Disconnected from invalid user ankit 8.219.8.54 port 55912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 00:09:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (relibetion) [87.103.126.54]:9829: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 00:09:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<oSMIHHVFkqC8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.8.54
country_id: 1880251
description:
Dec  9 00:09:33 host2 sshd[4432]: Disconnected from invalid user uzivatel 8.219.8.54 port 39374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 00:10:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<8QyJIXVFGISPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  9 00:10:55 host2 sshd[5565]: Disconnected from invalid user kuba 62.60.193.188 port 47432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-12-09 00:11:04 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:56876: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 00:11:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<viMJJHVFSo+KxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 00:12:07 host2 sshd[6490]: Disconnected from invalid user user 2.57.121.25 port 44479 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-09 00:12:53 dovecot_login authenticator failed for ([125.18.210.161]) [182.95.119.118]:41728: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-12-09 00:13:18 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:55751: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-09 00:12:41 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:43402: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-09 00:12:51 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:41888: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-09 00:12:51 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:45579: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 00:13:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<51/dK3VFKtM+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-09 00:13:09 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:36576: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-09 00:13:43 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:45705: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 00:14:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Va0cLnVFioqKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.193.188
country_id: 130758
description:
Dec  9 00:14:31 host2 sshd[8368]: Disconnected from invalid user star 62.60.193.188 port 52736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  9 00:14:37 host2 sshd[8475]: Disconnected from invalid user aaa 45.230.150.7 port 48944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  9 00:16:25 host2 sshd[9815]: Disconnected from invalid user admin 8.219.161.97 port 39408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 00:16:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<s5zZNnVFMrc+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 00:16:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<xaAUOHVFNtI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 00:17:15 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (celly) [87.103.126.54]:59290: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-09 00:17:28 dovecot_plain authenticator failed for (ticary) [185.214.169.10]:54062: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 00:17:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<z5lNO3VFCOI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 00:18:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jTypPHVFGJQv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  9 00:18:29 host2 sshd[11444]: Disconnected from invalid user spark 8.219.161.97 port 57952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.2.130
country_id: 1880251
description:
Dec  9 00:17:48 host2 sshd[10914]: Disconnected from invalid user dspace 47.236.2.130 port 51872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec  9 00:20:23 host2 sshd[13041]: Disconnected from invalid user odoo 45.78.230.104 port 35768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.8.54
country_id: 1880251
description:
Dec  9 00:21:12 host2 sshd[13436]: Disconnected from invalid user sysadmin 8.219.8.54 port 39480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-09 00:21:22 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:59559: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-09 00:21:48 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:49512: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 00:22:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<m1hySnVFSOw+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 00:22:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<feyaSnVF3LyqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec  9 00:22:52 host2 sshd[14528]: Disconnected from invalid user steam 45.78.230.104 port 52950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.179.36
country_id: 2510769
description:
2025-12-09 00:24:24 dovecot_login authenticator failed for 36.red-80-29-179.dynamicip.rima-tde.net [80.29.179.36]:41697: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec  9 00:24:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RbL3UnVFlLdChJmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 00:24:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<8UxCU3VFhFF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2025-12-09 00:25:10 dovecot_login authenticator failed for ([197.231.202.201]) [197.231.202.201]:44098: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-09 00:24:47 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:59646: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-09 00:24:53 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:45811: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.236.2.130
country_id: 1880251
description:
Dec  9 00:24:54 host2 sshd[16125]: Disconnected from invalid user ubuntu 47.236.2.130 port 36048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 00:25:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<uj1yV3VFSOY+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 00:27:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<GTfKXnVFRKpnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 00:30:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<IoRzZ3VFH95100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-09 00:31:37 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (differm) [93.145.118.40]:60774: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  9 00:31:33 host2 sshd[21553]: Disconnected from invalid user artur 8.219.161.97 port 33366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-09 00:33:05 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:38905: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-12-09 00:33:13 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:37390: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 00:35:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<cSqZeXVF+O2qQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.202.209.172
country_id: 3437598
description:
Dec  9 00:35:44 host2 sshd[24672]: Disconnected from invalid user ubuntu 143.202.209.172 port 42794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-09 00:36:27 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:37348: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.122
country_id: 2635167
description:
Dec  9 00:37:29 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.122, lip=66.85.158.92, TLS, session=<ZJOpgXVFF56594l6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 00:36:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<rEf1fnVF4JY+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 00:36:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<2chsf3VFDsKPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-09 00:38:08 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:45756: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-09 00:37:49 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:43672: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.85
country_id: 2635167
description:
Dec  9 00:39:40 host2 dovecot[2208013]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.85, lip=66.85.158.92, TLS, session=<pId2iXVFVe1X7LBV>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 00:40:39 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 00:42:49 host2 sshd[29606]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 00:43:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<80QdmHVFWN0v/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.202.209.172
country_id: 3437598
description:
Dec  9 00:43:56 host2 sshd[30311]: Disconnected from invalid user httpd 143.202.209.172 port 57676 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 00:44:26 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 00:45:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<TCiJnXVFkJWPbtX3>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 143.110.213.247
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[143.110.213.247] [Remote Port]=[38288] [Authentication Database]=[mail] [Username]=[notify@seyawin.com] (10/10 failures) (blocked until [Tue Dec  9 19:15:16 2025 UTC/Wed Dec 10 00:45:16 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec  9 00:45:22 host2 sshd[31749]: Disconnected from invalid user guest2 45.78.230.104 port 53638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-09 00:47:14 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:37132: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 00:47:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<5JgSp3VFTMA+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.202.209.172
country_id: 3437598
description:
Dec  9 00:50:40 host2 sshd[35721]: Disconnected from invalid user felix 143.202.209.172 port 59292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.84.36.99
country_id: 1880251
description:
Dec  9 00:52:44 host2 sshd[37131]: Disconnected from invalid user openstack 47.84.36.99 port 41082 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 00:53:52 host2 sshd[37785]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 00:54:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<8qvrvHVFqsWnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 00:56:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<2vWuxXVFvpk+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.49
country_id: 3469034
description:
Dec  9 00:56:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.89.137.49, lip=66.85.158.91, TLS, session=<UsfpxXVFDey+WYkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.236
country_id: 3865483
description:
Dec  9 00:57:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=181.191.223.236, lip=66.85.158.91, TLS, session=<MRAQx3VFi+a1v9/s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-12-09 00:58:10 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:59740: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-12-09 00:58:16 dovecot_login authenticator failed for ([209.23.72.144]) [209.23.72.144]:39184: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-09 00:58:25 dovecot_login authenticator failed for ([149.54.15.42]) [149.54.15.42]:46490: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-12-09 00:58:54 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:52360: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-12-09 00:58:41 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:46562: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-12-09 00:58:47 dovecot_login authenticator failed for ([125.23.125.209]) [122.187.59.26]:36462: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.189.141
country_id: 1819730
description:
Dec  9 00:58:52 host2 sshd[42522]: Disconnected from invalid user misp 47.243.189.141 port 45968 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 00:59:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<1DFw0XVFDtpnJFMP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.243.189.141
country_id: 1819730
description:
Dec  9 01:00:27 host2 sshd[43969]: Disconnected from invalid user saeid 47.243.189.141 port 52832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-09 01:01:28 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:33682: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.234.150
country_id: 1733045
description:
Dec  9 01:02:07 host2 sshd[44991]: Disconnected from invalid user olivier 102.211.234.150 port 45198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.122.248
country_id: 1819730
description:
Dec  9 01:02:11 host2 sshd[45023]: Disconnected from invalid user artur 47.243.122.248 port 44122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.103.161
country_id: 1819730
description:
Dec  9 01:02:27 host2 sshd[45205]: Disconnected from invalid user student2 8.210.103.161 port 49356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-09 01:01:45 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:50674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 01:03:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<1DzZ3nVFloqPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec  9 01:02:48 host2 sshd[45379]: Disconnected from invalid user test1 101.47.162.24 port 58070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.102.234.58
country_id: 1269750
description:
Dec  9 01:02:56 host2 sshd[45467]: Disconnected from invalid user hz 103.102.234.58 port 33728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:03:26 host2 sshd[46477]: Disconnected from invalid user web 83.235.21.125 port 44794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.1.180
country_id: 953987
description:
Dec  9 01:03:33 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@v-deploy.com>, method=PLAIN, rip=102.66.1.180, lip=66.85.158.91, TLS, session=<+6+q3XVFe4lmQgG0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.122.248
country_id: 1819730
description:
Dec  9 01:03:39 host2 sshd[46612]: Disconnected from invalid user httpd 47.243.122.248 port 33292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 01:03:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<HymN33VFjraKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.247
country_id: 3469034
description:
Dec  9 01:03:54 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.205.247, lip=66.85.158.91, TLS, session=<UGsH33VFTYKzvc33>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.165
country_id: 6252001
description:
Dec  9 01:04:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.165, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vPw/4XVFz5NBMQGl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 01:04:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<0Wod4XVF3p+8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Dec  9 01:04:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sb1P4nVFgmtBMQGi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:04:37 host2 sshd[47296]: Disconnected from invalid user asd 83.235.21.125 port 53854 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Dec  9 01:04:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS: Connection closed, session=<S0vf4nVF4LlBMQGi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 01:06:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<qx6B6XVF1K+KxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.84.36.99
country_id: 1880251
description:
Dec  9 01:05:44 host2 sshd[48484]: Disconnected from invalid user user2 47.84.36.99 port 39718 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:05:44 host2 sshd[48491]: Disconnected from invalid user pzuser 83.235.21.125 port 56748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.189.141
country_id: 1819730
description:
Dec  9 01:06:27 host2 sshd[49113]: Disconnected from invalid user user2 47.243.189.141 port 52010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.215.45.49
country_id: 3469034
description:
Dec  9 01:06:38 host2 sshd[49244]: Disconnected from invalid user shopify 181.215.45.49 port 39850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.218.173
country_id: 1819730
description:
Dec  9 01:05:49 host2 sshd[48576]: Disconnected from invalid user ubuntu 47.239.218.173 port 47570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Dec  9 01:07:09 host2 sshd[49640]: Disconnected from invalid user aaa 201.249.87.201 port 54336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:06:51 host2 sshd[49450]: Disconnected from invalid user dns 83.235.21.125 port 57866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:07:53 host2 sshd[50078]: Disconnected from invalid user httpd 83.235.21.125 port 46282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.29.61
country_id: 6251999
description:
Dec  9 01:08:21 host2 sshd[50397]: Disconnected from invalid user hz 51.222.29.61 port 36154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-09 01:08:43 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (rechitic) [71.230.228.16]:51486: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.122.248
country_id: 1819730
description:
Dec  9 01:09:05 host2 sshd[50879]: Disconnected from invalid user olivier 47.243.122.248 port 36768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec  9 01:10:26 host2 sshd[52206]: Disconnected from invalid user olivier 181.46.131.55 port 58154 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.243.122.248
country_id: 1819730
description:
Dec  9 01:10:27 host2 sshd[52216]: Disconnected from invalid user guest 47.243.122.248 port 47844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.189.141
country_id: 1819730
description:
Dec  9 01:09:44 host2 sshd[51319]: Disconnected from invalid user vikas 47.243.189.141 port 37484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-09 01:11:30 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:34282: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-09 01:11:37 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:32975: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Dec  9 01:10:41 host2 sshd[52363]: Disconnected from invalid user tang 201.249.87.201 port 50224 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.198
country_id: 6252001
description:
Dec  9 01:10:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.198, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Dwem+HVFKNnG6xjG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec  9 01:12:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.66, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wMI2/XVFb8OTuYRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Dec  9 01:12:19 host2 sshd[53641]: Disconnected from invalid user httpd 201.249.87.201 port 48166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 01:17:03 host2 sshd[57474]: Disconnected from invalid user user 2.57.121.25 port 35166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.218.173
country_id: 1819730
description:
Dec  9 01:17:15 host2 sshd[57621]: Disconnected from invalid user testa 47.239.218.173 port 37056 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 01:17:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<djzvEHZFSOmqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.18.158
country_id: 1819730
description:
Dec  9 01:17:40 host2 sshd[57890]: Disconnected from invalid user admin 47.83.18.158 port 49742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 01:18:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jbEsFHZF6sl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.191.195.188
country_id: 3865483
description:
2025-12-09 01:19:07 dovecot_plain authenticator failed for ([89.116.164.85]) [190.191.195.188]:35186: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.222.245
country_id: 3469034
description:
2025-12-09 01:19:20 dovecot_plain authenticator failed for 245.222.208.186.yukanet.com.br ([89.116.164.85]) [186.208.222.245]:59369: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.56.197
country_id: 6252001
description:
Dec  9 01:18:35 host2 sshd[58450]: Disconnected from invalid user gmodserver 167.99.56.197 port 43356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.207.28.62
country_id: 3469034
description:
2025-12-09 01:18:53 dovecot_plain authenticator failed for ([89.116.164.85]) [186.207.28.62]:52288: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.144
country_id: 6252001
description:
Dec  9 01:20:07 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=195.184.76.144, lip=66.85.158.92, TLS handshaking: Connection closed, session=<TOQnGnZFf4DDuEyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.83
country_id: 6252001
description:
Dec  9 01:20:18 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.83, lip=66.85.158.92, TLS: Connection closed, session=<FczUGnZFZZjDuExT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.218.173
country_id: 1819730
description:
Dec  9 01:21:02 host2 sshd[59925]: Disconnected from invalid user aa 47.239.218.173 port 50152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.18.158
country_id: 1819730
description:
Dec  9 01:21:31 host2 sshd[60275]: Disconnected from invalid user kevin 47.83.18.158 port 57214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.146
country_id: 6252001
description:
Dec  9 01:20:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.146, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<KJ6iG3ZF56nDuEyS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.86
country_id: 6252001
description:
Dec  9 01:20:35 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.86, lip=66.85.158.92, TLS: Connection closed, session=<BH3RG3ZF177DuExW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.83.18.158
country_id: 1819730
description:
Dec  9 01:22:45 host2 sshd[61457]: Disconnected from invalid user user2 47.83.18.158 port 46184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.124.114.7
country_id: 3865483
description:
Dec  9 01:23:07 host2 sshd[61836]: Disconnected from invalid user userroot 186.124.114.7 port 35966 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.39.45
country_id: 1819730
description:
Dec  9 01:23:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=118.193.39.45, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qxgLJnZFHih2wSct>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 01:24:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<oSZnKHZFtTh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 01:25:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<93oZLHZFosE+PIcp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.56.197
country_id: 6252001
description:
Dec  9 01:25:51 host2 sshd[64423]: Disconnected from invalid user admin 167.99.56.197 port 42072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.40.2.36
country_id: 6252001
description:
2025-12-09 01:26:47 dovecot_plain authenticator failed for ([89.116.164.85]) [64.40.2.36]:46288: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.136.227.124
country_id: 3996063
description:
2025-12-09 01:27:00 dovecot_plain authenticator failed for ([89.116.164.85]) [187.136.227.124]:24262: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.208.130
country_id: 3469034
description:
2025-12-09 01:26:35 dovecot_plain authenticator failed for ([89.116.164.85]) [187.49.208.130]:53600: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 01:27:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<MIzQNXZFCL6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 01:28:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<WWb7NnZFwJg+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 01:28:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<ZfEeOXZFtto+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec  9 01:29:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, session=<PSz9OXZFAf/CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 01:29:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<U+qbPHZFDqw+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.124.114.7
country_id: 3865483
description:
Dec  9 01:30:34 host2 sshd[68603]: Disconnected from invalid user nishant 186.124.114.7 port 41208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 01:30:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<7elAQHZF9LGqQMFo>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 170.64.193.104
country_id: 2077456
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[170.64.193.104] [Remote Port]=[45556] [Authentication Database]=[mail] [Username]=[notify@sobaherbal.com] (10/10 failures) (blocked until [Tue Dec  9 20:00:46 2025 UTC/Wed Dec 10 01:30:46 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.212.19.14
country_id: 2510769
description:
Dec  9 01:31:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=188.212.19.14, lip=66.85.158.91, TLS, session=<MO1lQXZFsZ+81BMO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.68
country_id: 6252001
description:
Dec  9 01:31:42 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.68, lip=66.85.158.91, TLS, session=<ajWWQ3ZFTu3N0h9E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.13.86.215
country_id: 3996063
description:
Dec  9 01:31:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=154.13.86.215, lip=66.85.158.91, TLS, session=<+HKFQnZFVNGaDVbX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 01:32:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<dyoKRnZFkONnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-09 01:34:24 dovecot_plain authenticator failed for (marity) [154.144.243.93]:51904: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 01:34:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<fwIvTXZFQo8+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.137.154.160
country_id: 3469034
description:
2025-12-09 01:34:10 dovecot_plain authenticator failed for ([89.116.164.85]) [143.137.154.160]:37538: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.199.177.253
country_id: 3469034
description:
2025-12-09 01:34:22 dovecot_plain authenticator failed for 179-199-177-253.user3p.vtal.net.br ([89.116.164.85]) [179.199.177.253]:27442: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.156.212.11
country_id: 2542007
description:
2025-12-09 01:34:35 dovecot_plain authenticator failed for ([89.116.164.85]) [105.156.212.11]:42366: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 01:36:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<+tLhU3ZF8JqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.55
country_id: 3469034
description:
Dec  9 01:38:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.251.55, lip=66.85.158.91, TLS, session=<csW9WnZFhcG60fs3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 01:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<AsmlWHZFaLA+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.47.158.7
country_id: 2510769
description:
Dec  9 01:38:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=139.47.158.7, lip=66.85.158.91, TLS, session=<EDvWW3ZF9LCLL54H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec  9 01:40:27 host2 sshd[76376]: Disconnected from invalid user web 101.47.162.24 port 37906 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.75
country_id: 6252001
description:
Dec  9 01:41:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.75, lip=66.85.158.92, TLS, session=<FAmQZXZFsPjN0h9L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-09 01:41:54 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:33288: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.222.111.92
country_id: 3625428
description:
2025-12-09 01:41:59 dovecot_plain authenticator failed for ([89.116.164.85]) [38.222.111.92]:43296: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-09 01:41:43 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:48793: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.36.239.240
country_id: 6252001
description:
2025-12-09 01:41:47 dovecot_plain authenticator failed for c-73-36-239-240.hsd1.il.comcast.net ([89.116.164.85]) [73.36.239.240]:35560: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-09 01:44:45 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:35058: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 01:44:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<QEM1cnZFTqI+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-09 01:44:59 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:36212: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.119
country_id: 3175395
description:
Dec  9 01:46:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.119, lip=66.85.158.91, TLS, session=<fS4ZdnZFzNq5D6t3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.104
country_id: 3469034
description:
Dec  9 01:45:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=138.186.197.104, lip=66.85.158.91, TLS, session=<KSXUdHZF/JKKusVo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 01:46:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3sfZeHZFeo8v/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.227
country_id: 6252001
description:
Dec  9 01:46:55 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.185.227, lip=66.85.158.92, session=<OaMEenZF6N8s3Lnj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 01:48:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<h9gRgXZFyL+nR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.35.168.17
country_id: 935317
description:
2025-12-09 01:49:32 dovecot_plain authenticator failed for ([89.116.164.85]) [102.35.168.17]:53576: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.49
country_id: 6252001
description:
2025-12-09 01:50:29 dovecot_login authenticator failed for ([98.181.46.49]) [98.181.46.49]:35197: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.35.168.17
country_id: 935317
description:
2025-12-09 01:49:39 dovecot_login authenticator failed for ([89.116.164.85]) [102.35.168.17]:53576: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.213.132.10
country_id: 953987
description:
2025-12-09 01:49:47 dovecot_plain authenticator failed for ([89.116.164.85]) [102.213.132.10]:18815: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.130.153
country_id: 3469034
description:
2025-12-09 01:50:03 dovecot_plain authenticator failed for ([89.116.164.85]) [177.125.130.153]:1304: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-12-09 01:50:45 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:60550: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-09 01:51:34 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (bodurses) [24.127.53.61]:46138: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.242.19.149
country_id: 1819730
description:
Dec  9 01:51:57 host2 sshd[85623]: Disconnected from invalid user admin 47.242.19.149 port 49694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-09 01:55:23 dovecot_plain authenticator failed for (weatophted) [91.73.188.251]:33572: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 01:57:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<IudfnnZFCqaKxX03>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 138.197.125.55
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[138.197.125.55] [Remote Port]=[42506] [Authentication Database]=[mail] [Username]=[notify@melanifinefood.com] (10/10 failures) (blocked until [Tue Dec  9 20:27:05 2025 UTC/Wed Dec 10 01:57:05 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.28.207
country_id: 6252001
description:
2025-12-09 01:57:24 dovecot_plain authenticator failed for ([89.116.164.85]) [67.241.28.207]:58646: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 01:56:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<zButnXZF1tmPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.252.145
country_id: 3865483
description:
2025-12-09 01:57:07 dovecot_plain authenticator failed for ([89.116.164.85]) [186.158.252.145]:11153: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 01:57:35 host2 sshd[89885]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.119.222
country_id: 1819730
description:
Dec  9 01:58:06 host2 sshd[90256]: Disconnected from invalid user wangziyun 47.76.119.222 port 42312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-12-09 01:58:16 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:63316: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 01:58:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<a3VQo3ZFDu68putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.242.19.149
country_id: 1819730
description:
Dec  9 01:57:33 host2 sshd[89891]: Disconnected from invalid user yuan 47.242.19.149 port 38696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-09 01:58:00 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:34465: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-09 01:59:17 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:54008: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.55.164.246
country_id: 3469034
description:
2025-12-09 01:58:37 dovecot_login authenticator failed for ([177.55.164.246]) [177.55.164.246]:55428: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 01:58:46 host2 sshd[90727]: Disconnected from invalid user admin 2.57.121.112 port 50015 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 02:00:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<VzCvqHZFNqWKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 02:00:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<A5j6qHZF9Ms+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.242.19.149
country_id: 1819730
description:
Dec  9 02:00:23 host2 sshd[92079]: Disconnected from invalid user sean 47.242.19.149 port 37308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-09 02:00:24 dovecot_plain authenticator failed for (uprip) [149.62.239.4]:59404: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.119.222
country_id: 1819730
description:
Dec  9 02:00:48 host2 sshd[92453]: Disconnected from invalid user nmrsu 47.76.119.222 port 60158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.76.119.222
country_id: 1819730
description:
Dec  9 02:02:06 host2 sshd[93343]: Disconnected from invalid user nick 47.76.119.222 port 52688 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Dec  9 02:02:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, TLS: Connection closed, session=<AMeJsXZF+HZChJl/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Dec  9 02:02:33 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, session=<uujhsXZFwJ5ChJl/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.217.102.175
country_id: 3469034
description:
2025-12-09 02:04:47 dovecot_plain authenticator failed for ([89.116.164.85]) [179.217.102.175]:8649: 535 Incorrect authentication data (set_id=contato@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.129.249.189
country_id: 6252001
description:
2025-12-09 02:04:59 dovecot_plain authenticator failed for ([89.116.164.85]) [24.129.249.189]:36384: 535 Incorrect authentication data (set_id=contato@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 02:05:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<XETyunZFwLhnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.171.39.124
country_id: 3865483
description:
2025-12-09 02:05:11 dovecot_plain authenticator failed for 124.39-171-45.netlink.com.ar ([89.116.164.85]) [45.171.39.124]:51559: 535 Incorrect authentication data (set_id=contato@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-09 02:05:32 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (healy) [68.83.181.181]:56424: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 02:05:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<dmi1vHZFtNsf3Dhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 02:05:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1RXCvXZFuo0XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 02:06:55 host2 sshd[97354]: Disconnected from invalid user admin 2.57.121.112 port 6421 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.119.222
country_id: 1819730
description:
Dec  9 02:08:28 host2 sshd[98461]: Disconnected from invalid user shopify 47.76.119.222 port 52108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 02:08:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<S8FhxnZFxKE+PIdq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 02:08:54 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.242.19.149
country_id: 1819730
description:
Dec  9 02:08:41 host2 sshd[98625]: Disconnected from invalid user ubuntu 47.242.19.149 port 49176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-09 02:10:05 dovecot_login authenticator failed for ([94.207.251.240]) [94.207.251.240]:55436: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-09 02:09:45 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:45700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 02:12:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<8J8S1XZFbc9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.46.119.210
country_id: 3895114
description:
2025-12-09 02:12:28 dovecot_plain authenticator failed for pc-210-119-46-190.cm.vtr.net ([89.116.164.85]) [190.46.119.210]:38254: 535 Incorrect authentication data (set_id=contacto@host2.phenomhost.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 117.211.64.219
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[117.211.64.219] [Remote Port]=[53101] [Authentication Database]=[mail] [Username]=[admin@bostonlanka.com] (10/10 failures) (blocked until [Tue Dec  9 20:42:23 2025 UTC/Wed Dec 10 02:12:23 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  9 02:11:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<UMDP0nZF3K4+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.46.119.210
country_id: 3895114
description:
2025-12-09 02:12:35 dovecot_login authenticator failed for pc-210-119-46-190.cm.vtr.net ([89.116.164.85]) [190.46.119.210]:38254: 535 Incorrect authentication data (set_id=contacto@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.150.103.132
country_id: 6252001
description:
2025-12-09 02:12:40 dovecot_plain authenticator failed for ([89.116.164.85]) [35.150.103.132]:26792: 535 Incorrect authentication data (set_id=contacto@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.56.156.224
country_id: 953987
description:
2025-12-09 02:12:55 dovecot_plain authenticator failed for ([89.116.164.85]) [41.56.156.224]:3968: 535 Incorrect authentication data (set_id=contacto@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 02:12:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2ZoK13ZF6uQv/lVz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 02:13:08 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 02:14:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<xIjf2nZFjImqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 02:18:06 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (kindy) [24.1.200.187]:37126: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 02:18:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<oBdk6XZFpTl100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 02:19:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<CnTL7HZFqpGPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.190.87.241
country_id: 1269750
description:
2025-12-09 02:20:16 dovecot_plain authenticator failed for ([89.116.164.85]) [223.190.87.241]:14365: 535 Incorrect authentication data (set_id=financeiro@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.161.230.60
country_id: 3996063
description:
2025-12-09 02:20:33 dovecot_plain authenticator failed for ([89.116.164.85]) [189.161.230.60]:39112: 535 Incorrect authentication data (set_id=financeiro@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-09 02:21:58 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (calie) [73.197.194.98]:43314: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.217.192
country_id: 6252001
description:
Dec  9 02:22:21 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.234.217.192, lip=66.85.158.92, session=<p26++HZF9N+s6tnA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.161.230.60
country_id: 3996063
description:
2025-12-09 02:23:22 dovecot_login authenticator failed for ([89.116.164.85]) [189.161.230.60]:39112: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-09 02:25:10 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (dishia) [81.225.30.107]:51300: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 02:25:35 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (syncer) [24.1.200.187]:43810: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Dec  9 02:25:47 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.92, session=<wGP9BHdFPDms7OQm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 02:27:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<JxR+CndFapSqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 02:27:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<uYWmCndFdtKPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.7.107.13
country_id: 2963597
description:
2025-12-09 02:28:06 dovecot_plain authenticator failed for ([89.116.164.85]) [46.7.107.13]:53228: 535 Incorrect authentication data (set_id=comercial@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.109.156.251
country_id: 102358
description:
2025-12-09 02:28:19 dovecot_plain authenticator failed for ([89.116.164.85]) [149.109.156.251]:44964: 535 Incorrect authentication data (set_id=comercial@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-09 02:27:39 dovecot_plain authenticator failed for (delete) [105.114.21.51]:41615: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.117.105.8
country_id: 6252001
description:
2025-12-09 02:27:53 dovecot_plain authenticator failed for ([89.116.164.85]) [152.117.105.8]:9142: 535 Incorrect authentication data (set_id=comercial@host2.phenomhost.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 02:29:48 host2 sshd[115332]: Disconnected from invalid user user 2.57.121.25 port 43932 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.69
country_id: 6252001
description:
Dec  9 02:30:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.69, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</P/MFHdFTdrN0h9F>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 02:30:42 host2 sshd[116203]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-09 02:34:01 dovecot_plain authenticator failed for (bortria) [23.30.11.253]:47088: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec  9 02:35:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FNoWJndFMMNChJl3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.54
country_id: 6252001
description:
2025-12-09 02:35:51 dovecot_login authenticator failed for ([98.185.120.54]) [98.185.120.54]:54584: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-09 02:36:18 dovecot_login authenticator failed for ([125.20.183.201]) [27.123.90.94]:55890: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 02:36:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<5PfMK3dFLI0+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 02:37:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<qDnOL3dF8sxnJFMP>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.36.83.15
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.36.83.15] [Remote Port]=[52466] [Authentication Database]=[mail] [Username]=[contact@dataesite.lk] (10/10 failures) (blocked until [Tue Dec  9 21:07:45 2025 UTC/Wed Dec 10 02:37:45 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 02:38:06 host2 sshd[121693]: Disconnected from invalid user user 2.57.121.25 port 14230 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 02:40:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=</veeOHdFQNU+PIdc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 02:42:13 host2 sshd[124809]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 02:41:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<oDrDPXdFQJA+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 02:41:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<qvWOPndF0IMv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 02:42:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<F5JQQHdFjog+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-09 02:47:11 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (friant) [73.176.157.57]:42582: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 02:47:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<GqpuUndF/uM+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 202.155.148.25
country_id: 1643084
description:
Dec  9 02:48:20 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=202.155.148.25, lip=66.85.158.92, session=<ax2iVXdFFrjKm5QZ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.216.133.14
country_id: 6252001
description:
[2025-12-09 02:48:53 +0530] info [whostmgrd] 47.216.133.14 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 02:50:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<otYrXHdFvpY+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 02:50:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hEhPXndF7JuKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 02:50:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<2EmvXndFep+Pbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 02:51:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1nuxYXdFaK4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 02:52:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<KO7gZHdFAry8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.67
country_id: 3017382
description:
Dec  9 02:53:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NMupZ3dF3bJbxJhD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 02:53:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<d/vVZ3dFbJw+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.67
country_id: 3017382
description:
Dec  9 02:53:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=91.196.152.67, lip=66.85.158.92, TLS: Connection closed, session=<d56BaHdFOc9bxJhD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 02:53:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<kapbaHdFipeKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.45
country_id: 3017382
description:
Dec  9 02:53:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.45, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<RfQhaXdFe5lbxJgt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.44
country_id: 3017382
description:
Dec  9 02:53:50 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.44, lip=66.85.158.92, TLS: Connection closed, session=<c+dRaXdFm+dbxJgs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 202.155.148.25
country_id: 1643084
description:
Dec  9 02:53:59 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=202.155.148.25, lip=66.85.158.92, TLS, session=<AOXWaXdF8KLKm5QZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 202.155.148.25
country_id: 1643084
description:
Dec  9 02:54:58 host2 pure-ftpd[133751]: (?@202.155.148.25) [INFO] New connection from 202.155.148.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-09 02:55:36 dovecot_login authenticator failed for (88.255.189.21.static.ttnet.com.tr) [88.255.189.21]:59600: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.75
country_id: 3017382
description:
Dec  9 02:55:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.196.152.75, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4cowcHdFra5bxJhL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.52
country_id: 3017382
description:
Dec  9 02:56:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=91.196.152.52, lip=66.85.158.92, TLS: Connection closed, session=<1iRTcXdFz8tbxJg0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-09 02:56:11 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:62923: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.74
country_id: 3017382
description:
Dec  9 02:56:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.74, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xKpFcndF3bNbxJhK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.72
country_id: 3017382
description:
Dec  9 02:56:24 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.196.152.72, lip=66.85.158.92, TLS: Connection closed, session=<YzV2cndF0ahbxJhI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-09 02:58:24 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:43358: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.80
country_id: 1733045
description:
2025-12-09 02:59:11 dovecot_login authenticator failed for ([49.125.201.80]) [49.125.201.80]:36134: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-09 03:00:20 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:56578: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-12-09 03:00:35 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:51800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec  9 03:04:08 host2 sshd[141277]: Disconnected from invalid user giulia 181.0.192.28 port 1220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-09 03:05:44 dovecot_plain authenticator failed for (bletism) [102.53.15.17]:47526: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-09 03:07:10 dovecot_login authenticator failed for ([182.95.20.31]) [182.95.228.22]:41340: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 03:07:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<nqq1mXdFYdx100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-09 03:07:36 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:47639: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2025-12-09 03:07:57 dovecot_plain authenticator failed for (trass) [173.165.182.203]:59940: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-09 03:08:51 dovecot_plain authenticator failed for (obarynci) [5.11.140.219]:59762: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 03:10:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<cjKipHdF2qFnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-09 03:09:38 dovecot_plain authenticator failed for (brica) [65.20.129.28]:35753: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.73.18.40
country_id: 3895114
description:
[2025-12-09 03:09:53 +0530] info [webmaild] 200.73.18.40 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 03:09:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<q+HsondFnsyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 03:10:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<7Z3XpHdFyOWqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.223
country_id: 3996063
description:
2025-12-09 03:11:16 dovecot_login authenticator failed for (201.173.56.223-clientes-izzi.mx) [201.173.56.223]:50432: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec  9 03:11:36 host2 sshd[147330]: Disconnected from invalid user build 181.0.192.28 port 1168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-09 03:11:38 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:56776: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 03:18:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lGjmwHdFLKCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 03:20:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<7Lf+yXdF1M0+PIdq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 03:21:03 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.115.51
country_id: 2635167
description:
[2025-12-09 03:21:16 +0530] info [webmaild] 77.68.115.51 - senthil@yashiholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-09 03:22:47 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:34151: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-09 03:23:13 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:45155: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 03:23:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<fcnA1HdFOLuqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-09 03:24:15 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (hally) [76.106.163.189]:49742: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec  9 03:27:46 host2 sshd[162553]: Disconnected from invalid user httpd 181.0.192.28 port 1226 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.248.112.37
country_id: 2635167
description:
[2025-12-09 03:30:10 +0530] info [webmaild] 213.248.112.37 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-09 03:30:54 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:55128: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-09 03:31:03 dovecot_plain authenticator failed for (tarie) [80.227.102.242]:52725: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-12-09 03:31:26 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:36958: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.102.30.18
country_id: 6252001
description:
[2025-12-09 03:34:16 +0530] info [webmaild] 82.102.30.18 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.209.110
country_id: 1269750
description:
2025-12-09 03:35:12 dovecot_login authenticator failed for ([182.95.12.209]) [152.52.209.110]:49424: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec  9 03:37:19 host2 sshd[170479]: Disconnected from invalid user postgres 181.0.192.28 port 16721 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-09 03:39:12 dovecot_login authenticator failed for ([78.156.0.88]) [78.156.0.88]:55057: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-09 03:39:13 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:57579: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-09 03:39:19 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (yemism) [73.0.235.30]:42392: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.153
country_id: 6252001
description:
2025-12-09 03:39:24 dovecot_login authenticator failed for ([98.185.120.153]) [98.185.120.153]:58719: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-09 03:39:32 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:59380: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-09 03:39:34 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:46570: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-12-09 03:39:33 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:38152: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-09 03:39:18 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:36090: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-09 03:39:25 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:59138: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 03:40:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ZDCxD3hFNrIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 03:40:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<CSDzD3hFEN+nR+bm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.194
country_id: 6252001
description:
Dec  9 03:42:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.194, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8V7rFnhFgOIUQGnC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.165.198
country_id: 2921044
description:
Dec  9 03:43:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.90.165.198, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<tsodGXhF94ikWqXG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 03:43:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<UFu0G3hF4uWKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.165.198
country_id: 2921044
description:
Dec  9 03:43:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=164.90.165.198, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sDPhGXhFDR+kWqXG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.201.147
country_id: 2921044
description:
Dec  9 03:43:36 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=209.38.201.147, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FlNEG3hFdjfRJsmT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 03:45:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<NFA8IXhFOLdnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 03:45:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<wAiHIXhFcKKPbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 03:46:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<gbkDJnhFWuWKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 03:47:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<1sq7KHhFIKu8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-09 03:47:13 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:59587: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-09 03:47:22 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:41738: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 03:48:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<LWWuLXhFSpA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 03:49:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<HmwHMHhF8LQXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 03:50:32 host2 sshd[184133]: Disconnected from invalid user user 2.57.121.25 port 15774 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 03:50:58 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-09 03:52:43 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl (paphally) [91.202.230.214]:34464: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-09 03:53:33 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (thesled) [96.230.65.90]:35298: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-09 03:53:37 dovecot_plain authenticator failed for (calltabal) [12.182.125.210]:45918: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 03:53:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<JfCXP3hFrOg+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 03:53:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<dVzFP3hF4q0f3Dhi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.30.171
country_id: 2921044
description:
Dec  9 03:54:54 host2 pure-ftpd[188111]: (?@157.230.30.171) [INFO] New connection from 157.230.30.171


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 03:54:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<TUvrQXhF2rY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 03:55:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<9LbgRXhF8JQ+PIcd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 03:55:56 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.169.244
country_id: 3017382
description:
2025-12-09 03:56:36 dovecot_plain authenticator failed for lstlambert-656-1-118-244.w80-14.abo.wanadoo.fr (culing) [80.14.169.244]:34778: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.238.39
country_id: 6252001
description:
Dec  9 03:57:23 host2 sshd[190312]: Disconnected from invalid user hong 47.253.238.39 port 43518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.238.39
country_id: 6252001
description:
Dec  9 03:59:08 host2 sshd[192075]: Disconnected from invalid user elemental 47.253.238.39 port 42618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  9 03:59:37 host2 sshd[192442]: Disconnected from invalid user dev 182.18.139.237 port 34136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.234.145.12
country_id: 3469034
description:
Dec  9 03:59:46 host2 sshd[192542]: Disconnected from invalid user jack 177.234.145.12 port 49788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-09 04:00:17 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:57898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 04:00:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<t12oV3hFfuU+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-09 04:00:33 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:51956: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 04:01:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<G12gWXhFjpWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 04:01:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<yWvxWnhFFVh100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec  9 04:01:53 host2 sshd[194667]: Disconnected from invalid user odoo 198.245.55.32 port 57226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:02:06 host2 sshd[194960]: Disconnected from invalid user centos 103.82.92.118 port 47582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 04:02:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<cjoyXnhF8ok+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.64
country_id: 798544
description:
Dec  9 04:02:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=128.127.94.64, lip=66.85.158.91, TLS, session=<0/W1XXhFgLKAf15A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.148
country_id: 3865483
description:
Dec  9 04:02:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.181.101.148, lip=66.85.158.91, TLS, session=<QPP5XnhFBei+tWWU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:03:25 host2 sshd[196516]: Disconnected from invalid user factorio 103.82.92.118 port 39956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 04:03:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<5Sc9YnhFitc+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec  9 04:03:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS handshaking: Connection closed, session=<b37aYnhFwm5ChJmL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.253.238.39
country_id: 6252001
description:
Dec  9 04:03:49 host2 sshd[196907]: Disconnected from invalid user usuario2 47.253.238.39 port 46658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  9 04:05:00 host2 sshd[198046]: Disconnected from invalid user hong 182.18.139.237 port 38324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  9 04:05:59 host2 sshd[198995]: Disconnected from invalid user support 182.18.139.237 port 33506 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 04:07:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<irNyb3hFkVd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 04:07:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<9Olsb3hFwNOqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec  9 04:06:15 host2 sshd[199351]: Disconnected from invalid user usuario2 198.245.55.32 port 37462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-09 04:06:19 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (scoed) [174.59.253.88]:58602: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.128.177
country_id: 3469034
description:
Dec  9 04:06:55 host2 sshd[199775]: Disconnected from invalid user botuser 187.72.128.177 port 60898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  9 04:06:59 host2 sshd[199810]: Disconnected from invalid user newuser 182.18.139.237 port 56920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-09 04:07:28 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:43816: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.57.123.166
country_id: 2510769
description:
2025-12-09 04:07:36 dovecot_login authenticator failed for 166.red-195-57-123.staticip.rima-tde.net [195.57.123.166]:18531: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.238.39
country_id: 6252001
description:
Dec  9 04:07:10 host2 sshd[199988]: Disconnected from invalid user support 47.253.238.39 port 40616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-09 04:08:53 dovecot_login authenticator failed for ([182.95.123.46]) [182.95.123.46]:57644: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-09 04:09:01 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:60906: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 04:09:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<QJugdnhFltMv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.128.177
country_id: 3469034
description:
Dec  9 04:08:18 host2 sshd[201028]: Disconnected from invalid user newuser 187.72.128.177 port 33958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-09 04:08:44 dovecot_plain authenticator failed for (ineurete) [65.20.160.107]:37092: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.12
country_id: 3996063
description:
2025-12-09 04:09:26 dovecot_login authenticator failed for ([177.236.146.12]) [177.236.146.12]:36854: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 04:09:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lOHMd3hFkp2PbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-09 04:09:53 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (triostinta) [76.16.7.82]:37481: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-09 04:09:56 dovecot_plain authenticator failed for (hally) [24.187.213.29]:34766: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.234.145.12
country_id: 3469034
description:
Dec  9 04:11:27 host2 sshd[204280]: Disconnected from invalid user newuser 177.234.145.12 port 35862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:12:17 host2 sshd[205085]: Disconnected from invalid user httpd 103.82.92.118 port 46366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec  9 04:12:29 host2 sshd[205262]: Disconnected from invalid user service 198.245.55.32 port 33772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-09 04:12:54 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:41416: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.234
country_id: 3996063
description:
2025-12-09 04:13:03 dovecot_login authenticator failed for (201.173.92.234-clientes-izzi.mx) [201.173.92.234]:51859: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-12-09 04:13:08 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:59708: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.123
country_id: 2635167
description:
2025-12-09 04:13:15 dovecot_login authenticator failed for (77-89-143-123.fluidata.co.uk) [77.89.143.123]:55422: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.245.55.32
country_id: 6251999
description:
Dec  9 04:14:38 host2 sshd[208014]: Disconnected from invalid user fauzi 198.245.55.32 port 48254 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.177.155.63
country_id: 2510769
description:
Dec  9 04:15:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=94.177.155.63, lip=66.85.158.91, TLS, session=<g7hcjHhFGsxesZs/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.171
country_id: 3175395
description:
Dec  9 04:15:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.171, lip=66.85.158.91, TLS, session=<VgV3jXhFhuG5D6ur>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec  9 04:16:34 host2 sshd[210734]: Disconnected from invalid user centos 201.186.40.250 port 44024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.134
country_id: 3865483
description:
Dec  9 04:16:36 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.101.134, lip=66.85.158.91, TLS, session=<mqoLkHhFqrO+tWWG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.136
country_id: 3865483
description:
Dec  9 04:16:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=179.0.249.136, lip=66.85.158.91, TLS, session=<cZtvkXhFotOzAPmI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 04:18:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<Z2V9l3hFWKhnJFMP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 04:19:40 host2 sshd[213565]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-09 04:19:17 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (feratiess) [98.192.74.183]:44774: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.184.27
country_id: 6252001
description:
Dec  9 04:19:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.184.27, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Oas4nXhF0K4ofLgb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:20:04 host2 sshd[214082]: Disconnected from invalid user ahmed 103.82.92.118 port 49912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-09 04:20:22 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:47555: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.125.13.12
country_id: 6252001
description:
2025-12-09 04:20:44 dovecot_login authenticator failed for (172-125-13-12.lightspeed.rcsntx.sbcglobal.net) [172.125.13.12]:52504: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 04:20:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<SxAOoHhFLuCqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 04:21:24 host2 sshd[215561]: Disconnected from invalid user admin 2.57.121.112 port 40854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:23:55 host2 sshd[218174]: Disconnected from invalid user steamcmd 103.82.92.118 port 60670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 04:25:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<3yvdsXhFgMY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-09 04:27:06 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:46366: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-09 04:26:49 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:44221: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-09 04:28:23 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:43529: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-12-09 04:28:38 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:33248: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-09 04:30:07 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:39783: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-12-09 04:29:46 dovecot_login authenticator failed for ([195.158.14.232]) [195.158.14.232]:36198: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 04:30:54 host2 sshd[228329]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.73
country_id: 1880251
description:
Dec  9 04:30:30 host2 sshd[227559]: Disconnected from invalid user ubuntu 101.47.162.73 port 45506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.32.169
country_id: 3895114
description:
2025-12-09 04:31:00 dovecot_plain authenticator failed for ([89.116.164.85]) [190.114.32.169]:6660: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.127.198
country_id: 953987
description:
2025-12-09 04:31:15 dovecot_plain authenticator failed for ([89.116.164.85]) [102.38.127.198]:59542: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.29.216.120
country_id: 3439705
description:
2025-12-09 04:31:30 dovecot_plain authenticator failed for r179-29-216-120.dialup.mobile.ancel.net.uy ([89.116.164.85]) [179.29.216.120]:10843: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-09 04:32:12 dovecot_plain authenticator failed for (conia) [92.62.243.175]:42965: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-09 04:33:07 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:49044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-09 04:33:29 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:48766: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-09 04:33:50 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:40242: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 04:34:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<Kr8Z0HhFxpo+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 04:35:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<ZeKu1XhF8NinR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 04:35:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (oprines) [87.103.126.54]:2130: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-09 04:36:36 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:37308: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-09 04:36:48 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:35566: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-09 04:36:13 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:34918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-09 04:36:17 dovecot_login authenticator failed for ([125.20.223.161]) [152.52.236.2]:40026: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2025-12-09 04:36:31 dovecot_login authenticator failed for ([122.187.181.57]) [182.95.174.178]:51366: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 04:38:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<9Fgf3nhFXMKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-09 04:37:22 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:45528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  9 04:38:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<cm1n3nhF/tk+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 04:39:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<zkQN5HhFYMmPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-09 04:40:05 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:44785: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-09 04:39:30 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:40644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-09 04:39:48 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:41998: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 04:41:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<wqKf6HhFxsWKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.73
country_id: 1880251
description:
Dec  9 04:40:27 host2 sshd[242553]: Disconnected from invalid user admin 101.47.162.73 port 58500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 04:41:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (copion) [87.103.126.54]:21425: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 04:42:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<5H897HhFdtAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-09 04:42:28 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (guill) [174.166.153.20]:39570: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 04:42:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Nxhf7nhFWKi8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-09 04:43:00 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:45212: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-09 04:43:13 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:34318: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-09 04:46:05 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:42604: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-09 04:46:15 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:42652: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-09 04:46:24 dovecot_login authenticator failed for (187.161.136.37-clientes-izzi.mx) [187.161.136.37]:54654: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-09 04:46:31 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:57962: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-09 04:48:58 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (ovidaest) [76.31.164.124]:59200: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  9 04:49:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<W/SEBnlFrpk+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.45
country_id: 6252001
description:
Dec  9 04:49:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.45, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5CwzCHlFtcnN0h8t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 04:51:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<JK5gDHlFDJFnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 04:52:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<18pHEHlFms+PbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-09 04:51:47 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:40462: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-09 04:52:09 dovecot_login authenticator failed for ([154.208.47.13]) [154.208.47.13]:53408: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.194
country_id: 953987
description:
Dec  9 04:53:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=102.129.60.194, lip=66.85.158.91, TLS, session=<quTcFXlFbZpmgTzC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-09 04:54:09 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (worthess) [73.197.194.98]:51130: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 04:55:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<206RGnlFvpF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-09 04:54:20 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:37312: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.241.31
country_id: 933860
description:
Dec  9 04:54:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.76.241.31, lip=66.85.158.91, TLS, session=<fOQnF3lFWtcpTPEf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-09 04:54:30 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:43276: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-09 04:54:31 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (myophoty) [73.168.136.150]:59074: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-09 04:56:01 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:38144: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2025-12-09 04:56:27 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:34984: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-12-09 04:56:51 dovecot_login authenticator failed for ([120.157.80.73]) [120.157.80.73]:34290: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec  9 04:56:55 host2 pure-ftpd[268204]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec  9 04:56:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qDt8IXlFtK0zn+p2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.82
country_id: 1733045
description:
2025-12-09 04:57:21 dovecot_login authenticator failed for ([49.124.151.82]) [49.124.151.82]:55840: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-09 04:58:34 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:58775: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-12-09 04:58:42 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:50333: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 05:00:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<txrtLXlFvM+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 05:00:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<PUqpLnlFCax100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-09 05:01:12 dovecot_plain authenticator failed for (readriter) [103.51.26.198]:38117: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-09 05:01:14 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl (myrextrit) [91.202.230.214]:56841: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 05:01:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<ssnQMnlF9NQ+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 05:02:31 host2 sshd[275540]: Disconnected from invalid user user 2.57.121.25 port 39045 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 05:03:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<IA3/OXlFXOGqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec  9 05:05:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<vdkPQHlFYEhChJl9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 05:07:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<8noSSHlFZLo+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 05:08:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<vIlXSXlFctsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 05:08:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<G5r7SXlFPrw+PIdc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 05:08:39 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 05:08:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<2enES3lFIsc+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 05:10:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<jC+yU3lFsKQ+PIdr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-12-09 05:14:09 +0530] info [cpaneld] 117.103.80.92 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-12-09 05:14:11 +0530] info [cpaneld] 117.103.80.92 - lezzarotechcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 05:14:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<pOjIX3lF6pw+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.41
country_id: 6252001
description:
Dec  9 05:15:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.41, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XHWjYnlFesPG6xgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 05:16:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<exwwZ3lFlog+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 05:17:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<0Sv/aXlF3NCqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-09 05:20:10 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:53232: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.51.221.132
country_id: 3175395
description:
2025-12-09 05:20:19 dovecot_login authenticator failed for 93-51-221-132.ip268.fastwebnet.it [93.51.221.132]:40445: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 05:23:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<C/hBgXlFLoxnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 05:30:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<72+FmnlFosynR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 05:32:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<2W3tn3lFyJmKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 05:33:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<H/7ypHlFtOyPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-09 05:34:16 dovecot_plain authenticator failed for (parping) [91.73.188.251]:52584: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.37
country_id: 2635167
description:
Dec  9 05:34:37 host2 pure-ftpd[315129]: (?@185.247.137.37) [INFO] New connection from 185.247.137.37


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-09 05:35:50 dovecot_login authenticator failed for ([122.187.230.13]) [122.187.230.13]:47183: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-09 05:35:58 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:14918: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 05:35:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<D1XWqnlFNqKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-09 05:36:28 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:41821: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 05:37:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<dsWxsXlFftkv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 05:37:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<o17EsXlF/sw+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 05:37:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<F0FksnlFBoe8putr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 05:38:15 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 05:43:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<D9B8xnlFAOCPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 05:42:57 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.111.178
country_id: 1733045
description:
Dec  9 05:45:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=72.60.111.178, lip=66.85.158.91, session=<IRkfznlF3tNIPG+y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.42.143.107
country_id: 6252001
description:
2025-12-09 05:47:06 dovecot_plain authenticator failed for c-98-42-143-107.hsd1.ca.comcast.net ([89.116.164.85]) [98.42.143.107]:45758: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.42.143.107
country_id: 6252001
description:
2025-12-09 05:47:12 dovecot_login authenticator failed for c-98-42-143-107.hsd1.ca.comcast.net ([89.116.164.85]) [98.42.143.107]:45758: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 05:47:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<BuJl1XlFKKA+PIdq>


