# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-12 06:41:47 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:59552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-12-12 06:42:15 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:41022: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-12-12 06:42:18 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:51915: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-12 06:42:40 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:49590: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-12-12 06:43:07 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:35496: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-12 06:43:23 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:47210: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 06:43:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<DFPn97ZF9OXO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.88
country_id: 2635167
description:
Dec 12 06:43:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.88, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jw2x+LZFp8+594lY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.196
country_id: 2635167
description:
Dec 12 06:43:37 host2 dovecot[3988696]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.196, lip=66.85.158.92, TLS, session=<Scqg+LZFece594nE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 06:44:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<GdgZ+rZFCuU+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-12 06:44:20 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (oddumbion) [24.98.45.238]:57672: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 06:44:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<8Fz6+7ZFDr2G0Wp/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 12 06:44:45 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<rEOp/LZFpYZX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.87
country_id: 2635167
description:
Dec 12 06:44:12 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.87, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9WSs+rZFD8K594lX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 06:44:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<RxvI+rZFwpvD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Dec 12 06:45:18 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<gQSl/rZFl4lX7LBd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-12 06:45:26 dovecot_plain authenticator failed for (nonle) [90.160.139.163]:48259: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.91
country_id: 2635167
description:
Dec 12 06:45:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.91, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<6DehALdFF6+594lb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 06:45:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<sVES/rZFrMk+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 06:46:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<rfLSAbdF1tPCBa8Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.86
country_id: 2635167
description:
Dec 12 06:46:25 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Az+bArdF49tX7LBW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 12 06:46:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shuf@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<JcwPA7dFmMA+PIcc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 12 06:46:58 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<0suaBLdFi4hX7LBO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 06:47:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<LkZyBbdFCtUu4ntB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.74
country_id: 2635167
description:
Dec 12 06:47:32 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.74, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<rWWXBrdF1bS594lK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.148
country_id: 1694008
description:
2025-12-12 06:47:48 dovecot_login authenticator failed for ([124.105.219.170]) [124.105.218.148]:40478: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 12 06:48:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<JEmRCLdFA+hX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.92
country_id: 2635167
description:
Dec 12 06:48:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.92, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<NjqNCrdFfaW594lc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-12 06:48:44 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:48142: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.216
country_id: 1733045
description:
2025-12-12 06:49:01 dovecot_login authenticator failed for ([49.124.152.216]) [49.124.152.216]:43930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-12 06:48:28 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (denonch) [69.142.126.37]:59608: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-12 06:48:31 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (unesizer) [67.172.54.29]:38140: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 06:49:06 host2 sshd[149707]: Disconnected from invalid user admin 62.60.131.157 port 47013 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 12 06:49:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ceylondigest.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<177IDLdF5og+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 06:49:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Ii5XDbdFeoWH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 06:50:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<BiMWEbdFSuEIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 06:50:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<Gh+pEbdFCsw+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-12 06:50:45 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (inparous) [174.59.253.88]:41638: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 12 06:51:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@essenceceylontea.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<nOhvE7dFuIc+PIdn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.14.236.224
country_id: 6252001
description:
Dec 12 06:51:52 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=128.14.236.224, lip=66.85.158.91, session=<pSQYFrdFtoCADuzg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.14.236.224
country_id: 6252001
description:
Dec 12 06:52:11 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=128.14.236.224, lip=66.85.158.91, session=<tWM/F7dF/puADuzg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.14.236.224
country_id: 6252001
description:
Dec 12 06:53:49 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=128.14.236.224, lip=66.85.158.92, session=<dKcbHbdFFIiADuzg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.150.20
country_id: 3686110
description:
Dec 12 06:54:03 host2 sshd[153996]: Disconnected from invalid user david 200.118.150.20 port 54684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Dec 12 06:53:23 host2 sshd[153355]: Disconnected from invalid user admin 200.118.150.20 port 42046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 12 06:53:28 host2 sshd[153416]: Disconnected from invalid user admin 42.200.66.164 port 35616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 06:53:33 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sulutale) [87.103.126.54]:12918: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.14.236.224
country_id: 6252001
description:
Dec 12 06:54:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=128.14.236.224, lip=66.85.158.92, session=<gIM1HrdFIoiADuzg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 06:54:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<RxKnH7dFp/detwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 06:55:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shuf@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<6ZJsI7dF4Oo+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 12 06:55:20 host2 sshd[155518]: Disconnected from invalid user git 156.241.128.48 port 57378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Dec 12 06:55:23 host2 sshd[155570]: Disconnected from invalid user dino 200.118.150.20 port 51740 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 12 06:55:23 host2 sshd[155568]: Disconnected from invalid user mk 42.200.66.164 port 45152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 06:56:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<Ieh2JbdF6KbAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 12 06:56:51 host2 sshd[156746]: Disconnected from invalid user ftpuser 156.241.128.48 port 55110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 12 06:57:31 host2 sshd[157200]: Disconnected from invalid user sftpuser 118.193.61.170 port 54318 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 06:57:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<a4KnK7dFPNy8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-12 06:58:03 dovecot_login authenticator failed for (nsg-corporate-126.60.187.122.airtel.in) [122.187.60.126]:38064: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.2.166.30
country_id: 2635167
description:
2025-12-12 06:59:05 dovecot_login authenticator failed for ([151.2.166.30]) [151.2.166.30]:58161: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 12 06:58:09 host2 sshd[157758]: Disconnected from invalid user admin 118.193.61.170 port 40800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-12 06:58:17 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:56724: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 06:58:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<qOmJLbdFSLW8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-12 06:58:39 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:48413: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 12 06:59:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@rehanseo.online>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<M/azMLdF9Nk+PIdq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 12 06:59:22 host2 sshd[158693]: Disconnected from invalid user ubuntu 118.193.61.170 port 36272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 07:00:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<v4J4NbdFHMCB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-12 07:02:05 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:42996: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 07:01:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<cyzGOLdFSqY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 07:02:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<6aoMO7dFvrGkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-12 07:02:34 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:42630: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 07:02:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<R268PbdFKoA+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 07:03:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<7e+8P7dFktwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 07:03:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<gQ0dQLdFOIkro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.33
country_id: 3865483
description:
Dec 12 07:04:08 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.181.97.33, lip=66.85.158.91, TLS, session=<I53iQLdFw6C+tWEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.94
country_id: 3277605
description:
Dec 12 07:04:26 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=188.246.73.94, lip=66.85.158.91, TLS, session=<v/kLQrdFZAy89kle>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-12 07:06:46 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (donthous) [68.40.189.43]:48334: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 07:07:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<o6oxT7dFKK1m1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-12 07:07:54 dovecot_login authenticator failed for ([125.19.173.202]) [152.52.236.2]:51106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-12 07:07:11 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:47106: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-12 07:07:27 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:47400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-12 07:07:39 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:48492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 07:08:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<kWZ5UrdFjMxAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-12-12 07:08:09 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:57524: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 07:08:24 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:34348: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 07:09:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<kLNXVbdF8pMv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.127
country_id: 99237
description:
2025-12-12 07:09:38 dovecot_login authenticator failed for ([65.20.251.127]) [65.20.251.127]:42850: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-12 07:09:59 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:41066: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 07:11:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<1le7WrdFfMEuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-12 07:12:43 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:59709: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 07:13:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<F/GWYrdF8IGKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 07:13:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<2RLJYrdFxJ6WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-12 07:13:54 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:57244: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-12 07:15:59 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (sechip) [98.193.112.85]:43890: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 07:15:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<KhjgardFyoA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 07:16:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<sp+BbbdFxqAI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 07:19:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<lMHVeLdFrs1ntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 07:19:09 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (elentist) [174.169.224.27]:46706: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.22
country_id: 3469034
description:
Dec 12 07:20:11 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.11.251.22, lip=66.85.158.91, TLS, session=<OU1DerdFLI+xC/sW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.31
country_id: 3469034
description:
Dec 12 07:20:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=186.209.250.31, lip=66.85.158.91, TLS, session=<Nph9e7dFA8C60fof>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 07:21:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<vd+GfrdFpNukXF7M>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.180.144.185
country_id: 6252001
description:
Dec 12 07:21:38 host2 pure-ftpd[175317]: (?@52.180.144.185) [INFO] New connection from 52.180.144.185


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 07:22:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<UFY5hLdFyIw+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 07:22:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<Mf9rhLdFfI1npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-12 07:23:11 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:49196: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-12 07:23:33 dovecot_plain authenticator failed for (accased) [24.187.213.29]:38292: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2025-12-12 07:23:41 dovecot_login authenticator failed for ([49.124.146.42]) [49.124.146.42]:43294: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-12 07:23:42 dovecot_login authenticator failed for ([161.8.241.121]) [161.8.241.121]:58639: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 07:23:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<rcQuiLdFxJwv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-12 07:23:58 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:47016: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 07:24:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Gvipi7dFRusv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 12 07:25:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<J8YJjbdFoMQ+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.42
country_id: 6252001
description:
2025-12-12 07:26:52 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:58307: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 07:27:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ev+ik7dF0ozD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 07:27:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<54CQlLdFXJSl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 07:28:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<+IOal7dF1qU+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 07:28:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<dQxCmbdFKskImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 07:28:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<anL+mbdFKIR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 07:29:33 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (deproceyd) [87.103.126.54]:23661: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 07:30:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<pZ72n7dFQsAI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.218
country_id: 798544
description:
Dec 12 07:30:44 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=178.216.25.218, lip=66.85.158.91, TLS, session=<2l8eoLdF6e2y2Bna>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.183
country_id: 953987
description:
Dec 12 07:31:06 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.33.183, lip=66.85.158.91, TLS, session=<pzQ8obdFi5xmQCG3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-12 07:31:50 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:37309: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-12 07:31:57 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:49786: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 07:32:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<eCq/pbdFzs/D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 12 07:32:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@dataesite.lk>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<NykSprdFfow+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-12 07:32:39 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:33408: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.16.64
country_id: 3175395
description:
Dec 12 07:33:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.43.16.64, lip=66.85.158.91, TLS, session=<nGo6qLdFrrW5KxBA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-12 07:32:09 dovecot_login authenticator failed for (cm-178.232.237.107.get.no) [178.232.237.107]:32936: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 07:33:20 host2 sshd[183366]: Disconnected from invalid user user 2.57.121.25 port 39059 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.138.83
country_id: 3469034
description:
Dec 12 07:33:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=177.85.138.83, lip=66.85.158.91, TLS, session=<P7NjqbdF2LexVYpT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-12 07:33:26 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:42830: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-12 07:33:37 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36183: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-12-12 07:33:49 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:52682: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-12 07:33:56 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (lulfuld) [68.83.181.181]:58784: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-12 07:34:23 dovecot_plain authenticator failed for (quineity) [102.53.15.56]:59965: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 07:34:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=</f/QrrdFUrPO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-12 07:34:43 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (miciate) [73.144.27.228]:37556: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 07:35:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<yEhrsbdFAKvCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-12 07:36:30 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:34717: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-12 07:36:49 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:36716: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 07:36:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<xPrVtrdFKOsu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-12 07:37:18 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:51618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-12 07:37:27 dovecot_plain authenticator failed for (chothhea) [102.88.10.10]:58844: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.211.219.73
country_id: 3175395
description:
2025-12-12 07:37:58 dovecot_login authenticator failed for host-62-211-219-73.pool62211.interbusiness.it ([185.196.221.176]) [62.211.219.73]:43234: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-12 07:38:13 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:36068: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-12 07:38:38 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:55671: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 12 07:38:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@kiriaswanu.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<+J7WvbdFPO4+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.54
country_id: 2186224
description:
2025-12-12 07:39:01 dovecot_login authenticator failed for ([121.73.162.54]) [121.73.162.54]:50406: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 07:39:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Aw+4v7dF3NmG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 12 07:40:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@kiriaswanu.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<w4a3w7dFXuw+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 12 07:41:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@essenceceylontea.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<rKhUx7dFwLI+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 07:41:54 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (quatown) [87.103.126.54]:61666: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 07:42:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<k0iOybdF1q8IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 12 07:42:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@nsteeleng.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<yFL4yrdFGK8+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 07:42:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<BJsey7dFuLqLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 07:44:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<0lOi0LdF/tDAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 07:44:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<qCfs0bdFEIynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 07:44:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<PKiV07dFVXhetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.252.202.6
country_id: 1643084
description:
Dec 12 07:45:35 host2 sshd[191326]: Disconnected from invalid user rahul 180.252.202.6 port 33814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.2
country_id: 6252001
description:
Dec 12 07:46:36 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.2, lip=66.85.158.92, TLS, session=<POHg2bdFyP7N0h8C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-12-12 07:47:37 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:41294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 12 07:48:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<w4/y3rdFNMw+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-12 07:48:06 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:38986: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 07:47:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<geq927dFKKaH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.252.202.6
country_id: 1643084
description:
Dec 12 07:48:39 host2 sshd[193301]: Disconnected from invalid user titus 180.252.202.6 port 38512 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 07:49:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<GOY65bdFFr28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 07:50:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<sE+K6LdFNLg+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 07:51:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<fGZ06bdF6oWkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 07:51:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<Fya96bdFyI4+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-12 07:51:20 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:36244: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-12 07:51:33 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:58818: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 07:52:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<P3OS7rdFDK2B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 07:52:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<JTeB8LdFLsu8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 07:53:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<22R58bdF0NY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 07:53:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<22Ca8bdF4IMro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 07:53:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<9jIB87dFnIcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 07:55:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<knZ5+bdFtohm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 07:55:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<93n8+bdFfM1AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-12 07:56:15 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:49451: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-12 07:56:29 dovecot_login authenticator failed for (dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:49388: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-12-12 07:56:52 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:43208: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-12 07:57:55 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:60243: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 07:57:13 host2 sshd[201563]: Disconnected from invalid user hadoop 154.73.168.229 port 49100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-12-12 07:57:34 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:46529: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 07:57:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<TiJRAbhFfN0+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 07:59:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<AqP3CLhFuOouZXpm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.162.42
country_id: 1562822
description:
Dec 12 07:59:55 host2 sshd[204906]: Disconnected from invalid user cy 152.32.162.42 port 55176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Dec 12 08:01:07 host2 sshd[206431]: Disconnected from invalid user l 211.24.41.44 port 40250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 08:02:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Qr3/ELhFEtuKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 08:01:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<iIHlDbhFmIY+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 08:01:14 host2 sshd[206535]: Disconnected from invalid user neo 154.73.168.229 port 49196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.162.42
country_id: 1562822
description:
Dec 12 08:01:44 host2 sshd[207140]: Disconnected from invalid user l 152.32.162.42 port 46068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.88
country_id: 6252001
description:
2025-12-12 08:01:55 dovecot_login authenticator failed for ([70.174.168.88]) [70.174.168.88]:37339: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 211.24.41.44
country_id: 1733045
description:
Dec 12 08:01:55 host2 sshd[207372]: Disconnected from invalid user admin 211.24.41.44 port 57310 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-12-12 08:02:45 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:53408: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-12 08:02:10 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:36346: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2025-12-12 08:02:17 dovecot_login authenticator failed for ([195.133.156.133]) [195.133.156.133]:34689: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 08:02:43 host2 sshd[208669]: Disconnected from invalid user cy 154.73.168.229 port 49296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.162.42
country_id: 1562822
description:
Dec 12 08:03:09 host2 sshd[209387]: Disconnected from invalid user xu 152.32.162.42 port 52564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Dec 12 08:03:14 host2 sshd[209464]: Disconnected from invalid user agent 211.24.41.44 port 59728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-12 08:03:17 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:54794: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 08:03:24 host2 sshd[209905]: Disconnected from invalid user xu 154.73.168.229 port 49352 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-12 08:03:31 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:35944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 08:04:04 host2 sshd[210571]: Disconnected from invalid user wangbo 154.73.168.229 port 49406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.162.42
country_id: 1562822
description:
Dec 12 08:04:34 host2 sshd[210896]: Disconnected from invalid user oracle 152.32.162.42 port 34838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 08:04:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<IkyvGrhFatSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 08:05:07 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (wermoer) [87.103.126.54]:38444: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-12 08:08:52 dovecot_plain authenticator failed for (heabilik) [65.20.191.12]:55536: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 08:08:54 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (fairrums) [87.103.126.54]:49812: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 87.103.126.54
country_id: 2264397
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[87.103.126.54] [Authentication Database]=[mail] [Username]=[info@ksoft.lk] (10/10 failures) (blocked until [Sat Dec 13 02:38:52 2025 UTC/Sat Dec 13 08:08:52 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 08:09:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<340OKrhFPIMI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec 12 08:08:27 host2 sshd[213336]: Disconnected from invalid user seekcy 105.27.148.94 port 35146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 08:08:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<kQIPKLhF9rGkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 08:08:45 host2 sshd[213736]: Disconnected from invalid user  62.60.131.157 port 64507 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 08:09:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<7G1TK7hF5Ipntrtb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.215
country_id: 6252001
description:
Dec 12 08:10:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.215, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<iuQ3LrhFWNGi2JbX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.215
country_id: 6252001
description:
Dec 12 08:11:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.215, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<D0kmMrhFJPCi2JbX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec 12 08:11:21 host2 sshd[216374]: Disconnected from invalid user temp 102.220.23.233 port 52148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec 12 08:11:51 host2 sshd[216805]: Disconnected from invalid user test_user 105.27.148.94 port 34978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-12 08:14:06 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (untelly) [98.192.74.183]:41226: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec 12 08:13:16 host2 sshd[217995]: Disconnected from invalid user l 105.27.148.94 port 35642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec 12 08:14:16 host2 sshd[219337]: Disconnected from invalid user brandon 102.220.23.233 port 52922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.244.63
country_id: 3469034
description:
Dec 12 08:14:18 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=186.209.244.63, lip=66.85.158.91, TLS, session=<dcTgO7hF6dS60fQ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.208.119
country_id: 798544
description:
Dec 12 08:14:35 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=91.246.208.119, lip=66.85.158.91, TLS, session=<h1b7PLhFtaZb9tB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 08:14:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<hdXwPrhFju3D+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Dec 12 08:15:57 host2 sshd[220568]: Disconnected from invalid user guest 105.27.148.94 port 36908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-12 08:15:59 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:52466: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 08:15:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<8KclQbhFDq9npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-12 08:15:44 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:41171: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 08:15:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GwNAQrhFlJ8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 08:16:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<+TehQ7hFgspo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.90.45
country_id: 1643084
description:
Dec 12 08:17:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=202.155.90.45, lip=66.85.158.91, session=<G1ekSLhFZK7Km1ot>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.215
country_id: 6252001
description:
Dec 12 08:18:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.215, lip=66.85.158.92, TLS, session=<gu2OSrhFFvGi2JbX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.215
country_id: 6252001
description:
Dec 12 08:18:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.215, lip=66.85.158.92, TLS, session=<VqrrSrhFJumi2JbX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 08:19:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<QwzzULhFOpXD+hnW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 195.250.25.214
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[195.250.25.214] [Remote Port]=[38202] [Authentication Database]=[mail] [Username]=[test@essenceceylontea.com] (10/10 failures) (blocked until [Sat Dec 13 02:49:54 2025 UTC/Sat Dec 13 08:19:54 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 08:19:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<XymyTrhFItKl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-12-12 08:19:43 dovecot_plain authenticator failed for (hetuadives) [5.32.61.6]:55975: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-12 08:20:20 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (abled) [75.74.211.27]:37436: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-12 08:21:10 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:37544: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 08:21:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<sQWSVrhFntZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 08:21:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<+JLsVrhFZtcImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-12 08:21:57 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:51426: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-12 08:22:11 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:37502: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 08:23:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<yTloXLhFWtwI3tq7>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.222.218.187
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.222.218.187] [Remote Port]=[56410] [Authentication Database]=[mail] [Username]=[sales@essenceceylontea.com] (10/10 failures) (blocked until [Sat Dec 13 02:53:06 2025 UTC/Sat Dec 13 08:23:06 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 12 08:23:56 host2 sshd[225834]: Disconnected from invalid user image 41.58.186.130 port 51880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 08:24:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<SQhFYrhFxqLCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 08:25:05 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (phieste) [96.230.65.90]:37172: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 12 08:25:45 host2 sshd[227388]: Disconnected from invalid user deploy 41.58.186.130 port 42506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-12 08:27:10 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:37092: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 08:26:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<oNUIaLhFTJ/O7iqJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.241.128.91
country_id: 1819730
description:
Dec 12 08:26:28 host2 sshd[227727]: Disconnected from invalid user wpyan 156.241.128.91 port 44016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec 12 08:26:39 host2 sshd[227824]: Disconnected from invalid user ubuntu 103.16.202.187 port 24373 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 12 08:26:56 host2 sshd[228085]: Disconnected from invalid user steam 41.58.186.130 port 43190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.218.89.110
country_id: 226074
description:
Dec 12 08:26:31 host2 sshd[227741]: Disconnected from invalid user tim 102.218.89.110 port 42436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.239.104.144
country_id: 2921044
description:
Dec 12 08:26:34 host2 sshd[227768]: Disconnected from invalid user testuser 77.239.104.144 port 56230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-12 08:26:45 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:52570: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 08:26:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<Y0HaabhFDJsu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-12 08:27:34 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:52644: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.239.104.144
country_id: 2921044
description:
Dec 12 08:27:42 host2 sshd[228579]: Disconnected from invalid user jason 77.239.104.144 port 52422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.64
country_id: 3996063
description:
2025-12-12 08:27:50 dovecot_login authenticator failed for (201.173.97.64-clientes-izzi.mx) [201.173.97.64]:58141: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.218.89.110
country_id: 226074
description:
Dec 12 08:28:07 host2 sshd[228855]: Disconnected from invalid user alireza 102.218.89.110 port 43214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Dec 12 08:27:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<Y+ija7hFBrBChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.56.197
country_id: 6252001
description:
Dec 12 08:28:45 host2 sshd[229321]: Disconnected from invalid user master 167.99.56.197 port 35388 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.204
country_id: 6252001
description:
Dec 12 08:29:37 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.204, lip=66.85.158.92, TLS, session=<ppSzc7hFEviTuYTM>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.99.56.197
country_id: 6252001
description:
Dec 12 08:29:45 host2 sshd[229753]: Received disconnect from 167.99.56.197 port 42138:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.56.197
country_id: 6252001
description:
Dec 12 08:29:45 host2 sshd[229753]: Disconnected from invalid user yy 167.99.56.197 port 42138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.56.197
country_id: 6252001
description:
Dec 12 08:29:15 host2 sshd[229593]: Disconnected from invalid user tt 167.99.56.197 port 37606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 12 08:30:35 host2 sshd[230449]: Disconnected from invalid user ubuntu 41.58.186.130 port 43044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec 12 08:30:41 host2 sshd[230490]: Disconnected from invalid user appuser 103.16.202.187 port 42316 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 08:32:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<K1rAfLhFPo/AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-12 08:32:50 dovecot_plain authenticator failed for (oveinated) [65.20.148.165]:53093: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-12 08:33:08 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:58733: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 12 08:33:16 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, session=<rpDFgLhFvpdChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-12 08:33:17 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:57620: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 08:34:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<IxmshbhFhLcv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 08:34:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<r5XnhbhFFIqG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-12 08:34:54 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (cloth) [73.213.236.66]:60802: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 08:34:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<BEpMhbhFtI4IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 08:35:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lJRriLhF6n1etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 08:36:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<RX/FirhFDLg+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.49
country_id: 1733045
description:
2025-12-12 08:36:45 dovecot_login authenticator failed for ([49.124.151.49]) [49.124.151.49]:42368: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.120
country_id: 3923057
description:
Dec 12 08:37:29 host2 sshd[234298]: Disconnected from invalid user nexus 190.129.122.120 port 36960 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 63.41.9.210
country_id: 6252001
description:
Dec 12 08:39:32 host2 sshd[235470]: Disconnected from invalid user smart 63.41.9.210 port 41607 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 08:39:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<VwRol7hF0r6kXGTY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Dec 12 08:39:53 host2 sshd[235777]: Disconnected from invalid user d 51.158.152.220 port 44450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-12-12 08:40:44 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:51910: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.120
country_id: 3923057
description:
Dec 12 08:40:13 host2 sshd[236232]: Disconnected from invalid user ftptest 190.129.122.120 port 38136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-12-12 08:41:13 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:54551: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-12 08:41:23 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (kerize) [24.61.199.212]:54840: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-12 08:41:30 dovecot_plain authenticator failed for (habeamia) [46.10.210.68]:39371: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.120
country_id: 3923057
description:
Dec 12 08:41:36 host2 sshd[237409]: Disconnected from invalid user postgres 190.129.122.120 port 42816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.217
country_id: 1733045
description:
Dec 12 08:41:55 host2 sshd[237611]: Disconnected from invalid user test_user 103.159.132.217 port 56034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Dec 12 08:42:03 host2 sshd[237732]: Disconnected from invalid user mohit 51.158.152.220 port 51474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.217
country_id: 1733045
description:
Dec 12 08:42:39 host2 sshd[238075]: Disconnected from invalid user vmuser 103.159.132.217 port 52248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.133
country_id: 298795
description:
Dec 12 08:42:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=45.67.155.133, lip=66.85.158.91, TLS, session=<hK6YoLhF5YYtQ5uF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.172
country_id: 3865483
description:
Dec 12 08:42:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt>, method=PLAIN, rip=190.122.128.172, lip=66.85.158.91, TLS, session=<pOnoobhFJs2+eoCs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 08:43:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<d12xo7hFNMwro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Dec 12 08:43:08 host2 sshd[238375]: Disconnected from invalid user deploy 51.158.152.220 port 46272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 08:42:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<1ZeYoLhFVIW8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.129.122.120
country_id: 3923057
description:
Dec 12 08:42:16 host2 sshd[237850]: Disconnected from invalid user deploy 190.129.122.120 port 37700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 08:43:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Hj9ApLhFZpdAF6S9>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.252
country_id: 2635167
description:
Dec 12 08:44:00 host2 dovecot[3988696]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.252, lip=66.85.158.92, TLS, session=<1GUap7hF7eFX7LD8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.242
country_id: 2635167
description:
Dec 12 08:44:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.242, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<MPlqp7hFsdu594ny>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Dec 12 08:43:40 host2 sshd[238684]: Disconnected from invalid user arkserver 51.158.152.220 port 38738 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 08:43:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ukMFprhF3sVm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 08:44:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<WiaEp7hFCvYvTJuG>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.158.152.220
country_id: 2750405
description:
Dec 12 08:44:11 host2 sshd[238951]: Received disconnect from 51.158.152.220 port 35000:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.152.220
country_id: 2750405
description:
Dec 12 08:44:11 host2 sshd[238951]: Disconnected from invalid user hadoop 51.158.152.220 port 35000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 08:44:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<W7F2qLhFLpiB4kCN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.231
country_id: 2635167
description:
Dec 12 08:44:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.231, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PopnqbhFG9+594nn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-12 08:45:59 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (wifullacox) [78.66.119.139]:42406: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-12 08:45:58 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:38237: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.223
country_id: 2635167
description:
Dec 12 08:45:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.223, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<X2dkq7hFv8W594nf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-12 08:45:39 dovecot_login authenticator failed for ([182.95.63.50]) [182.95.63.50]:41738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 08:45:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<rt3UrLhFmsiH6yFP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.218
country_id: 2635167
description:
Dec 12 08:45:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.218, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<l11grbhFy7NX7LDa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-12 08:45:16 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (naness) [68.82.141.145]:60256: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-12 08:45:21 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:45894: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.153
country_id: 6252001
description:
2025-12-12 08:45:33 dovecot_login authenticator failed for ([70.174.167.153]) [70.174.167.153]:37667: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.216
country_id: 6252001
description:
2025-12-12 08:45:45 dovecot_login authenticator failed for wsip-184-191-242-216.fv.ks.cox.net [184.191.242.216]:57200: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.249
country_id: 2635167
description:
Dec 12 08:46:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.249, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<t9Rcr7hFT5dX7LD5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-12 08:46:27 dovecot_login authenticator failed for ([125.17.236.223]) [125.17.233.246]:43428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.242
country_id: 2635167
description:
Dec 12 08:46:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.242, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<auVWsbhFDeVX7LDy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-12-12 08:47:02 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:41722: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-12 08:46:13 dovecot_login authenticator failed for ([84.213.190.55]) [84.213.190.55]:36571: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.224
country_id: 2635167
description:
Dec 12 08:47:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.224, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dCpRtbhF9eZX7LDg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-12 08:47:21 dovecot_login authenticator failed for ([178.232.55.16]) [178.232.55.16]:48612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.252
country_id: 2635167
description:
Dec 12 08:47:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.252, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<C0FVs7hFKcRX7LD8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 08:47:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<7llmtLhFjM+8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-12 08:47:51 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:51280: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 08:48:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jpfBuLhFrsov/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.248
country_id: 2635167
description:
Dec 12 08:49:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.248, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<txhHubhF9aa594n4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 08:48:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<8h/StrhFpsYuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.235
country_id: 2635167
description:
Dec 12 08:48:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.235, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<CONKt7hFYeFX7LDr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 08:50:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<eFo6v7hFuMSKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 08:51:46 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:58866: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 08:52:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<3mjew7hFSpqB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-12 08:52:38 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:50712: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-12 08:55:05 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (stsed) [76.145.10.140]:35068: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 08:56:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<0Frl0bhFxpGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 08:56:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<bSA91bhFluSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2025-12-12 08:57:52 dovecot_plain authenticator failed for c-98-195-138-52.hsd1.tx.comcast.net (rawed) [98.195.138.52]:47656: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 08:58:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<tD5J27hF3JA+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 08:59:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<tfXR3rhF7rFntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 12 08:59:17 host2 sshd[250473]: Disconnected from invalid user user 36.255.223.75 port 14538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 09:01:03 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:50984: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 09:01:08 host2 sshd[252247]: Disconnected from invalid user admin 2.57.121.112 port 31896 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 208.93.167.195
country_id: 6251999
description:
Dec 12 09:01:40 host2 dovecot[3988696]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<training@v-deploy.com>, method=PLAIN, rip=208.93.167.195, lip=66.85.158.91, TLS, session=<MOga5rhFMsTQXafD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 12 09:01:47 host2 sshd[252776]: Disconnected from invalid user bitrix 36.255.223.75 port 63796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 12 09:01:10 host2 sshd[252282]: Disconnected from invalid user wzy 36.255.223.75 port 51480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-12-12 09:01:22 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:2609: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 09:01:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<VrIj5bhFAowI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 09:02:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<hQFj6LhFutjD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.201
country_id: 3469034
description:
Dec 12 09:04:12 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=186.209.246.201, lip=66.85.158.91, TLS, session=</4xL7rhFLeW60fbJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 12 09:04:13 host2 sshd[255376]: Disconnected from invalid user yq 36.255.223.75 port 58050 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.228
country_id: 3175395
description:
Dec 12 09:04:30 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.171.228, lip=66.85.158.91, TLS, session=<8SNw77hFvda5D6vk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.41
country_id: 1733045
description:
2025-12-12 09:05:38 dovecot_login authenticator failed for ([49.124.153.41]) [49.124.153.41]:33036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-12 09:05:59 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:49571: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.206.214
country_id: 953987
description:
Dec 12 09:06:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.234.206.214, lip=66.85.158.91, TLS, session=<EG6x9bhFt8fF6s7W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 09:06:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<cPCo97hFaMUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.206.245.188
country_id: 798544
description:
Dec 12 09:06:37 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.206.245.188, lip=66.85.158.91, TLS, session=</Kj89rhFPZ5bzvW8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 09:07:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<WSaQ+rhFsuXD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 09:08:09 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (abbilly) [96.230.65.90]:47536: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Dec 12 09:08:14 host2 sshd[259299]: Disconnected from invalid user vncuser 45.78.201.131 port 42478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 09:08:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<q4DC/bhFRJlnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.191.141.128
country_id: 1512440
description:
2025-12-12 09:08:40 dovecot_plain authenticator failed for (hoont) [185.191.141.128]:49254: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-12 09:10:02 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:38545: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.29
country_id: 6252001
description:
Dec 12 09:10:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.29, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FsqgBLlFa8Rb5qgd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Dec 12 09:09:38 host2 sshd[260514]: Disconnected from invalid user nathan 45.78.201.131 port 51078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-12 09:09:44 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:60378: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 09:09:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<O+YkA7lFPNml6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-12 09:09:55 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:35606: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-12 09:10:13 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:50993: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.18
country_id: 6252001
description:
Dec 12 09:10:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.18, lip=66.85.158.91, TLS: Connection closed, session=<L6pGBblFtY9b5qgS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.25
country_id: 6252001
description:
Dec 12 09:10:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.25, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</SDiBblFO81b5qgZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.27
country_id: 6252001
description:
Dec 12 09:10:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.27, lip=66.85.158.91, TLS: Connection closed, session=<758QBrlFU7Fb5qgb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-12 09:11:10 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:38400: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-12 09:11:47 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:57837: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.131
country_id: 1880251
description:
Dec 12 09:12:06 host2 sshd[263637]: Disconnected from invalid user ubuntu 45.78.201.131 port 52796 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 09:13:33 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (proculer) [174.169.224.27]:38018: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 09:13:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BpruEblFZK9100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Dec 12 09:13:13 host2 sshd[265291]: Disconnected from invalid user git 45.78.201.131 port 43586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 09:14:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Z3vkE7lFHKDCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 09:15:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<qAHQFrlFAukImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 09:15:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<jvmtF7lFNOEI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.14
country_id: 3996063
description:
2025-12-12 09:15:44 dovecot_login authenticator failed for (201.173.216.14-clientes-izzi.mx) [201.173.216.14]:52833: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-12 09:16:00 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:58772: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-12 09:16:19 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:60430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-12 09:16:22 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:42610: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-12 09:16:39 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:37684: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 09:16:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<Mev1HLlFJMEu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 09:19:01 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:41897: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 09:18:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<DpLiIblFSs+LOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 09:18:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<+jLSIblFIJLO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 09:18:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZYvfIrlFLJenrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-12 09:19:00 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (semichs) [68.83.181.181]:54740: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-12 09:19:24 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:60873: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 09:19:40 host2 sshd[273400]: Disconnected from invalid user user 2.57.121.25 port 8761 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 09:20:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<My0nK7lFSrjAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 09:21:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<7/jwLblFJrI+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 09:22:18 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (epital) [71.224.169.28]:51818: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 09:22:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<ONjdMblFgrI+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 09:25:47 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:59832: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-12 09:26:10 dovecot_login authenticator failed for 16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:47816: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 09:26:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<epTxPrlFXYtetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 09:27:14 host2 sshd[281619]: Disconnected from invalid user  62.60.131.157 port 28437 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 09:27:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<GS03RLlFRNcIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 09:28:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<1BApRrlFusqkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 09:29:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<bV8ESrlFfOmG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.249
country_id: 6252001
description:
2025-12-12 09:29:56 dovecot_login authenticator failed for ([98.185.121.249]) [98.185.121.249]:56153: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-12 09:31:05 dovecot_plain authenticator failed for (uncycomart) [65.20.153.146]:51139: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 09:31:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<vOygULlFlr9AF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 09:32:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<3Ow4U7lFWug+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 09:32:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<0iOHVblF2MRm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.176.34.117
country_id: 1269750
description:
2025-12-12 09:33:26 dovecot_plain authenticator failed for (96H3V7R8Q2) [123.176.34.117]:52111: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 09:34:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<NO7oWblFeqi8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 09:34:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<W38qWrlFiOcro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2025-12-12 09:34:09 dovecot_login authenticator failed for ([177.236.146.149]) [177.236.146.149]:55945: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-12 09:34:16 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:39179: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-12 09:34:29 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:48394: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.48
country_id: 2464461
description:
2025-12-12 09:34:35 dovecot_login authenticator failed for ([102.110.11.48]) [102.110.11.48]:3016: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 09:34:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<VQldXLlFMtsvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-12 09:36:02 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (sturerreth) [69.142.126.37]:36682: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.69
country_id: 2635167
description:
Dec 12 09:35:11 host2 pure-ftpd[291126]: (?@185.247.137.69) [INFO] New connection from 185.247.137.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2025-12-12 09:35:31 dovecot_login authenticator failed for ([49.124.148.2]) [49.124.148.2]:46340: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 09:35:43 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60394: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 09:35:43 dovecot_plain authenticator failed for (sythoan) [154.144.243.93]:38140: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-12 09:35:52 dovecot_login authenticator failed for (aes-static-041.73.22.125.airtel.in) [122.186.201.62]:49108: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 09:36:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<ovyPYrlFLtuB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 09:37:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<jC6GZblF9LwuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-12 09:39:15 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (rophootof) [73.171.230.200]:51777: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 09:39:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<kP/abLlFQNE+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-12 09:39:22 dovecot_plain authenticator failed for (cocars) [154.144.255.208]:53350: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 09:39:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<5jkTbblF3KuKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-12 09:39:40 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:52665: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-12 09:39:52 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:33405: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-12-12 09:40:47 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:55950: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 09:41:37 host2 sshd[298544]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.96
country_id: 2635167
description:
Dec 12 09:41:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.96, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wLkldrlFhNkjy9Ng>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.96
country_id: 2635167
description:
Dec 12 09:42:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.96, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AV3Nd7lFjvQjy9Ng>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 09:42:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<0SDAeblFQsS8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 09:43:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<xq8XfblFItukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 09:45:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<BXfjgblFoqyB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 09:45:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<1201grlFRqiH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.46.42
country_id: 1821275
description:
2025-12-12 09:47:30 dovecot_login authenticator failed for ([125.31.46.42]) [125.31.46.42]:43862: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-12 09:48:13 dovecot_login authenticator failed for ([103.186.193.149]) [103.186.193.149]:44118: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-12 09:48:15 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:42276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.96
country_id: 2635167
description:
Dec 12 09:48:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.96, lip=66.85.158.91, TLS, session=<FU0Dj7lFNOkjy9Ng>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.42
country_id: 6252001
description:
2025-12-12 09:48:35 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:53635: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-12 09:48:54 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:55382: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-12-12 09:49:31 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:51323: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 09:49:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<dL1QkrlFgtiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 09:50:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<KFUYk7lFVofD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 09:50:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<yypKlLlFUolntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-12 09:50:32 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (undiss) [71.235.225.181]:49172: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-12 09:52:55 dovecot_plain authenticator failed for (caless) [24.104.225.201]:59162: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 09:53:26 host2 sshd[311017]: Disconnected from invalid user user 2.57.121.25 port 40598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-12 09:54:00 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:47012: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-12 09:53:21 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:34672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 09:54:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<RMgRorlFqqsI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 09:55:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<YeIVpblF/JjD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 12 09:55:56 host2 sshd[313950]: Disconnected from invalid user frontend 42.200.78.78 port 32896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-12 09:57:59 dovecot_login authenticator failed for (dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:42132: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 09:57:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<XYVTr7lFsuYv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-12 09:58:09 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:13452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.227.238.172
country_id: 6252001
description:
2025-12-12 09:58:21 dovecot_login authenticator failed for ([50.227.238.172]) [50.227.238.172]:60981: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 09:58:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<5oLqsLlFjOJo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-12-12 09:58:28 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:33293: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-12 09:59:32 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:51310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 12 09:59:41 host2 sshd[318450]: Disconnected from invalid user ftpuser 42.200.78.78 port 44002 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.192
country_id: 6252001
description:
Dec 12 09:59:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8CFKtLlFRd/N0h/A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-12 09:59:19 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:35472: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 10:00:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<okXYublFUMCl6L5h>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 12 10:00:59 host2 sshd[319823]: Disconnected from invalid user dockeruser 42.200.78.78 port 43466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 10:00:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<zt6KuLlFbKsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 10:01:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<rurlvblFho9npBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Dec 12 10:02:06 host2 sshd[320469]: Disconnected from invalid user dev 103.243.26.174 port 36102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 12 10:02:13 host2 sshd[320655]: Disconnected from invalid user zhangm 42.200.78.78 port 42924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Dec 12 10:02:51 host2 sshd[321084]: Disconnected from invalid user composeruser 103.243.26.174 port 39778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 12 10:03:27 host2 sshd[321900]: Disconnected from invalid user opc 209.15.115.240 port 52584 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.26.174
country_id: 1819730
description:
Dec 12 10:03:27 host2 sshd[321909]: Disconnected from invalid user igor 103.243.26.174 port 43380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-12 10:03:49 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:39017: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 12 10:03:56 host2 sshd[322295]: Disconnected from invalid user frontend 103.171.85.219 port 53868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-12 10:04:25 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:14423: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-12 10:04:53 dovecot_plain authenticator failed for (scamadevel) [65.20.133.208]:38775: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-12-12 10:04:54 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:42604: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 10:04:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<1XiJyLlFbNbCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-12 10:05:07 dovecot_login authenticator failed for ([180.94.75.110]) [180.94.75.110]:54972: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Dec 12 10:05:30 host2 sshd[323595]: Disconnected from invalid user cmm 185.158.23.150 port 37251 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Dec 12 10:05:53 host2 sshd[323820]: Disconnected from invalid user ubuntu 103.243.26.174 port 42692 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:05:17 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<SIjOyblFFt0DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 12 10:05:28 host2 sshd[323579]: Disconnected from invalid user zhangm 209.15.115.240 port 37514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-12 10:06:17 dovecot_plain authenticator failed for (vients) [80.227.147.94]:37149: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:06:59 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<LMHez7lFELcDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 12 10:07:02 host2 sshd[324678]: Disconnected from invalid user rahim 103.171.85.219 port 37082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 12 10:06:12 host2 sshd[324080]: Disconnected from invalid user dockeruser 209.15.115.240 port 60140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 10:07:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Krqv0LlF7JJ100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:07:32 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<J7Ph0blFjtQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 10:08:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<LaLy1LlF2psI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 12 10:08:28 host2 sshd[325990]: Disconnected from invalid user ftpuser 103.171.85.219 port 50364 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:09:13 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Oh/o17lFxqYDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:09:39 host2 dovecot[3988696]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<MSBp2blF3K0DhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 12 10:09:54 host2 sshd[326960]: Disconnected from invalid user zhangm 103.171.85.219 port 48292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 10:10:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<S1v92rlFLoQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 10:10:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<OXcF3LlFhObAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 10:10:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<j+mO3blFOs/O7iqJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:11:54 host2 dovecot[3988696]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<s2J+4blFTLMDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 10:11:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<yTH23rlFaOw+PIdg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:11:25 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<lbLE37lF1tQDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.164
country_id: 1269750
description:
2025-12-12 10:13:51 dovecot_login authenticator failed for ([182.79.218.164]) [182.79.218.164]:55086: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:13:40 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<1HDG57lF8IUDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-12 10:14:11 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:44426: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 10:14:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<iuG367lFAJ4v/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Dec 12 10:16:44 host2 sshd[332734]: Disconnected from invalid user ubuntu 182.253.156.184 port 38328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-12 10:16:53 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (wageed) [76.31.164.124]:38494: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 10:18:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<W7Zj97lFxQZetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec 12 10:17:21 host2 sshd[333352]: Disconnected from invalid user oracle 182.253.156.184 port 51082 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 10:17:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<kK449blFdIOkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-12 10:17:38 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:47999: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-12 10:17:52 dovecot_login authenticator failed for ([182.95.58.114]) [182.95.58.114]:35930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:19:07 host2 sshd[335008]: Disconnected from invalid user caja 152.32.238.146 port 46156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 10:19:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Tnqn/blFQItAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 10:19:35 host2 sshd[335680]: Disconnected from invalid user admin 2.57.121.112 port 27876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 12 10:21:41 host2 sshd[338993]: Disconnected from invalid user vps 103.153.190.105 port 48048 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 10:23:04 host2 sshd[341149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:22:24 host2 sshd[340154]: Disconnected from invalid user pablo 152.32.238.146 port 59168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-12 10:22:54 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:51948: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 12 10:22:57 host2 sshd[340902]: Disconnected from invalid user debian 103.153.190.105 port 35854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 10:23:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<L9osCbpFhqUIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 10:22:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mLqGB7pFYJJm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-12 10:22:43 dovecot_login authenticator failed for ([182.95.229.38]) [182.95.229.38]:39364: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2025-12-12 10:23:53 dovecot_login authenticator failed for ([147.235.226.154]) [147.235.226.154]:42986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 12 10:24:15 host2 sshd[342615]: Disconnected from invalid user tableau 103.153.190.105 port 53216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:24:22 host2 sshd[342819]: Disconnected from invalid user test2 152.32.238.146 port 60234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 10:25:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<XYsEErpFtOGG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 10:25:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<445BErpFvhkvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 10:25:57 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:55824: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 10:26:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<BBZXFLpFZNUuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-12-12 10:26:13 dovecot_login authenticator failed for ([122.187.234.56]) [122.187.234.56]:52418: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 10:26:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<yumbFrpFbIcro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 10:26:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<LgpCF7pFYpW8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.38.92
country_id: 390903
description:
2025-12-12 10:27:19 dovecot_plain authenticator failed for (roscied) [149.210.38.92]:47901: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-12 10:27:22 dovecot_plain authenticator failed for (hemes) [12.150.243.22]:35197: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 10:28:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Ht2BHLpFesCB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 10:28:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<EJfdHbpFlsKKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:28:58 host2 sshd[348557]: Disconnected from invalid user filippo 152.32.238.146 port 48268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-12 10:29:01 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:46002: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:28:21 host2 sshd[347978]: Disconnected from invalid user ammar 152.32.238.146 port 53286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-12-12 10:28:23 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:46412: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-12 10:29:15 dovecot_login authenticator failed for (nsg-static-033.187.72.182.airtel.in) [182.95.228.110]:55096: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-12 10:29:48 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:54488: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-12 10:30:53 dovecot_login authenticator failed for ([128.185.223.185]) [27.123.114.190]:53520: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 10:31:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<uMcJJrpF/s0+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-12 10:31:10 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:33129: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 10:31:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uwvvKLpFVoykXF7M>


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 103.87.13.247
country_id: 1227603
description:
Dec 12 10:33:48 host2 pure-ftpd[352576]: (mathsmot@103.87.13.247) [NOTICE] /home/mathsmot//public_html/6/3-operations on integers/index3.html uploaded  (11928 bytes, 57.89KB/sec)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 12 10:35:29 host2 sshd[354272]: Disconnected from invalid user adam 152.32.129.140 port 45598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 12 10:36:32 host2 sshd[355020]: Disconnected from invalid user hp 155.4.244.169 port 24159 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 10:37:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<UivNPbpFrJHD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 12 10:38:42 host2 sshd[356616]: Disconnected from invalid user gitlab-runner 152.32.129.140 port 41530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 10:38:49 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:43341: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 10:39:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<dudKQrpFKum8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-12 10:38:22 dovecot_plain authenticator failed for (noides) [24.104.225.201]:49911: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-12 10:38:33 dovecot_plain authenticator failed for (nicasterid) [65.20.174.63]:52485: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 12 10:39:16 host2 sshd[357100]: Disconnected from invalid user user1 155.4.244.169 port 46759 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-12 10:39:22 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:34872: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 10:41:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<TRKiTLpFgpVntrtb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 12 10:41:13 host2 sshd[358915]: Disconnected from invalid user brenda 155.4.244.169 port 29953 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 10:42:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ozLsTrpF3sHD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.56.116.178
country_id: 6252001
description:
Dec 12 10:42:35 host2 sshd[360427]: Disconnected from invalid user netbox 2.56.116.178 port 57536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-12 10:42:45 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:46266: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 103.87.13.247
country_id: 1227603
description:
Dec 12 10:43:00 host2 pure-ftpd[360769]: (mathsmot@103.87.13.247) [NOTICE] /home/mathsmot//public_html/6/3-operations on integers/index3.html uploaded  (11934 bytes, 146.97KB/sec)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 10:42:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<mtLDTrpFgs6WXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.56.116.178
country_id: 6252001
description:
Dec 12 10:43:08 host2 sshd[361054]: Disconnected from invalid user david 2.56.116.178 port 41586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-12 10:42:27 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:47812: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Dec 12 10:43:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<cVXQUbpFPJnE+2Qw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-12 10:44:11 dovecot_plain authenticator failed for (dheters) [91.73.195.150]:35089: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 10:46:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<j4TgW7pFktmH6yFP>


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 103.87.13.247
country_id: 1227603
description:
Dec 12 10:46:40 host2 pure-ftpd[365135]: (mathsmot@103.87.13.247) [NOTICE] /home/mathsmot//public_html/6/3-operations on integers/pop-correct.mp3 uploaded  (43680 bytes, 61.63KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 10:47:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (obronted) [87.103.126.54]:17566: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 10:46:15 host2 sshd[364875]: Disconnected from invalid user  62.60.131.157 port 62926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2025-12-12 10:47:44 dovecot_login authenticator failed for (aes-static-097.188.22.125.airtel.in) [122.184.118.126]:53964: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-12 10:48:00 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:60364: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 103.87.13.247
country_id: 1227603
description:
Dec 12 10:47:22 host2 pure-ftpd[365135]: (mathsmot@103.87.13.247) [NOTICE] /home/mathsmot//public_html/6/3-operations on integers/pop-correct.mp3 uploaded  (43680 bytes, 48.23KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-12 10:47:28 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:42746: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 10:47:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<hG9LYbpF6MoI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-12 10:48:14 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:34290: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.204.239
country_id: 3469034
description:
Dec 12 10:48:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.189.204.239, lip=66.85.158.91, TLS, session=<cj7dZLpF/rOzvczv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-12 10:49:06 dovecot_login authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:58429: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-12 10:49:18 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:33895: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.178
country_id: 3865483
description:
Dec 12 10:49:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=179.0.250.178, lip=66.85.158.91, TLS, session=<z85NZrpFGYuzAPqy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 10:49:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<2M+vZ7pFxJ0v7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.4
country_id: 3017382
description:
Dec 12 10:51:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.4, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KvVOcLpFT4lb51kE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.110
country_id: 3017382
description:
Dec 12 10:52:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.110, lip=66.85.158.91, TLS: Connection closed, session=<ZZzucLpFE81b51lu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.107
country_id: 3017382
description:
Dec 12 10:52:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.107, lip=66.85.158.91, TLS: Connection closed, session=<63bycbpFn+Zb51lr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 10:52:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<gI/6crpFVLCl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-12 10:53:10 dovecot_login authenticator failed for ([178.239.238.23]) [178.239.238.23]:38710: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.3
country_id: 3017382
description:
Dec 12 10:52:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.3, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<J2XCcbpFF8Zb51kD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-12 10:53:48 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:59972: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-12 10:53:59 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:35854: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 10:54:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<8NPBerpFyKenrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-12 10:54:37 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:37470: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 10:55:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<vcVQfrpFPMY+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 10:56:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<ZQ9rf7pFtrSLOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 10:55:29 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:52526: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 10:55:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<CGBWfbpFJMfCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 10:56:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<IXvPgbpFvspnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 10:58:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<9Uk1hrpFvKXAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-12 11:00:17 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (loasts) [73.197.236.163]:41478: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-12 11:00:20 dovecot_plain authenticator failed for (deial) [64.72.74.162]:55820: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-12 11:00:32 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:44480: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 11:00:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jew4j7pFPfR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-12 11:01:08 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:55452: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 11:01:31 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:38774: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-12 11:01:39 dovecot_plain authenticator failed for (subishled) [65.20.133.208]:46326: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-12 11:03:06 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:53760: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 11:02:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<TSQolbpFvsMI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-12-12 11:02:21 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:45128: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-12 11:02:42 dovecot_plain authenticator failed for (parnmetre) [91.72.153.110]:55032: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-12 11:03:21 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:44314: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-12 11:03:33 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:55780: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-12 11:03:52 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:41592: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 11:04:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<HiTlnLpFBIzO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-12-12 11:04:33 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:58116: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-12-12 11:05:28 dovecot_login authenticator failed for ([124.197.73.76]) [124.197.73.76]:36336: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 11:06:03 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:56783: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 11:06:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<u31lo7pF0NEImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 11:06:17 dovecot_plain authenticator failed for (quaimous) [65.20.164.137]:52377: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 11:06:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<p5QIpLpF6OCkXGTY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 11:06:43 host2 sshd[385440]: Disconnected from invalid user admin 2.57.121.112 port 50975 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-12-12 11:07:54 dovecot_login authenticator failed for h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:56310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 11:08:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<jVIQqrpFsNQ+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-12 11:07:43 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54058: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 12 11:08:29 host2 sshd[386929]: Disconnected from invalid user wd 45.40.57.41 port 45576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 11:08:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Ss4xrbpFgqVAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 11:10:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<zCtdsbpF9CletwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 12 11:09:14 host2 sshd[387401]: Disconnected from invalid user backend 182.253.79.194 port 20106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.206.166
country_id: 2921044
description:
Dec 12 11:09:27 host2 sshd[387534]: Disconnected from invalid user hacker 46.101.206.166 port 53962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 12 11:10:15 host2 sshd[388575]: Disconnected from invalid user ossadm 59.98.148.5 port 46858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-12 11:11:07 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:34294: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 12 11:11:58 host2 sshd[389829]: Disconnected from invalid user zhangfeng 182.253.79.194 port 41002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 11:11:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<+K2xtbpFsK8+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-12 11:11:22 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:53241: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-12 11:12:29 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:59508: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 12 11:12:39 host2 sshd[390274]: Disconnected from invalid user newuser 45.40.57.41 port 60344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-12 11:12:39 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:55990: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-12 11:12:50 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:40646: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-12 11:12:52 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:36638: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 12 11:13:24 host2 sshd[390717]: Disconnected from invalid user ftp_id 45.40.57.41 port 56872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 11:13:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<b7g7vrpFlJZm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-12 11:14:12 dovecot_login authenticator failed for ([122.186.50.17]) [182.95.61.114]:56488: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 11:15:40 host2 sshd[392496]: Disconnected from invalid user user 2.57.121.25 port 12771 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 11:15:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<BBInxrpF/pIuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 11:17:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<rjTQy7pFAtAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.51
country_id: 3175395
description:
Dec 12 11:17:57 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=195.177.113.51, lip=66.85.158.91, TLS, session=<fEWlzLpFf5jDsXEz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.78.150
country_id: 1861060
description:
2025-12-12 11:18:51 dovecot_login authenticator failed for 133.232.78.150.static.zoot.jp [133.232.78.150]:51658: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Dec 12 11:18:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<xJHezbpFGNbEAHqi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.130.79
country_id: 2077456
description:
2025-12-12 11:18:36 dovecot_login authenticator failed for (61-69-130-79.static.tpgi.com.au) [61.69.130.79]:46987: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 11:18:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<yJtC0LpFguiKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 11:20:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<qRz31LpFsucIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-12 11:19:18 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:43292: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-12 11:19:48 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:58342: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 11:21:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<20n72LpFzraB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 11:20:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ee1x1rpF7NykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 11:20:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<XYjK17pFqpu8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 11:20:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<gHrs17pF+Isro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 12 11:20:56 host2 sshd[396592]: Disconnected from invalid user switch 59.98.148.5 port 58616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 11:21:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<C9lX2bpF9sOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 11:21:58 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ganded) [87.103.126.54]:61081: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:22:12 host2 sshd[397465]: Disconnected from invalid user toto 103.139.192.17 port 43956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 12 11:23:40 host2 sshd[398331]: Disconnected from invalid user marcel 102.88.137.80 port 1369 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:23:55 host2 sshd[398449]: Disconnected from invalid user apollo 103.139.192.17 port 46514 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 12 11:24:26 host2 sshd[398723]: Disconnected from invalid user ldap 102.88.137.80 port 33575 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:24:40 host2 sshd[398836]: Disconnected from invalid user ubuntu 103.139.192.17 port 40528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 11:25:41 host2 sshd[399586]: Disconnected from invalid user admin 62.60.131.157 port 45159 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 11:25:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<6jKb6bpFOOzD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:26:20 host2 sshd[400070]: Disconnected from invalid user user 103.139.192.17 port 47142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 12 11:26:40 host2 sshd[400271]: Disconnected from invalid user car 102.88.137.80 port 17550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 11:27:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<hkjM7rpFyM4v/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:27:22 host2 sshd[400640]: Disconnected from invalid user dinesh 103.139.192.17 port 49728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 12 11:28:22 host2 sshd[401269]: Disconnected from invalid user teamspeak 154.83.15.200 port 56944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.16.111
country_id: 390903
description:
Dec 12 11:28:51 host2 sshd[401507]: Disconnected from invalid user adminz 83.235.16.111 port 36288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-12 11:29:26 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:36692: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-12 11:29:48 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:49678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.235.16.111
country_id: 390903
description:
Dec 12 11:30:07 host2 sshd[402314]: Disconnected from invalid user ircd 83.235.16.111 port 32780 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 11:30:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<i5AS/LpFAtDD+hnW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 11:31:38 host2 sshd[403265]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 12 11:31:46 host2 sshd[403380]: Disconnected from invalid user jay 154.83.15.200 port 34162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.16.111
country_id: 390903
description:
Dec 12 11:31:15 host2 sshd[402941]: Disconnected from invalid user tacuser 83.235.16.111 port 57506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 12 11:31:22 host2 sshd[403007]: Disconnected from invalid user chromeuser 199.195.254.215 port 51028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.41.194.63
country_id: 3469034
description:
Dec 12 11:32:10 host2 sshd[403667]: Disconnected from invalid user deploy 191.41.194.63 port 59060 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 12 11:32:24 host2 sshd[403821]: Disconnected from invalid user weather 154.83.15.200 port 46542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.97
country_id: 6252001
description:
2025-12-12 11:33:11 dovecot_login authenticator failed for ([70.174.168.97]) [70.174.168.97]:60278: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-12 11:33:47 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:50770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 12 11:34:30 host2 sshd[405465]: Disconnected from invalid user adminz 103.49.238.104 port 42990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 12 11:34:46 host2 sshd[405668]: Disconnected from invalid user gitea 158.69.194.34 port 55900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 11:34:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<rF6NB7tFit5ntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 12 11:34:15 host2 sshd[405304]: Disconnected from invalid user rob 199.195.254.215 port 36768 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 12 11:35:06 host2 sshd[406060]: Disconnected from invalid user jack 103.49.238.104 port 60554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 12 11:34:57 host2 sshd[405817]: Disconnected from invalid user david 40.83.182.122 port 57472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.41.194.63
country_id: 3469034
description:
Dec 12 11:35:26 host2 sshd[406445]: Disconnected from invalid user rundeck 191.41.194.63 port 36904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 12 11:35:55 host2 sshd[406913]: Disconnected from invalid user esuser 158.69.194.34 port 37750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 11:36:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<3+ywDrtFHIC8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 12 11:36:10 host2 sshd[407107]: Disconnected from invalid user plexuser 40.83.182.122 port 55738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 12 11:36:35 host2 sshd[407464]: Disconnected from invalid user matheus 118.193.38.207 port 39666 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.217
country_id: 3996063
description:
Dec 12 11:36:41 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=138.122.97.217, lip=66.85.158.91, TLS, session=<hVa4D7tFx+iKemHZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 12 11:37:03 host2 sshd[407973]: Disconnected from invalid user rundeck 158.69.194.34 port 46776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.47
country_id: 1269750
description:
Dec 12 11:37:04 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=202.136.85.47, lip=66.85.158.91, TLS, session=<lDPZELtF1rjKiFUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 11:36:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<ngznDrtFSqKWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 12 11:36:29 host2 sshd[407360]: Disconnected from invalid user debian 36.66.16.233 port 52252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 12 11:37:35 host2 sshd[408353]: Disconnected from invalid user deploy 158.69.194.34 port 41428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 12 11:37:54 host2 sshd[408602]: Disconnected from invalid user ftpuser 36.66.16.233 port 49750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.157
country_id: 1880251
description:
Dec 12 11:37:33 host2 sshd[408275]: Disconnected from invalid user test 45.78.220.157 port 50386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 12 11:37:47 host2 sshd[408522]: Disconnected from invalid user debian 118.193.38.207 port 40588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 11:37:16 host2 sshd[408121]: Disconnected from invalid user admin 2.57.121.112 port 17045 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 12 11:38:22 host2 sshd[408982]: Disconnected from invalid user esuser 118.193.38.207 port 55008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-12 11:38:24 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:46160: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-12 11:38:37 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:8633: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-12 11:38:48 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:59772: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-12-12 11:39:43 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:45670: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 12 11:39:15 host2 sshd[409658]: Disconnected from invalid user deploy 36.66.16.233 port 47136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-12 11:39:19 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:45801: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 11:39:33 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (poning) [71.224.169.28]:59564: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 12 11:39:45 host2 sshd[409964]: Disconnected from invalid user david 118.193.38.207 port 45126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-12 11:39:37 dovecot_plain authenticator failed for (iniurocles) [38.248.111.238]:46537: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 11:41:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tGefIrtF4rov/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 11:41:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Fnw/IbtFLMIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 11:41:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<PXzEIbtFdI4I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 11:42:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<cypuJbtFxIlo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-12 11:44:35 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:51235: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 11:45:06 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:37809: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-12 11:44:23 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:41086: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 11:45:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<vh4QL7tF4oyl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 11:46:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<1uBdMrtFYMrAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 11:47:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<1zpMNrtFPo/CBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 11:48:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<AfVdO7tFiKCH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 11:50:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<67tKQbtFXr2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-12 11:51:01 dovecot_plain authenticator failed for (xygnard) [96.85.104.2]:59370: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 11:52:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<4vUPSrtF+tRnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 11:54:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hMfETrtF21p100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-12 11:55:10 dovecot_login authenticator failed for ([128.185.243.163]) [182.95.119.118]:48976: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 11:55:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<EdgyVbtF0uQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 11:56:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<QLyZVrtFgJGkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 11:57:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Fr/OW7tFqtDO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 11:57:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<SXNGXLtFiKJAF6S9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.84.120
country_id: 6252001
description:
Dec 12 11:58:23 host2 pure-ftpd[423329]: (?@198.199.84.120) [INFO] New connection from 198.199.84.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-12 11:58:30 dovecot_login authenticator failed for ([125.23.72.129]) [125.20.245.194]:41084: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-12 11:59:09 dovecot_login authenticator failed for ([122.185.184.134]) [182.95.226.82]:34394: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-12 12:02:00 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (alocies) [85.225.19.144]:41973: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 12:02:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<bHBybLtFFBVetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-12 12:02:50 dovecot_plain authenticator failed for (nosce) [65.20.147.45]:37396: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 12:03:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<PazybrtFLpoImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-12-12 12:03:11 dovecot_login authenticator failed for ([128.185.70.193]) [125.19.157.158]:59170: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-12 12:03:19 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:50739: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 12 12:03:22 host2 sshd[427375]: Disconnected from invalid user deploy 36.91.166.34 port 37338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-12 12:03:41 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:56716: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 12:03:49 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (truevigy) [24.15.216.41]:32796: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-12 12:03:53 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:46972: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 12:04:11 host2 sshd[427987]: Disconnected from invalid user user 2.57.121.25 port 48822 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-12 12:04:43 dovecot_login authenticator failed for ([209.202.195.148]) [209.202.195.148]:49058: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-12 12:04:55 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:40063: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 12:05:18 host2 sshd[428776]: Disconnected from invalid user  62.60.131.157 port 5206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 12 12:05:21 host2 sshd[428809]: Disconnected from invalid user test 158.69.213.129 port 51696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 12:05:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<3sxqd7tFwKdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 12:06:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<zggqfLtFILguZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-12 12:07:05 dovecot_plain authenticator failed for (nogaprie) [65.20.160.107]:59868: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.238.189
country_id: 6252001
description:
Dec 12 12:07:30 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.238.189, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TJvifrtFtsxfte69>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.55
country_id: 1831722
description:
Dec 12 12:07:30 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=188.215.235.55, lip=66.85.158.91, TLS, session=<ny7kfrtFuMy81+s3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.5
country_id: 2661886
description:
Dec 12 12:07:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=212.112.19.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tX32frtF2LbUcBMF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.18
country_id: 597427
description:
Dec 12 12:07:29 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.18, lip=66.85.158.91, session=<VAvcfrtFVKkthMIS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 12 12:07:28 host2 sshd[429936]: Disconnected from invalid user deploy 36.91.166.34 port 41918 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.25
country_id: 3932488
description:
Dec 12 12:07:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.155.25, lip=66.85.158.91, session=<Pu/efrtFRKktmpsZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.173
country_id: 732800
description:
Dec 12 12:07:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=156.146.55.173, lip=66.85.158.91, session=<QsT2frtFZNuckjet>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-12 12:08:58 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:47228: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 12:09:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<hJAdhLtFzLWkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 12 12:09:01 host2 sshd[430903]: Disconnected from invalid user gitea 103.98.176.164 port 39476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 12:09:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Hp+RhLtFvMeKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 12:08:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<GIqVg7tFvqUvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.46.115.44
country_id: 6290252
description:
Dec 12 12:08:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=37.46.115.44, lip=66.85.158.91, TLS, session=<Dbfwg7tFOpUlLnMs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.25
country_id: 3932488
description:
Dec 12 12:08:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.155.25, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5zbwg7tFMJUtmpsZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 12:08:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<isQHhLtFQL0+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 12 12:08:11 host2 sshd[430454]: Disconnected from invalid user esuser 36.91.166.34 port 54720 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.8
country_id: 3041565
description:
Dec 12 12:09:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.217.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<onMGhbtFNt2t79kI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-12 12:09:34 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:46768: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 12 12:09:35 host2 sshd[431388]: Disconnected from invalid user david 158.69.213.129 port 52154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-12 12:09:44 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:44289: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-12-12 12:09:43 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:47061: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 12 12:09:44 host2 sshd[431491]: Disconnected from invalid user rundeck 103.98.176.164 port 40712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.18
country_id: 3041565
description:
Dec 12 12:09:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.217.18, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZO4Ph7tFuret79kS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2025-12-12 12:09:53 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:55206: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 12 12:10:05 host2 sshd[431882]: Disconnected from invalid user homeassistant 158.69.213.129 port 53868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-12-12 12:09:22 dovecot_login authenticator failed for ([49.124.148.196]) [49.124.148.196]:55682: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.125.61
country_id: 1694008
description:
Dec 12 12:10:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.214.125.61, lip=66.85.158.91, TLS, session=<S/bah7tFvoC81n09>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.238.189
country_id: 6252001
description:
Dec 12 12:10:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=95.181.238.189, lip=66.85.158.91, TLS, session=<bSUCibtFlqVfte69>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 12 12:10:23 host2 sshd[432244]: Disconnected from invalid user plexuser 103.98.176.164 port 55216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-12 12:10:26 dovecot_plain authenticator failed for (expred) [94.206.93.90]:41534: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.126.157
country_id: 3703430
description:
Dec 12 12:10:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.126.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<158CibtFjqVbWn6d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-12 12:10:28 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:58387: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 12 12:10:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xbUDirtFXu5ChJmN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-12 12:10:12 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:47174: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 12 12:11:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<IViojbtFSsQjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 12 12:12:14 host2 sshd[433392]: Disconnected from invalid user ftpuser 158.69.213.129 port 38548 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 12:13:14 host2 sshd[434149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Dec 12 12:13:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.55, lip=66.85.158.92, TLS: Connection closed, session=<5mhslLtF6O+nXpI3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 12:13:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<22GplbtFFuqB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-12 12:13:57 dovecot_login authenticator failed for 61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:57540: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2025-12-12 12:13:26 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:43014: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 12:14:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<+jMLl7tFRovD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 12:15:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<oMH8mbtFuosro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 12:15:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<6HF6mrtFzMe8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-12 12:16:04 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:37607: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-12 12:16:26 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:33480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 12:17:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<GFSyo7tFGtyG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-12-12 12:19:11 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:40930: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 12:19:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<atZvqbtFrr4IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 12:19:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<tjHiqbtFhoPD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-12 12:20:02 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (erreg) [78.66.119.139]:47512: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.189.152.228
country_id: 337996
description:
Dec 12 12:21:42 host2 pure-ftpd[440905]: (?@196.189.152.228) [INFO] New connection from 196.189.152.228


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.152.228
country_id: 337996
description:
Dec 12 12:21:43 host2 sshd[440904]: Invalid user shamila@epid.gov.lk from 196.189.152.228 port 10430


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.189.152.228
country_id: 337996
description:
Dec 12 12:21:48 host2 pure-ftpd[440905]: (?@196.189.152.228) [WARNING] Authentication failed for user [shamila@epid.gov.lk]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-12 12:22:56 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:60929: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2025-12-12 12:23:39 dovecot_login authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:51004: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-12 12:23:24 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:36885: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.100.204.180
country_id: 2661886
description:
2025-12-12 12:23:32 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:45192: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.189.152.228
country_id: 337996
description:
Dec 12 12:25:12 host2 dovecot[3988696]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=196.189.152.228, lip=66.85.158.91, TLS handshaking, session=<NPcuvrtF5SjEvZjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-12 12:25:39 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:49434: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-12 12:26:22 dovecot_login authenticator failed for (88.255.189.21.static.ttnet.com.tr) [88.255.189.21]:49220: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-12 12:27:05 dovecot_plain authenticator failed for (suped) [102.53.15.17]:40086: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-12 12:27:09 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (lenymed) [73.176.157.57]:58924: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-12-12 12:27:53 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:61234: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.61
country_id: 6252001
description:
2025-12-12 12:28:00 dovecot_login authenticator failed for ([98.185.120.61]) [98.185.120.61]:50961: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 12:28:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<pRMmyrtFdKNntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-12 12:28:16 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:60964: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-12-12 12:28:15 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:56392: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.184
country_id: 6252001
description:
Dec 12 12:29:28 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UQ5zzbtFntzG6xi4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-12 12:30:48 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (chboolan) [66.177.30.53]:50556: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 12:31:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Ew6C07tFIL6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 12:31:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<U2UA1btFrOanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 12:33:58 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:42955: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-12 12:34:27 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:40484: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-12 12:34:38 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (pureggia) [98.227.25.115]:35754: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-12 12:34:54 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:41932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 12:35:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<PyFQ4btF/ukv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.252
country_id: 2510769
description:
2025-12-12 12:35:12 dovecot_login authenticator failed for (109-69-15-252.puntdacces.coop) [109.69.15.252]:42973: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 12:35:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<dn5m4rtF1q28pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 12:36:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<i4iw5LtFApYI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.211
country_id: 6252001
description:
Dec 12 12:36:29 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.211, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fJSU5rtFGNfG6xjT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 12:36:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<+PsO6LtF3Nk+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-12 12:38:48 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:41447: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 12:39:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<gbFG8LtFbpXAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.16.88
country_id: 2661886
description:
2025-12-12 12:39:20 dovecot_login authenticator failed for a088.broadband.quicknet.se [217.78.16.88]:55046: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 12:39:29 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:55822: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 12:39:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<jHVY8btFGOGl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-12 12:39:48 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:33473: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-12 12:39:13 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (supip) [98.192.74.183]:36052: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 12:40:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<tBo29rtF5JjCBa8Y>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.161.244
country_id: 1227603
description:
[2025-12-12 12:41:59 +0530] info [whostmgrd] 112.134.161.244 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 12:43:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<Sk69/rtFSM+LOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.233
country_id: 6252001
description:
2025-12-12 12:44:25 dovecot_login authenticator failed for wsip-184-191-242-233.fv.ks.cox.net [184.191.242.233]:39839: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-12 12:44:41 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (nodual) [174.161.27.82]:38433: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-12-12 12:44:44 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:47662: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-12 12:45:37 dovecot_plain authenticator failed for (preher) [192.34.128.202]:43890: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.183
country_id: 3175395
description:
Dec 12 12:48:21 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.15.171.183, lip=66.85.158.91, TLS, session=</gr+D7xFFKW5D6u3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-12 12:48:34 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:47156: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.111
country_id: 690791
description:
Dec 12 12:48:39 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.17.125.111, lip=66.85.158.91, TLS, session=<+fcWEbxFb5i5EX1v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-12 12:48:50 dovecot_login authenticator failed for ([27.123.105.41]) [182.95.52.206]:34476: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 12:49:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<kRiqFLxFUuakXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.88.255
country_id: 1269750
description:
2025-12-12 12:49:54 dovecot_plain authenticator failed for (V4836VC8A) [152.59.88.255]:63855: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 12:49:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<uidoFrxFakF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.114.35
country_id: 1269750
description:
2025-12-12 12:50:59 dovecot_plain authenticator failed for (pling) [103.69.114.35]:53364: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-12 12:50:22 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (senamiant) [73.0.191.33]:48064: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 12:50:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<kZnSGLxF3tdAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 12:51:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<AvgJG7xFWo4I3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2025-12-12 12:51:24 dovecot_plain authenticator failed for dsl540122f2.fixip.t-online.hu (unplortion) [84.1.34.242]:45058: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 12:51:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<CQEEHLxFTtpnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 12:51:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<IGY9HbxF2tE+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-12 12:52:43 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (triol) [68.52.119.193]:51086: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 12:53:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<TjwOIrxFct7O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-12-12 12:54:00 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:36748: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-12 12:54:11 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:26452: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.22
country_id: 6252001
description:
2025-12-12 12:53:24 dovecot_login authenticator failed for ([98.185.120.22]) [98.185.120.22]:44321: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 12:54:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<5zopKLxF1sWH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-12 12:54:57 dovecot_login authenticator failed for ([12.150.243.20]) [12.150.243.22]:36206: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2025-12-12 12:54:59 dovecot_login authenticator failed for ([122.186.230.25]) [125.19.161.150]:60794: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-12 12:55:03 dovecot_plain authenticator failed for (hirrhael) [23.30.11.253]:50482: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2025-12-12 12:55:06 dovecot_plain authenticator failed for c-98-195-138-52.hsd1.tx.comcast.net (marter) [98.195.138.52]:47962: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-12 12:55:08 dovecot_login authenticator failed for ([89.140.17.22]) [81.0.54.119]:39658: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 12:56:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<dWg3L7xFYtsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 12:57:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<FV1XMLxFrXxetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 12:58:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<uPH8M7xFPI0+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-12 12:58:20 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:57251: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 12:58:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<K9BuNbxFOrdm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-12 12:59:25 dovecot_login authenticator failed for 16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:44901: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-12-12 12:59:37 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:46316: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-12 12:58:57 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:45120: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-12 12:59:05 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (sestion) [69.142.126.37]:56226: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 12 13:00:24 host2 sshd[473591]: Disconnected from invalid user adminuser 81.215.228.18 port 58552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-12 13:00:32 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:56812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 13:00:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<DfyIPbxFSsIuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 13:01:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<yI1JPrxFmt6kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 12 13:01:12 host2 sshd[473897]: Disconnected from invalid user prova 81.215.228.18 port 45094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-12 13:00:46 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:37109: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-12 13:02:39 dovecot_plain authenticator failed for (ackes) [65.20.233.110]:39756: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Dec 12 13:02:20 host2 sshd[474364]: Disconnected from invalid user vr 81.215.228.18 port 42292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 13:03:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<OTiQRbxF/JQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 13:03:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<X1lNRrxFVtsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 13:02:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<dg25RLxFqJuKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-12 13:04:31 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:49352: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-12-12 13:04:45 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:50294: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.14.194.128
country_id: 3017382
description:
[2025-12-12 13:04:57 +0530] info [cpaneld] 45.14.194.128 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 13:05:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<KnjjTLxFopHD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-12 13:07:39 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:49594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-12 13:07:54 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:43312: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.14
country_id: 1733045
description:
2025-12-12 13:10:03 dovecot_login authenticator failed for ([49.124.153.14]) [49.124.153.14]:34088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 13:10:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<TCxnYLxFtJrD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-12 13:09:43 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:52705: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 13:09:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<m2HJXbxFaoWB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 13:12:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<B/P8ZbxFkMYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 13:12:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<77bzaLxFgIW8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 13:13:44 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:37150: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2025-12-12 13:14:02 dovecot_login authenticator failed for (cm-84.213.187.240.get.no) [84.213.187.240]:32997: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 13:15:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<7cBRcLxFgLMro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-12-12 13:14:48 dovecot_plain authenticator failed for (irings) [5.32.107.6]:59737: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 13:17:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<37IGeLxF1N+G0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2025-12-12 13:18:36 dovecot_login authenticator failed for (abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:9310: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-12 13:19:06 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:56554: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-12 13:18:44 dovecot_login authenticator failed for (cm-84.213.190.55.get.no) [84.213.190.55]:39139: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-12 13:18:53 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:54652: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-12 13:20:32 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:39727: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 13:19:42 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (acism) [174.169.224.27]:46662: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 13:22:10 host2 sshd[489424]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 13:21:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<p1KNiLxFeJIIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-12 13:21:43 dovecot_plain authenticator failed for (poscu) [24.105.248.218]:40630: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 13:23:56 host2 sshd[490635]: Disconnected from invalid user  62.60.131.157 port 12358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 13:24:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<ybcUkbxFbpZntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-12 13:24:23 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:64256: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-12 13:25:14 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:58553: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 12 13:25:20 host2 sshd[491978]: Disconnected from invalid user ubuntu 162.240.156.34 port 48420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-12 13:24:46 dovecot_login authenticator failed for ([84.210.192.240]) [84.210.192.240]:41324: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-12 13:24:47 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:35240: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-12 13:26:13 dovecot_login authenticator failed for 40-54-166-83.dyn.estpak.ee [83.166.54.40]:36375: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 12 13:26:20 host2 sshd[492623]: Disconnected from invalid user khalid 118.193.43.167 port 26684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 12 13:26:32 host2 sshd[492746]: Disconnected from invalid user user002 162.240.156.34 port 48444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-12 13:25:47 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:53222: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 12 13:25:57 host2 sshd[492327]: Disconnected from invalid user scan 162.240.156.34 port 34316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 12 13:27:46 host2 sshd[493441]: Disconnected from invalid user ubuntu 162.240.156.34 port 48484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 12 13:28:06 host2 sshd[493658]: Disconnected from invalid user amir 118.193.43.167 port 64078 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 13:28:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<fIGEoLxFFtmWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 12 13:29:19 host2 sshd[494254]: Disconnected from invalid user tester 118.193.43.167 port 25030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 13:29:39 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53875: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 13:29:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<SGUppbxFap5o1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 13:30:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<JbvIp7xFYqYv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-12 13:31:38 dovecot_plain authenticator failed for (pantrify) [176.113.155.132]:52355: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-12 13:31:34 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (oustable) [71.62.34.216]:34834: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 13:31:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<aN+Fq7xFGt8I3tq7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 12 13:31:42 host2 sshd[496450]: Disconnected from invalid user stperez 118.193.43.167 port 10916 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 13:33:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<zornsbxFms/AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-12 13:35:04 dovecot_login authenticator failed for ([149.232.203.22]) [149.232.203.22]:37146: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2025-12-12 13:35:19 dovecot_login authenticator failed for ([103.111.6.121]) [103.111.6.121]:55098: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 13:35:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<zVDuuLxFKp/CBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 13:35:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<QiPlurxFro68pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 13:36:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<XwgpvLxFpOal6L5h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 12 13:36:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<bQvJvbxFDrSLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 13:37:43 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:42002: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 13:39:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<MocIx7xFrrI+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2025-12-12 13:39:44 dovecot_login authenticator failed for ([128.185.219.54]) [128.185.219.54]:48820: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 13:40:25 host2 sshd[501945]: Disconnected from invalid user admin 2.57.121.112 port 39378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 13:41:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<4oORzrxFtLWkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 13:42:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<3+oG0rxFoKlAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-12 13:44:24 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:33294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-12 13:44:53 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:44316: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-12 13:45:25 dovecot_login authenticator failed for ([125.23.229.42]) [182.78.64.150]:59084: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 13:45:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<exd03bxFrIQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 13:44:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jlLd2rxF52F100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-12 13:44:52 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:49948: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-12 13:45:43 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:50590: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 13:46:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<xJ914rxFBOrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 13:47:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<qDB15bxFerRnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 13:49:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<HYNC67xFrLw+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-12 13:50:22 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (adetes) [73.161.96.107]:51816: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-12 13:50:26 dovecot_plain authenticator failed for (hiolous) [65.20.160.107]:46767: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 13:50:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<TELf7bxFzVxetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-12 13:50:13 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:57813: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 13:50:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<zTIM7rxFuKBm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-12 13:51:13 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:36772: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-12 13:51:32 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:55912: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-12 13:50:43 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:50342: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 13:50:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<7zpo8LxFwqukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 13:52:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<7bRU97xFuNguZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 13:53:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4IZI+LxFQLI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.102
country_id: 2750405
description:
2025-12-12 13:53:31 dovecot_login authenticator failed for (0PLYbCnjCJ) [45.80.158.102]:51306: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-12 13:53:34 dovecot_plain authenticator failed for (ertic) [102.53.15.18]:47817: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 13:53:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<eHmI+7xFMrTD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 13:54:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<XKLs+7xF4qeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-12 13:54:09 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (stels) [24.127.53.61]:39054: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-12 13:54:57 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (pularga) [174.58.87.108]:48432: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 13:55:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<6PHj/7xFEsUvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.102
country_id: 2750405
description:
2025-12-12 13:55:29 dovecot_login authenticator failed for (0kRR7xGbnA) [45.80.158.102]:57738: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-12 13:55:32 dovecot_plain authenticator failed for (semichs) [91.73.195.150]:36498: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-12 13:55:38 dovecot_plain authenticator failed for (unous) [185.214.169.10]:51274: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 13:54:48 host2 sshd[512327]: Disconnected from invalid user user 2.57.121.25 port 34986 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 13:55:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Jh0BAr1FDomH6yFP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.91
country_id: 2635167
description:
Dec 12 13:56:48 host2 pure-ftpd[513916]: (?@185.247.137.91) [INFO] New connection from 185.247.137.91


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 13:59:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=</3a5Db1FUI7D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-12 14:00:39 dovecot_plain authenticator failed for (ditess) [94.206.93.90]:60404: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.229.72.68
country_id: 1605651
description:
Dec 12 14:01:26 host2 sshd[516834]: Disconnected from invalid user admin 49.229.72.68 port 34892 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-12 14:01:32 dovecot_plain authenticator failed for (eysiesish) [65.20.205.197]:59244: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 14:00:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<W+JxFL1FgrcImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-12 14:01:05 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:33502: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 14:01:21 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:36854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.23.122.235
country_id: 895949
description:
Dec 12 14:02:15 host2 sshd[517324]: Disconnected from invalid user ubuntu 102.23.122.235 port 11165 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.255.1.48
country_id: 2750405
description:
Dec 12 14:02:18 host2 sshd[517372]: Disconnected from invalid user admin 156.255.1.48 port 32938 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 12 14:02:54 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS, session=<NkaXG71FlsBChJlx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 14:03:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<oE7aG71FvsKB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 14:03:10 host2 sshd[518135]: Disconnected from invalid user  62.60.131.157 port 13637 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 14:03:34 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (shobads) [24.15.216.41]:33266: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 14:03:58 host2 sshd[518822]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.145
country_id: 298795
description:
Dec 12 14:04:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=95.0.171.145, lip=66.85.158.91, TLS, session=<5qTUIL1Fp7dfAKuR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 12 14:03:45 host2 sshd[518623]: Disconnected from invalid user gituser 51.91.252.38 port 59972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.68
country_id: 953987
description:
Dec 12 14:04:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=102.64.43.68, lip=66.85.158.91, TLS, session=<GsqGH71F6Z9mQCtE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-12 14:04:22 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:35100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.191.118
country_id: 3144096
description:
2025-12-12 14:04:34 dovecot_login authenticator failed for (cm-178.232.191.118.get.no) [178.232.191.118]:57755: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 12 14:05:23 host2 sshd[519894]: Disconnected from invalid user ftpuser2 51.91.252.38 port 41586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Dec 12 14:06:16 host2 sshd[520539]: Disconnected from invalid user ubuntu 95.0.252.5 port 49066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 12 14:06:27 host2 sshd[520657]: Disconnected from invalid user arash 51.91.252.38 port 33624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:06:37 host2 sshd[520774]: Disconnected from invalid user eprints 98.142.247.121 port 37816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Dec 12 14:07:29 host2 sshd[521330]: Disconnected from invalid user dev 95.0.252.5 port 46402 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 14:07:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<kQCQKr1FGsoro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 14:07:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<DTqfK71FYNu8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 12 14:07:28 host2 sshd[521325]: Disconnected from invalid user tsserver 51.91.252.38 port 51426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.255.1.48
country_id: 2750405
description:
Dec 12 14:07:46 host2 sshd[521576]: Disconnected from invalid user user1 156.255.1.48 port 38358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.23.122.235
country_id: 895949
description:
Dec 12 14:08:39 host2 sshd[522062]: Disconnected from invalid user scpuser 102.23.122.235 port 11168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:08:47 host2 sshd[522134]: Disconnected from invalid user root1 98.142.247.121 port 57898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-12 14:09:29 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:42874: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 14:09:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<cRWkM71FsL+nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-12-12 14:10:16 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:35978: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-12 14:10:36 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:58334: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-12 14:11:20 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:46365: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:11:28 host2 sshd[524373]: Received disconnect from 98.142.247.121 port 48198:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:10:56 host2 sshd[523995]: Disconnected from invalid user gituser 98.142.247.121 port 54964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:11:58 host2 sshd[524643]: Disconnected from invalid user pivpn 98.142.247.121 port 34564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.255.1.48
country_id: 2750405
description:
Dec 12 14:12:33 host2 sshd[524914]: Disconnected from invalid user prakash 156.255.1.48 port 39298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 14:13:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<gRNrQL1FzIs+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 14:13:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<X1fGQr1FXN6G0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 14:14:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<nw7pQ71FLJo+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-12 14:14:28 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:35202: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-12 14:15:02 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:36753: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:15:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<LlF2R71FwtYDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 14:14:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<a311Rr1F4Mxntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-12 14:15:42 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:51548: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:16:02 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<teuVSr1FjIsDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-12 14:16:17 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:35486: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.80.200.216
country_id: 6252001
description:
Dec 12 14:17:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.80.200.216, lip=66.85.158.92, session=<XPooT71F/uUoUMjY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:17:51 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<rmAYUb1FFrgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:18:44 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<u5tAVL1FLKADgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 14:19:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<kx9mVr1FKM8IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.179
country_id: 3175395
description:
Dec 12 14:20:15 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=185.197.8.179, lip=66.85.158.91, TLS, session=<A9yaWL1FL9O5xQiz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:20:18 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<WuvQWb1FQokDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.160
country_id: 6290252
description:
Dec 12 14:19:56 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=109.207.35.160, lip=66.85.158.91, TLS, session=<deuIV71FL+ptzyOg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:21:18 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<LINoXb1F2IEDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:21:35 host2 dovecot[3988696]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0oxrXr1FSrgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 14:21:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<wN9XXr1F1sOWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:22:15 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<1+zOYL1F3uQDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:22:30 host2 dovecot[3988696]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<DgWyYb1F0JkDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 14:23:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<7yjLY71F3LaLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 14:23:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<2pMwZb1FlJXAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 14:23:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<cfZUY71FpMwv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:22:58 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<KlphY71FQocDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 14:24:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<O7h1Z71FdtYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 14:24:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<Wz3BZ71FhqUI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.162.246
country_id: 6252001
description:
Dec 12 14:24:25 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=130.131.162.246, lip=66.85.158.91, session=<OWCHaL1F3t+Cg6L2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:23:51 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<yOeLZr1FHIgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 14:25:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<OOcLbL1F/IuB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 14:25:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<tkkNbb1FANg+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-12 14:26:12 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:51889: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-12 14:26:26 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:44934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 14:26:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<3GyUcL1FIrrCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 14:27:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<7yj3cr1FoNG8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 14:28:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<9Nw4eL1FmKul6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-12 14:29:18 dovecot_plain authenticator failed for (lyctic) [65.20.184.80]:40280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-12 14:30:00 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (prappode) [98.40.101.10]:41922: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-12 14:30:15 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:54678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.20
country_id: 3175395
description:
Dec 12 14:30:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.26.178.20, lip=66.85.158.91, TLS, session=<WJ2afL1F0MnZGrIU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.174.73.235
country_id: 798544
description:
Dec 12 14:30:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.174.73.235, lip=66.85.158.91, TLS, session=<Bii+fb1Fa+kurknr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.49
country_id: 1733045
description:
2025-12-12 14:29:54 dovecot_login authenticator failed for ([49.124.151.49]) [49.124.151.49]:55976: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 14:31:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<q1v+f71F6MOkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 14:32:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Vlj8hL1F1LJAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.0
country_id: 3469034
description:
Dec 12 14:32:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.249.0, lip=66.85.158.91, TLS, session=<4U6ehL1FPdy60fkA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.174.40
country_id: 99237
description:
Dec 12 14:32:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=65.20.174.40, lip=66.85.158.91, TLS, session=<R+rshb1FoopBFK4o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 12 14:33:24 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rOWuiL1FOn1ChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-12 14:35:11 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:32946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-12 14:35:14 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:54539: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-12 14:35:23 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:38203: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-12 14:35:38 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:33632: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-12-12 14:34:51 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:44098: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.215
country_id: 3996063
description:
2025-12-12 14:35:41 dovecot_login authenticator failed for ([177.236.145.215]) [177.236.145.215]:53186: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-12 14:36:34 dovecot_login authenticator failed for ([128.185.201.138]) [128.185.201.138]:46188: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-12 14:36:53 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [125.17.124.75]:57392: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.217
country_id: 99237
description:
2025-12-12 14:37:59 dovecot_plain authenticator failed for (reited) [65.20.237.217]:43437: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 14:38:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2N4gm71FD8F100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 14:39:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<sv48nb1FXt0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 14:39:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=</se0nb1F5IMI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.173.36
country_id: 3469034
description:
2025-12-12 14:39:27 dovecot_plain authenticator failed for ([89.116.164.85]) [177.74.173.36]:2063: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 14:39:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<QWW4nr1FzuzO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 14:40:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<SPSAoL1FLNJm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.21.206.145
country_id: 3865483
description:
2025-12-12 14:40:18 dovecot_plain authenticator failed for ([89.116.164.85]) [181.21.206.145]:48922: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.193.212
country_id: 1694008
description:
2025-12-12 14:40:31 dovecot_plain authenticator failed for ([89.116.164.85]) [103.183.193.212]:58398: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 14:40:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<7Gkmor1F3uekXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.17.174.99
country_id: 3437598
description:
2025-12-12 14:39:45 dovecot_plain authenticator failed for ([89.116.164.85]) [186.17.174.99]:42082: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.92.217.41
country_id: 3865483
description:
2025-12-12 14:40:00 dovecot_plain authenticator failed for ([89.116.164.85]) [181.92.217.41]:43208: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.87.91.29
country_id: 3865483
description:
2025-12-12 14:40:04 dovecot_plain authenticator failed for ([89.116.164.85]) [181.87.91.29]:45868: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 14:41:27 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (overilis) [87.103.126.54]:12623: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 14:42:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<YlSlqL1FSr9npBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 14:42:24 host2 sshd[545940]: Disconnected from invalid user user 2.57.121.25 port 21636 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-12 14:42:29 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:58730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 14:42:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<8RlHqb1F35detwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-12 14:41:45 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:40546: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-12 14:42:10 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:34698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 14:43:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<rnxsrL1F8ObD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 14:43:47 dovecot_plain authenticator failed for (multe) [65.20.164.137]:49033: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2025-12-12 14:44:24 dovecot_login authenticator failed for ([49.124.146.34]) [49.124.146.34]:48374: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 14:44:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<knbkr71FBIUuZXpm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-12 14:44:41 +0530] info [cpaneld] 89.249.55.106 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-12 14:45:03 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:57856: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 14:45:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<xL1esr1FtK2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-12 14:45:32 dovecot_login authenticator failed for ([135.13.8.246]) [74.224.215.23]:9783: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-12 14:44:43 +0530] info [cpaneld] 89.249.55.106 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-12 14:46:03 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:38392: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 14:46:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<SrHZuL1FppQ+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 14:47:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<jG/wur1FqtMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 14:48:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=</CzHv71FsK7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 14:50:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<xLZHxb1FtIGH6yFP>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.73
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.73: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-12 14:52:01 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:50453: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-12 14:52:20 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (queuding) [73.88.196.91]:49414: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-12 14:52:26 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:55220: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-12 14:52:30 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (cohently) [93.145.118.40]:36638: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 12 14:54:16 host2 pure-ftpd[555819]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-12-12 14:54:39 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:37546: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-12 14:55:39 dovecot_plain authenticator failed for (berding) [91.73.195.150]:56021: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-12 14:56:09 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:35462: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-12 14:56:52 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57374: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-12 14:57:34 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (muticah) [73.13.220.220]:41134: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 14:57:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<cdmq371Fpp6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 15:00:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<utJA6L1FRtwImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 15:00:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<Cqdi6L1FtJUro2np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.10
country_id: 2921044
description:
Dec 12 15:00:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 7 secs): user=<>, rip=57.129.64.10, lip=66.85.158.91, TLS: Connection closed, session=<h0vK6b1FTY45gUAK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 15:01:05 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:44740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-12 15:01:17 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:49619: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-12 15:01:21 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54095: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-12 15:01:23 dovecot_plain authenticator failed for (spables) [24.93.140.162]:40553: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-12 15:01:34 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:39482: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-12-12 15:02:26 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:46882: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 12 15:02:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<fKe/8L1FkufBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2025-12-12 15:02:34 dovecot_login authenticator failed for ([198.8.94.171]) [181.177.9.119]:38334: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 15:02:55 dovecot_login authenticator failed for ([62.97.161.137]) [178.232.153.27]:50093: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 12 15:03:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<ZgvI8r1F1tPCw3NV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 15:03:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<xdiW871Fnoa8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:05:50 host2 sshd[564518]: Disconnected from invalid user ubuntu 174.136.203.212 port 52366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:07:30 host2 sshd[565734]: Disconnected from invalid user satya 103.13.207.125 port 47028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-12 15:07:37 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12085: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:07:00 host2 sshd[565382]: Disconnected from invalid user ruan 174.136.203.212 port 39844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:07:19 host2 sshd[565624]: Disconnected from invalid user zk 159.223.45.112 port 36702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:07:45 host2 sshd[565862]: Disconnected from invalid user dc 206.238.40.232 port 35490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:07:52 host2 sshd[565938]: Disconnected from invalid user tester 68.218.72.173 port 54642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-12 15:08:04 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:38799: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-12 15:08:26 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:57426: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:09:40 host2 sshd[567203]: Disconnected from invalid user support 174.136.203.212 port 60922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 15:09:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<e8jXB75FOpNntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:09:24 host2 sshd[567067]: Disconnected from invalid user gaurav 68.218.72.173 port 60198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:09:36 host2 sshd[567159]: Disconnected from invalid user testuser 51.178.43.161 port 53928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.166
country_id: 1269750
description:
2025-12-12 15:09:19 dovecot_login authenticator failed for (nsg-corporate-73.182.187.122.airtel.in) [182.95.178.166]:43646: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 12 15:09:30 host2 sshd[567106]: Disconnected from invalid user minerhub 165.154.205.128 port 41096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 15:08:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<KvL0Br5FVrNo1joy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:10:09 host2 sshd[567643]: Disconnected from invalid user test1 51.178.43.161 port 38198 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 12 15:09:58 host2 pure-ftpd[567384]: (?@66.132.153.115) [INFO] New connection from 66.132.153.115


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:10:11 host2 sshd[567692]: Disconnected from invalid user ubuntu 68.218.72.173 port 36106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Dec 12 15:10:38 host2 sshd[567987]: Disconnected from invalid user test 119.246.15.94 port 37868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:09:47 host2 sshd[567270]: Disconnected from invalid user marco 103.13.207.125 port 46002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:09:52 host2 sshd[567327]: Disconnected from invalid user sean 206.238.40.232 port 57552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:09:54 host2 sshd[567352]: Disconnected from invalid user ccorrea 159.223.45.112 port 44192 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:10:49 host2 sshd[568106]: Received disconnect from 174.136.203.212 port 55002:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:10:56 host2 sshd[568172]: Disconnected from invalid user test 68.218.72.173 port 47176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:11:11 host2 sshd[568444]: Disconnected from invalid user x 51.178.43.161 port 34974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:11:22 host2 sshd[568663]: Disconnected from invalid user ubuntu 206.238.40.232 port 37880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:10:49 host2 sshd[568106]: Disconnected from invalid user yf 174.136.203.212 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:11:14 host2 sshd[568525]: Disconnected from invalid user gaurav 159.223.45.112 port 39000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:12:12 host2 sshd[569484]: Disconnected from invalid user ubuntu 103.13.207.125 port 47712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 12 15:12:24 host2 sshd[569638]: Disconnected from invalid user vlad 165.154.205.128 port 51636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:12:30 host2 sshd[569705]: Disconnected from invalid user nabi 68.218.72.173 port 56206 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 12 15:12:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.168, lip=66.85.158.91, TLS, session=<RNDAEr5FFv/N0h+o>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 15:13:18 host2 sshd[570516]: Disconnected from invalid user user 2.57.121.25 port 27582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:14:03 host2 sshd[571491]: Disconnected from invalid user user 172.208.24.217 port 18054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:14:39 host2 sshd[572122]: Disconnected from invalid user sdtdserver 172.208.24.217 port 45890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Dec 12 15:15:00 host2 sshd[572399]: Disconnected from invalid user ubuntu 119.246.15.94 port 43535 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-12 15:15:45 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:60720: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 15:15:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<rZsCIL5FkMrAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 12 15:16:04 host2 sshd[573499]: Disconnected from invalid user usuario 197.211.55.20 port 53844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-12 15:16:07 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (breron) [98.204.134.124]:45992: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:15:15 host2 sshd[572751]: Disconnected from invalid user sysadmin 172.208.24.217 port 18088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 15:16:23 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:34860: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 12 15:17:27 host2 sshd[574821]: Disconnected from invalid user botuser 197.211.55.20 port 41166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-12-12 15:17:53 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:48096: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:17:30 host2 sshd[574872]: Disconnected from invalid user demo1 138.197.123.123 port 40602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:17:42 host2 sshd[574978]: Disconnected from invalid user mas 36.91.81.195 port 35888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 15:18:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<JqEiKL5FKt2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 15:18:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<O4V9KL5FsIgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-12 15:18:38 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:58625: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 15:20:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<R9vnL75F8rsI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:19:15 host2 sshd[576146]: Disconnected from invalid user demo 187.16.96.250 port 45646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.246
country_id: 6252001
description:
Dec 12 15:19:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.169.104.246, lip=66.85.158.92, session=<iQ2bLb5FFs8UqWj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 15:19:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<ZlKwLb5F4uq8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 15:20:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<L6c8L75FAJ0IgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:20:10 host2 sshd[577120]: Disconnected from invalid user nas 36.91.81.195 port 56184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.73
country_id: 6252001
description:
Dec 12 15:21:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.73, lip=66.85.158.91, session=<ThpFM75FK4Fb5qhJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 15:21:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<Znh4M75FSoaB4gum>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:20:16 host2 sshd[577228]: Received disconnect from 138.197.123.123 port 43026:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:20:49 host2 sshd[577707]: Disconnected from invalid user ubuntu 36.91.81.195 port 40090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 15:20:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<53Y9Mr5FCoXCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-12 15:22:10 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:47789: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.172
country_id: 6252001
description:
Dec 12 15:21:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.172, lip=66.85.158.91, session=<8SbvM75FZ69b5qis>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.175
country_id: 6252001
description:
Dec 12 15:21:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.175, lip=66.85.158.91, session=<fdV7NL5Fb+Zb5qiv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-12 15:21:47 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:47989: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 15:21:53 host2 sshd[578555]: Disconnected from invalid user  62.60.131.157 port 22660 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.168
country_id: 6252001
description:
Dec 12 15:21:23 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.168, lip=66.85.158.91, session=<odlMNL5FB8Vb5qio>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:21:44 host2 sshd[578422]: Disconnected from invalid user forward 187.16.96.250 port 48776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 15:23:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=</p2SOr5FYsyl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:22:21 host2 sshd[578863]: Disconnected from invalid user user 187.16.96.250 port 46940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:22:23 host2 sshd[578890]: Disconnected from invalid user botuser 138.197.123.123 port 43474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 15:23:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<+w38Ob5F4NSkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 15:23:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<p3e4Or5FLqI+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:23:32 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Z3/7O75FOJoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:24:28 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BNtTP75FiI4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 15:24:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<hMa/P75F+tlAF6S9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:24:19 host2 sshd[580294]: Disconnected from invalid user newroot 187.16.96.250 port 41744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:25:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Qca0Q75FGtIDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-12 15:27:05 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:43076: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 15:27:07 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:6287: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.204.227
country_id: 3469034
description:
Dec 12 15:28:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=177.93.204.227, lip=66.85.158.91, TLS, session=<21t/S75FOsqxXczj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:27:33 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<ZQpXSr5F2NYDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-12 15:27:33 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:59844: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-12 15:27:37 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:37200: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.141
country_id: 3865483
description:
Dec 12 15:27:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.90.141, lip=66.85.158.91, TLS, session=<DRcuSr5FspK+tVqN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-12 15:28:13 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:34891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:28:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A0MRTb5F+O0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-12 15:28:25 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:50538: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:31:06 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<1goMV75FoMYDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 15:31:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mR1XV75FIJlm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-12 15:32:02 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:58006: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 15:32:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<kOAsWr5FIIOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.168
country_id: 3996063
description:
2025-12-12 15:32:20 dovecot_login authenticator failed for ([177.236.146.168]) [177.236.146.168]:32844: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-12 15:32:51 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:35830: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 15:32:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<dbNdXb5FbuA+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-12 15:33:06 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:37616: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-12 15:34:03 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:49382: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 15:34:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4nmFYb5FmM7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 15:33:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<zHmsYL5F5KfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 15:35:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<0asXZr5FWKEI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 15:36:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<VXeJab5FULd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 15:36:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<j8xOar5FEbtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 15:36:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<u5bPar5Fit6KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 15:37:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<FB87br5F+pQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-12 15:37:23 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (hamorksts) [37.150.8.174]:46749: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 15:38:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<c9CJcb5FkIJnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 15:41:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<kyX2e75FCDEvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-12 15:42:27 dovecot_plain authenticator failed for (eambrack) [24.187.213.29]:47600: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-12 15:43:12 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:37572: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-12 15:43:32 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:45099: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 15:46:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<lCuMjL5FhKeH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-12 15:47:11 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:40594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 15:47:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<NdGGkr5FSqanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.150
country_id: 6252001
description:
2025-12-12 15:47:55 dovecot_login authenticator failed for ([70.174.167.150]) [70.174.167.150]:38669: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 15:49:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<EptimL5F3Kk+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-12 15:52:02 dovecot_login authenticator failed for ([203.193.147.41]) [203.193.147.37]:50929: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 15:53:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<z5pBpb5FJsYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-12-12 15:52:17 dovecot_login authenticator failed for ([149.54.51.162]) [149.54.51.162]:53206: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-12 15:52:23 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:50912: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-12 15:52:42 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:34017: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-12 15:53:17 dovecot_login authenticator failed for ([121.73.163.186]) [121.73.163.186]:51492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 15:53:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Anzspr5FLLCB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-12 15:53:39 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:45310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 15:54:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+AZVqb5FsuQv/lVz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 15:54:38 host2 sshd[606214]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-12-12 15:55:59 dovecot_login authenticator failed for ([2.55.88.51]) [2.55.88.51]:41892: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.6
country_id: 1733045
description:
2025-12-12 15:56:19 dovecot_login authenticator failed for ([49.124.151.6]) [49.124.151.6]:48536: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-12 15:57:59 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:46285: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-12 15:58:20 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:59035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 15:58:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ykZ1ur5F4oa8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-12 15:59:13 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:59330: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-12 15:59:34 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:50781: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.77
country_id: 3175395
description:
Dec 12 15:59:49 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=217.26.179.77, lip=66.85.158.91, TLS, session=<q8KJvL5FFLzZGrNN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 16:01:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<Z1pjwr5FSLsImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.142
country_id: 933860
description:
Dec 12 16:00:15 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=41.216.215.142, lip=66.85.158.91, TLS, session=<IKPovb5FyYwp2NeO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 16:00:39 host2 sshd[624145]: Disconnected from invalid user  62.60.131.157 port 38372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 16:01:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<hm92xL5FmrM+PIMh>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.135
country_id: 6252001
description:
Dec 12 16:02:14 host2 pure-ftpd[625371]: (?@135.237.126.135) [INFO] New connection from 135.237.126.135


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 16:02:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<UmIFyL5FuORntrtb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec 12 16:02:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS: Connection closed, session=<++uRyL5FQDdChJl3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 16:03:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<q5zjyb5F6I6LOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 16:03:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<5p/zyr5FQO4+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 12 16:03:51 host2 sshd[626934]: Disconnected from invalid user test 20.203.42.204 port 47212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.229.200.110
country_id: 298795
description:
2025-12-12 16:04:39 dovecot_plain authenticator failed for (bidess) [5.229.200.110]:54921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 12 16:06:32 host2 sshd[628815]: Disconnected from invalid user nexus 38.47.94.55 port 50670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-12 16:07:02 dovecot_plain authenticator failed for (bilomy) [65.20.129.28]:37437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-12 16:07:13 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:49270: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:07:43 host2 sshd[629697]: Disconnected from invalid user admin 172.188.75.98 port 44150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-12 16:08:01 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:41354: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.202.233
country_id: 6251999
description:
Dec 12 16:08:07 host2 pure-ftpd[629996]: (?@128.203.202.233) [INFO] New connection from 128.203.202.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.250
country_id: 1733045
description:
2025-12-12 16:09:12 dovecot_login authenticator failed for ([49.124.152.250]) [49.124.152.250]:41972: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:08:26 host2 sshd[630161]: Disconnected from invalid user analytics 172.188.75.98 port 50304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 16:08:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<9j33275F9JHAqZl0>


