# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.248
country_id: 2635167
description:
Dec 12 08:49:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.248, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<txhHubhF9aa594n4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 08:48:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<8h/StrhFpsYuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.235
country_id: 2635167
description:
Dec 12 08:48:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.235, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<CONKt7hFYeFX7LDr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 08:50:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<eFo6v7hFuMSKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 08:51:46 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:58866: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 08:52:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<3mjew7hFSpqB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-12 08:52:38 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:50712: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-12 08:55:05 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (stsed) [76.145.10.140]:35068: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 08:56:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<0Frl0bhFxpGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 08:56:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<bSA91bhFluSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2025-12-12 08:57:52 dovecot_plain authenticator failed for c-98-195-138-52.hsd1.tx.comcast.net (rawed) [98.195.138.52]:47656: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 08:58:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<tD5J27hF3JA+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 08:59:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<tfXR3rhF7rFntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 12 08:59:17 host2 sshd[250473]: Disconnected from invalid user user 36.255.223.75 port 14538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 09:01:03 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:50984: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 09:01:08 host2 sshd[252247]: Disconnected from invalid user admin 2.57.121.112 port 31896 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 208.93.167.195
country_id: 6251999
description:
Dec 12 09:01:40 host2 dovecot[3988696]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<training@v-deploy.com>, method=PLAIN, rip=208.93.167.195, lip=66.85.158.91, TLS, session=<MOga5rhFMsTQXafD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 12 09:01:47 host2 sshd[252776]: Disconnected from invalid user bitrix 36.255.223.75 port 63796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 12 09:01:10 host2 sshd[252282]: Disconnected from invalid user wzy 36.255.223.75 port 51480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-12-12 09:01:22 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:2609: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 09:01:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<VrIj5bhFAowI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 09:02:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<hQFj6LhFutjD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.201
country_id: 3469034
description:
Dec 12 09:04:12 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=186.209.246.201, lip=66.85.158.91, TLS, session=</4xL7rhFLeW60fbJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 12 09:04:13 host2 sshd[255376]: Disconnected from invalid user yq 36.255.223.75 port 58050 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.228
country_id: 3175395
description:
Dec 12 09:04:30 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.171.228, lip=66.85.158.91, TLS, session=<8SNw77hFvda5D6vk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.41
country_id: 1733045
description:
2025-12-12 09:05:38 dovecot_login authenticator failed for ([49.124.153.41]) [49.124.153.41]:33036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-12 09:05:59 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:49571: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.206.214
country_id: 953987
description:
Dec 12 09:06:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.234.206.214, lip=66.85.158.91, TLS, session=<EG6x9bhFt8fF6s7W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 09:06:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<cPCo97hFaMUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.206.245.188
country_id: 798544
description:
Dec 12 09:06:37 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.206.245.188, lip=66.85.158.91, TLS, session=</Kj89rhFPZ5bzvW8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 09:07:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<WSaQ+rhFsuXD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 09:08:09 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (abbilly) [96.230.65.90]:47536: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Dec 12 09:08:14 host2 sshd[259299]: Disconnected from invalid user vncuser 45.78.201.131 port 42478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 09:08:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<q4DC/bhFRJlnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.191.141.128
country_id: 1512440
description:
2025-12-12 09:08:40 dovecot_plain authenticator failed for (hoont) [185.191.141.128]:49254: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-12 09:10:02 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:38545: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.29
country_id: 6252001
description:
Dec 12 09:10:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.29, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FsqgBLlFa8Rb5qgd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Dec 12 09:09:38 host2 sshd[260514]: Disconnected from invalid user nathan 45.78.201.131 port 51078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-12 09:09:44 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:60378: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 09:09:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<O+YkA7lFPNml6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-12 09:09:55 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:35606: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-12 09:10:13 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:50993: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.18
country_id: 6252001
description:
Dec 12 09:10:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.18, lip=66.85.158.91, TLS: Connection closed, session=<L6pGBblFtY9b5qgS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.25
country_id: 6252001
description:
Dec 12 09:10:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.25, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</SDiBblFO81b5qgZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.27
country_id: 6252001
description:
Dec 12 09:10:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.27, lip=66.85.158.91, TLS: Connection closed, session=<758QBrlFU7Fb5qgb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-12 09:11:10 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:38400: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-12 09:11:47 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:57837: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.131
country_id: 1880251
description:
Dec 12 09:12:06 host2 sshd[263637]: Disconnected from invalid user ubuntu 45.78.201.131 port 52796 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 09:13:33 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (proculer) [174.169.224.27]:38018: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 09:13:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BpruEblFZK9100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Dec 12 09:13:13 host2 sshd[265291]: Disconnected from invalid user git 45.78.201.131 port 43586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 09:14:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Z3vkE7lFHKDCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 09:15:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<qAHQFrlFAukImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 09:15:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<jvmtF7lFNOEI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.14
country_id: 3996063
description:
2025-12-12 09:15:44 dovecot_login authenticator failed for (201.173.216.14-clientes-izzi.mx) [201.173.216.14]:52833: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-12 09:16:00 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:58772: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-12 09:16:19 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:60430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-12 09:16:22 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:42610: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-12 09:16:39 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:37684: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 09:16:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<Mev1HLlFJMEu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 09:19:01 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:41897: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 09:18:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<DpLiIblFSs+LOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 09:18:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<+jLSIblFIJLO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 09:18:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZYvfIrlFLJenrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-12 09:19:00 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (semichs) [68.83.181.181]:54740: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-12 09:19:24 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:60873: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 09:19:40 host2 sshd[273400]: Disconnected from invalid user user 2.57.121.25 port 8761 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 09:20:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<My0nK7lFSrjAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 09:21:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<7/jwLblFJrI+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 09:22:18 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (epital) [71.224.169.28]:51818: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 09:22:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<ONjdMblFgrI+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 09:25:47 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:59832: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-12 09:26:10 dovecot_login authenticator failed for 16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:47816: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 09:26:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<epTxPrlFXYtetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 09:27:14 host2 sshd[281619]: Disconnected from invalid user  62.60.131.157 port 28437 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 09:27:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<GS03RLlFRNcIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 09:28:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<1BApRrlFusqkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 09:29:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<bV8ESrlFfOmG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.249
country_id: 6252001
description:
2025-12-12 09:29:56 dovecot_login authenticator failed for ([98.185.121.249]) [98.185.121.249]:56153: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-12 09:31:05 dovecot_plain authenticator failed for (uncycomart) [65.20.153.146]:51139: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 09:31:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<vOygULlFlr9AF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 09:32:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<3Ow4U7lFWug+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 09:32:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<0iOHVblF2MRm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.176.34.117
country_id: 1269750
description:
2025-12-12 09:33:26 dovecot_plain authenticator failed for (96H3V7R8Q2) [123.176.34.117]:52111: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 09:34:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<NO7oWblFeqi8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 09:34:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<W38qWrlFiOcro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2025-12-12 09:34:09 dovecot_login authenticator failed for ([177.236.146.149]) [177.236.146.149]:55945: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-12 09:34:16 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:39179: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-12 09:34:29 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:48394: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.48
country_id: 2464461
description:
2025-12-12 09:34:35 dovecot_login authenticator failed for ([102.110.11.48]) [102.110.11.48]:3016: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 09:34:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<VQldXLlFMtsvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-12 09:36:02 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (sturerreth) [69.142.126.37]:36682: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.69
country_id: 2635167
description:
Dec 12 09:35:11 host2 pure-ftpd[291126]: (?@185.247.137.69) [INFO] New connection from 185.247.137.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2025-12-12 09:35:31 dovecot_login authenticator failed for ([49.124.148.2]) [49.124.148.2]:46340: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 09:35:43 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60394: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 09:35:43 dovecot_plain authenticator failed for (sythoan) [154.144.243.93]:38140: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-12 09:35:52 dovecot_login authenticator failed for (aes-static-041.73.22.125.airtel.in) [122.186.201.62]:49108: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 09:36:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<ovyPYrlFLtuB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 09:37:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<jC6GZblF9LwuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-12 09:39:15 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (rophootof) [73.171.230.200]:51777: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 09:39:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<kP/abLlFQNE+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-12 09:39:22 dovecot_plain authenticator failed for (cocars) [154.144.255.208]:53350: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 09:39:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<5jkTbblF3KuKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-12 09:39:40 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:52665: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-12 09:39:52 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:33405: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-12-12 09:40:47 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:55950: 535 Incorrect authentication data (set_id=comercial@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 09:41:37 host2 sshd[298544]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.96
country_id: 2635167
description:
Dec 12 09:41:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.96, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wLkldrlFhNkjy9Ng>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.96
country_id: 2635167
description:
Dec 12 09:42:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.96, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AV3Nd7lFjvQjy9Ng>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 09:42:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<0SDAeblFQsS8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 09:43:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<xq8XfblFItukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 09:45:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<BXfjgblFoqyB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 09:45:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<1201grlFRqiH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.46.42
country_id: 1821275
description:
2025-12-12 09:47:30 dovecot_login authenticator failed for ([125.31.46.42]) [125.31.46.42]:43862: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-12 09:48:13 dovecot_login authenticator failed for ([103.186.193.149]) [103.186.193.149]:44118: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-12 09:48:15 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:42276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.96
country_id: 2635167
description:
Dec 12 09:48:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.96, lip=66.85.158.91, TLS, session=<FU0Dj7lFNOkjy9Ng>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.42
country_id: 6252001
description:
2025-12-12 09:48:35 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:53635: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-12 09:48:54 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:55382: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-12-12 09:49:31 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:51323: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 09:49:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<dL1QkrlFgtiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 09:50:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<KFUYk7lFVofD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 09:50:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<yypKlLlFUolntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-12 09:50:32 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (undiss) [71.235.225.181]:49172: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-12 09:52:55 dovecot_plain authenticator failed for (caless) [24.104.225.201]:59162: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 09:53:26 host2 sshd[311017]: Disconnected from invalid user user 2.57.121.25 port 40598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-12 09:54:00 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:47012: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-12 09:53:21 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:34672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 09:54:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<RMgRorlFqqsI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 09:55:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<YeIVpblF/JjD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 12 09:55:56 host2 sshd[313950]: Disconnected from invalid user frontend 42.200.78.78 port 32896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-12 09:57:59 dovecot_login authenticator failed for (dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:42132: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 09:57:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<XYVTr7lFsuYv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-12 09:58:09 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:13452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.227.238.172
country_id: 6252001
description:
2025-12-12 09:58:21 dovecot_login authenticator failed for ([50.227.238.172]) [50.227.238.172]:60981: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 09:58:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<5oLqsLlFjOJo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-12-12 09:58:28 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:33293: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-12 09:59:32 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:51310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 12 09:59:41 host2 sshd[318450]: Disconnected from invalid user ftpuser 42.200.78.78 port 44002 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.192
country_id: 6252001
description:
Dec 12 09:59:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8CFKtLlFRd/N0h/A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-12 09:59:19 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:35472: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 10:00:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<okXYublFUMCl6L5h>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 12 10:00:59 host2 sshd[319823]: Disconnected from invalid user dockeruser 42.200.78.78 port 43466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 10:00:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<zt6KuLlFbKsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 10:01:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<rurlvblFho9npBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Dec 12 10:02:06 host2 sshd[320469]: Disconnected from invalid user dev 103.243.26.174 port 36102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 12 10:02:13 host2 sshd[320655]: Disconnected from invalid user zhangm 42.200.78.78 port 42924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Dec 12 10:02:51 host2 sshd[321084]: Disconnected from invalid user composeruser 103.243.26.174 port 39778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 12 10:03:27 host2 sshd[321900]: Disconnected from invalid user opc 209.15.115.240 port 52584 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.26.174
country_id: 1819730
description:
Dec 12 10:03:27 host2 sshd[321909]: Disconnected from invalid user igor 103.243.26.174 port 43380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-12 10:03:49 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:39017: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 12 10:03:56 host2 sshd[322295]: Disconnected from invalid user frontend 103.171.85.219 port 53868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-12 10:04:25 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:14423: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-12 10:04:53 dovecot_plain authenticator failed for (scamadevel) [65.20.133.208]:38775: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-12-12 10:04:54 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:42604: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 10:04:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<1XiJyLlFbNbCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-12 10:05:07 dovecot_login authenticator failed for ([180.94.75.110]) [180.94.75.110]:54972: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Dec 12 10:05:30 host2 sshd[323595]: Disconnected from invalid user cmm 185.158.23.150 port 37251 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Dec 12 10:05:53 host2 sshd[323820]: Disconnected from invalid user ubuntu 103.243.26.174 port 42692 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:05:17 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<SIjOyblFFt0DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 12 10:05:28 host2 sshd[323579]: Disconnected from invalid user zhangm 209.15.115.240 port 37514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-12 10:06:17 dovecot_plain authenticator failed for (vients) [80.227.147.94]:37149: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:06:59 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<LMHez7lFELcDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 12 10:07:02 host2 sshd[324678]: Disconnected from invalid user rahim 103.171.85.219 port 37082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 12 10:06:12 host2 sshd[324080]: Disconnected from invalid user dockeruser 209.15.115.240 port 60140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 10:07:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Krqv0LlF7JJ100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:07:32 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<J7Ph0blFjtQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 10:08:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<LaLy1LlF2psI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 12 10:08:28 host2 sshd[325990]: Disconnected from invalid user ftpuser 103.171.85.219 port 50364 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:09:13 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Oh/o17lFxqYDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:09:39 host2 dovecot[3988696]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<MSBp2blF3K0DhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 12 10:09:54 host2 sshd[326960]: Disconnected from invalid user zhangm 103.171.85.219 port 48292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 10:10:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<S1v92rlFLoQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 10:10:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<OXcF3LlFhObAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 10:10:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<j+mO3blFOs/O7iqJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:11:54 host2 dovecot[3988696]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<s2J+4blFTLMDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 10:11:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<yTH23rlFaOw+PIdg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:11:25 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<lbLE37lF1tQDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.164
country_id: 1269750
description:
2025-12-12 10:13:51 dovecot_login authenticator failed for ([182.79.218.164]) [182.79.218.164]:55086: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 12 10:13:40 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<1HDG57lF8IUDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-12 10:14:11 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:44426: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 10:14:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<iuG367lFAJ4v/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Dec 12 10:16:44 host2 sshd[332734]: Disconnected from invalid user ubuntu 182.253.156.184 port 38328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-12 10:16:53 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (wageed) [76.31.164.124]:38494: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 10:18:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<W7Zj97lFxQZetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec 12 10:17:21 host2 sshd[333352]: Disconnected from invalid user oracle 182.253.156.184 port 51082 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 10:17:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<kK449blFdIOkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-12 10:17:38 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:47999: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-12 10:17:52 dovecot_login authenticator failed for ([182.95.58.114]) [182.95.58.114]:35930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:19:07 host2 sshd[335008]: Disconnected from invalid user caja 152.32.238.146 port 46156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 10:19:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Tnqn/blFQItAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 10:19:35 host2 sshd[335680]: Disconnected from invalid user admin 2.57.121.112 port 27876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 12 10:21:41 host2 sshd[338993]: Disconnected from invalid user vps 103.153.190.105 port 48048 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 10:23:04 host2 sshd[341149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:22:24 host2 sshd[340154]: Disconnected from invalid user pablo 152.32.238.146 port 59168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-12 10:22:54 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:51948: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 12 10:22:57 host2 sshd[340902]: Disconnected from invalid user debian 103.153.190.105 port 35854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 10:23:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<L9osCbpFhqUIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 10:22:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mLqGB7pFYJJm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-12 10:22:43 dovecot_login authenticator failed for ([182.95.229.38]) [182.95.229.38]:39364: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2025-12-12 10:23:53 dovecot_login authenticator failed for ([147.235.226.154]) [147.235.226.154]:42986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 12 10:24:15 host2 sshd[342615]: Disconnected from invalid user tableau 103.153.190.105 port 53216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:24:22 host2 sshd[342819]: Disconnected from invalid user test2 152.32.238.146 port 60234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 10:25:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<XYsEErpFtOGG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 10:25:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<445BErpFvhkvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 10:25:57 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:55824: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 10:26:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<BBZXFLpFZNUuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-12-12 10:26:13 dovecot_login authenticator failed for ([122.187.234.56]) [122.187.234.56]:52418: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 10:26:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<yumbFrpFbIcro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 10:26:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<LgpCF7pFYpW8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.38.92
country_id: 390903
description:
2025-12-12 10:27:19 dovecot_plain authenticator failed for (roscied) [149.210.38.92]:47901: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-12 10:27:22 dovecot_plain authenticator failed for (hemes) [12.150.243.22]:35197: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 10:28:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Ht2BHLpFesCB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 10:28:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<EJfdHbpFlsKKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:28:58 host2 sshd[348557]: Disconnected from invalid user filippo 152.32.238.146 port 48268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-12 10:29:01 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:46002: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 12 10:28:21 host2 sshd[347978]: Disconnected from invalid user ammar 152.32.238.146 port 53286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-12-12 10:28:23 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:46412: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-12 10:29:15 dovecot_login authenticator failed for (nsg-static-033.187.72.182.airtel.in) [182.95.228.110]:55096: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-12 10:29:48 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:54488: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-12 10:30:53 dovecot_login authenticator failed for ([128.185.223.185]) [27.123.114.190]:53520: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 10:31:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<uMcJJrpF/s0+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-12 10:31:10 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:33129: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 10:31:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uwvvKLpFVoykXF7M>


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 103.87.13.247
country_id: 1227603
description:
Dec 12 10:33:48 host2 pure-ftpd[352576]: (mathsmot@103.87.13.247) [NOTICE] /home/mathsmot//public_html/6/3-operations on integers/index3.html uploaded  (11928 bytes, 57.89KB/sec)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 12 10:35:29 host2 sshd[354272]: Disconnected from invalid user adam 152.32.129.140 port 45598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 12 10:36:32 host2 sshd[355020]: Disconnected from invalid user hp 155.4.244.169 port 24159 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 10:37:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<UivNPbpFrJHD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 12 10:38:42 host2 sshd[356616]: Disconnected from invalid user gitlab-runner 152.32.129.140 port 41530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 10:38:49 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:43341: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 10:39:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<dudKQrpFKum8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-12 10:38:22 dovecot_plain authenticator failed for (noides) [24.104.225.201]:49911: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-12 10:38:33 dovecot_plain authenticator failed for (nicasterid) [65.20.174.63]:52485: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 12 10:39:16 host2 sshd[357100]: Disconnected from invalid user user1 155.4.244.169 port 46759 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-12 10:39:22 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:34872: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 10:41:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<TRKiTLpFgpVntrtb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 12 10:41:13 host2 sshd[358915]: Disconnected from invalid user brenda 155.4.244.169 port 29953 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 10:42:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ozLsTrpF3sHD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.56.116.178
country_id: 6252001
description:
Dec 12 10:42:35 host2 sshd[360427]: Disconnected from invalid user netbox 2.56.116.178 port 57536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-12 10:42:45 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:46266: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 103.87.13.247
country_id: 1227603
description:
Dec 12 10:43:00 host2 pure-ftpd[360769]: (mathsmot@103.87.13.247) [NOTICE] /home/mathsmot//public_html/6/3-operations on integers/index3.html uploaded  (11934 bytes, 146.97KB/sec)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 10:42:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<mtLDTrpFgs6WXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.56.116.178
country_id: 6252001
description:
Dec 12 10:43:08 host2 sshd[361054]: Disconnected from invalid user david 2.56.116.178 port 41586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-12 10:42:27 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:47812: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Dec 12 10:43:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<cVXQUbpFPJnE+2Qw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-12 10:44:11 dovecot_plain authenticator failed for (dheters) [91.73.195.150]:35089: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 10:46:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<j4TgW7pFktmH6yFP>


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 103.87.13.247
country_id: 1227603
description:
Dec 12 10:46:40 host2 pure-ftpd[365135]: (mathsmot@103.87.13.247) [NOTICE] /home/mathsmot//public_html/6/3-operations on integers/pop-correct.mp3 uploaded  (43680 bytes, 61.63KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 10:47:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (obronted) [87.103.126.54]:17566: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 10:46:15 host2 sshd[364875]: Disconnected from invalid user  62.60.131.157 port 62926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2025-12-12 10:47:44 dovecot_login authenticator failed for (aes-static-097.188.22.125.airtel.in) [122.184.118.126]:53964: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-12 10:48:00 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:60364: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 103.87.13.247
country_id: 1227603
description:
Dec 12 10:47:22 host2 pure-ftpd[365135]: (mathsmot@103.87.13.247) [NOTICE] /home/mathsmot//public_html/6/3-operations on integers/pop-correct.mp3 uploaded  (43680 bytes, 48.23KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-12 10:47:28 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:42746: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 10:47:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<hG9LYbpF6MoI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-12 10:48:14 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:34290: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.204.239
country_id: 3469034
description:
Dec 12 10:48:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.189.204.239, lip=66.85.158.91, TLS, session=<cj7dZLpF/rOzvczv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-12 10:49:06 dovecot_login authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:58429: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-12 10:49:18 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:33895: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.178
country_id: 3865483
description:
Dec 12 10:49:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=179.0.250.178, lip=66.85.158.91, TLS, session=<z85NZrpFGYuzAPqy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 10:49:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<2M+vZ7pFxJ0v7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.4
country_id: 3017382
description:
Dec 12 10:51:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.4, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KvVOcLpFT4lb51kE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.110
country_id: 3017382
description:
Dec 12 10:52:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.110, lip=66.85.158.91, TLS: Connection closed, session=<ZZzucLpFE81b51lu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.107
country_id: 3017382
description:
Dec 12 10:52:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.107, lip=66.85.158.91, TLS: Connection closed, session=<63bycbpFn+Zb51lr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 10:52:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<gI/6crpFVLCl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-12 10:53:10 dovecot_login authenticator failed for ([178.239.238.23]) [178.239.238.23]:38710: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.3
country_id: 3017382
description:
Dec 12 10:52:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.3, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<J2XCcbpFF8Zb51kD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-12 10:53:48 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:59972: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-12 10:53:59 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:35854: 535 Incorrect authentication data (set_id=information@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 10:54:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<8NPBerpFyKenrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-12 10:54:37 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:37470: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 10:55:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<vcVQfrpFPMY+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 10:56:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<ZQ9rf7pFtrSLOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 10:55:29 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:52526: 535 Incorrect authentication data (set_id=information)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 10:55:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<CGBWfbpFJMfCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 10:56:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<IXvPgbpFvspnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 10:58:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<9Uk1hrpFvKXAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-12 11:00:17 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (loasts) [73.197.236.163]:41478: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-12 11:00:20 dovecot_plain authenticator failed for (deial) [64.72.74.162]:55820: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-12 11:00:32 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:44480: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 11:00:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jew4j7pFPfR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-12 11:01:08 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:55452: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 11:01:31 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:38774: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-12 11:01:39 dovecot_plain authenticator failed for (subishled) [65.20.133.208]:46326: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-12 11:03:06 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:53760: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 11:02:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<TSQolbpFvsMI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-12-12 11:02:21 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:45128: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-12 11:02:42 dovecot_plain authenticator failed for (parnmetre) [91.72.153.110]:55032: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-12 11:03:21 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:44314: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-12 11:03:33 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:55780: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-12 11:03:52 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:41592: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 11:04:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<HiTlnLpFBIzO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-12-12 11:04:33 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:58116: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-12-12 11:05:28 dovecot_login authenticator failed for ([124.197.73.76]) [124.197.73.76]:36336: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 11:06:03 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:56783: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 11:06:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<u31lo7pF0NEImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 11:06:17 dovecot_plain authenticator failed for (quaimous) [65.20.164.137]:52377: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 11:06:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<p5QIpLpF6OCkXGTY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 11:06:43 host2 sshd[385440]: Disconnected from invalid user admin 2.57.121.112 port 50975 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-12-12 11:07:54 dovecot_login authenticator failed for h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:56310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 11:08:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<jVIQqrpFsNQ+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-12 11:07:43 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54058: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 12 11:08:29 host2 sshd[386929]: Disconnected from invalid user wd 45.40.57.41 port 45576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 11:08:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Ss4xrbpFgqVAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 11:10:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<zCtdsbpF9CletwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 12 11:09:14 host2 sshd[387401]: Disconnected from invalid user backend 182.253.79.194 port 20106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.206.166
country_id: 2921044
description:
Dec 12 11:09:27 host2 sshd[387534]: Disconnected from invalid user hacker 46.101.206.166 port 53962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 12 11:10:15 host2 sshd[388575]: Disconnected from invalid user ossadm 59.98.148.5 port 46858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-12 11:11:07 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:34294: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 12 11:11:58 host2 sshd[389829]: Disconnected from invalid user zhangfeng 182.253.79.194 port 41002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 11:11:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<+K2xtbpFsK8+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-12 11:11:22 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:53241: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-12 11:12:29 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:59508: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 12 11:12:39 host2 sshd[390274]: Disconnected from invalid user newuser 45.40.57.41 port 60344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-12 11:12:39 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:55990: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-12 11:12:50 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:40646: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-12 11:12:52 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:36638: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 12 11:13:24 host2 sshd[390717]: Disconnected from invalid user ftp_id 45.40.57.41 port 56872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 11:13:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<b7g7vrpFlJZm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-12 11:14:12 dovecot_login authenticator failed for ([122.186.50.17]) [182.95.61.114]:56488: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 11:15:40 host2 sshd[392496]: Disconnected from invalid user user 2.57.121.25 port 12771 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 11:15:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<BBInxrpF/pIuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 11:17:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<rjTQy7pFAtAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.51
country_id: 3175395
description:
Dec 12 11:17:57 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=195.177.113.51, lip=66.85.158.91, TLS, session=<fEWlzLpFf5jDsXEz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.78.150
country_id: 1861060
description:
2025-12-12 11:18:51 dovecot_login authenticator failed for 133.232.78.150.static.zoot.jp [133.232.78.150]:51658: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Dec 12 11:18:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<xJHezbpFGNbEAHqi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.130.79
country_id: 2077456
description:
2025-12-12 11:18:36 dovecot_login authenticator failed for (61-69-130-79.static.tpgi.com.au) [61.69.130.79]:46987: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 11:18:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<yJtC0LpFguiKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 11:20:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<qRz31LpFsucIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-12 11:19:18 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:43292: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-12 11:19:48 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:58342: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 11:21:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<20n72LpFzraB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 11:20:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ee1x1rpF7NykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 11:20:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<XYjK17pFqpu8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 11:20:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<gHrs17pF+Isro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 12 11:20:56 host2 sshd[396592]: Disconnected from invalid user switch 59.98.148.5 port 58616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 11:21:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<C9lX2bpF9sOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 11:21:58 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ganded) [87.103.126.54]:61081: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:22:12 host2 sshd[397465]: Disconnected from invalid user toto 103.139.192.17 port 43956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 12 11:23:40 host2 sshd[398331]: Disconnected from invalid user marcel 102.88.137.80 port 1369 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:23:55 host2 sshd[398449]: Disconnected from invalid user apollo 103.139.192.17 port 46514 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 12 11:24:26 host2 sshd[398723]: Disconnected from invalid user ldap 102.88.137.80 port 33575 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:24:40 host2 sshd[398836]: Disconnected from invalid user ubuntu 103.139.192.17 port 40528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 11:25:41 host2 sshd[399586]: Disconnected from invalid user admin 62.60.131.157 port 45159 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 11:25:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<6jKb6bpFOOzD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:26:20 host2 sshd[400070]: Disconnected from invalid user user 103.139.192.17 port 47142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 12 11:26:40 host2 sshd[400271]: Disconnected from invalid user car 102.88.137.80 port 17550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 11:27:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<hkjM7rpFyM4v/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.17
country_id: 1643084
description:
Dec 12 11:27:22 host2 sshd[400640]: Disconnected from invalid user dinesh 103.139.192.17 port 49728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 12 11:28:22 host2 sshd[401269]: Disconnected from invalid user teamspeak 154.83.15.200 port 56944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.16.111
country_id: 390903
description:
Dec 12 11:28:51 host2 sshd[401507]: Disconnected from invalid user adminz 83.235.16.111 port 36288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-12 11:29:26 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:36692: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-12 11:29:48 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:49678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.235.16.111
country_id: 390903
description:
Dec 12 11:30:07 host2 sshd[402314]: Disconnected from invalid user ircd 83.235.16.111 port 32780 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 11:30:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<i5AS/LpFAtDD+hnW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 11:31:38 host2 sshd[403265]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 12 11:31:46 host2 sshd[403380]: Disconnected from invalid user jay 154.83.15.200 port 34162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.16.111
country_id: 390903
description:
Dec 12 11:31:15 host2 sshd[402941]: Disconnected from invalid user tacuser 83.235.16.111 port 57506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 12 11:31:22 host2 sshd[403007]: Disconnected from invalid user chromeuser 199.195.254.215 port 51028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.41.194.63
country_id: 3469034
description:
Dec 12 11:32:10 host2 sshd[403667]: Disconnected from invalid user deploy 191.41.194.63 port 59060 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 12 11:32:24 host2 sshd[403821]: Disconnected from invalid user weather 154.83.15.200 port 46542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.97
country_id: 6252001
description:
2025-12-12 11:33:11 dovecot_login authenticator failed for ([70.174.168.97]) [70.174.168.97]:60278: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-12 11:33:47 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:50770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 12 11:34:30 host2 sshd[405465]: Disconnected from invalid user adminz 103.49.238.104 port 42990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 12 11:34:46 host2 sshd[405668]: Disconnected from invalid user gitea 158.69.194.34 port 55900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 11:34:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<rF6NB7tFit5ntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 12 11:34:15 host2 sshd[405304]: Disconnected from invalid user rob 199.195.254.215 port 36768 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 12 11:35:06 host2 sshd[406060]: Disconnected from invalid user jack 103.49.238.104 port 60554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 12 11:34:57 host2 sshd[405817]: Disconnected from invalid user david 40.83.182.122 port 57472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.41.194.63
country_id: 3469034
description:
Dec 12 11:35:26 host2 sshd[406445]: Disconnected from invalid user rundeck 191.41.194.63 port 36904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 12 11:35:55 host2 sshd[406913]: Disconnected from invalid user esuser 158.69.194.34 port 37750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 11:36:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<3+ywDrtFHIC8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 12 11:36:10 host2 sshd[407107]: Disconnected from invalid user plexuser 40.83.182.122 port 55738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 12 11:36:35 host2 sshd[407464]: Disconnected from invalid user matheus 118.193.38.207 port 39666 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.217
country_id: 3996063
description:
Dec 12 11:36:41 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=138.122.97.217, lip=66.85.158.91, TLS, session=<hVa4D7tFx+iKemHZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 12 11:37:03 host2 sshd[407973]: Disconnected from invalid user rundeck 158.69.194.34 port 46776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.47
country_id: 1269750
description:
Dec 12 11:37:04 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=202.136.85.47, lip=66.85.158.91, TLS, session=<lDPZELtF1rjKiFUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 11:36:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<ngznDrtFSqKWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 12 11:36:29 host2 sshd[407360]: Disconnected from invalid user debian 36.66.16.233 port 52252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 12 11:37:35 host2 sshd[408353]: Disconnected from invalid user deploy 158.69.194.34 port 41428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 12 11:37:54 host2 sshd[408602]: Disconnected from invalid user ftpuser 36.66.16.233 port 49750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.157
country_id: 1880251
description:
Dec 12 11:37:33 host2 sshd[408275]: Disconnected from invalid user test 45.78.220.157 port 50386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 12 11:37:47 host2 sshd[408522]: Disconnected from invalid user debian 118.193.38.207 port 40588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 11:37:16 host2 sshd[408121]: Disconnected from invalid user admin 2.57.121.112 port 17045 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 12 11:38:22 host2 sshd[408982]: Disconnected from invalid user esuser 118.193.38.207 port 55008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-12 11:38:24 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:46160: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-12 11:38:37 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:8633: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-12 11:38:48 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:59772: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-12-12 11:39:43 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:45670: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 12 11:39:15 host2 sshd[409658]: Disconnected from invalid user deploy 36.66.16.233 port 47136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-12 11:39:19 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:45801: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 11:39:33 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (poning) [71.224.169.28]:59564: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 12 11:39:45 host2 sshd[409964]: Disconnected from invalid user david 118.193.38.207 port 45126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-12 11:39:37 dovecot_plain authenticator failed for (iniurocles) [38.248.111.238]:46537: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 11:41:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tGefIrtF4rov/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 11:41:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Fnw/IbtFLMIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 11:41:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<PXzEIbtFdI4I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 11:42:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<cypuJbtFxIlo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-12 11:44:35 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:51235: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 11:45:06 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:37809: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-12 11:44:23 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:41086: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 11:45:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<vh4QL7tF4oyl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 11:46:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<1uBdMrtFYMrAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 11:47:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<1zpMNrtFPo/CBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 11:48:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<AfVdO7tFiKCH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 11:50:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<67tKQbtFXr2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-12 11:51:01 dovecot_plain authenticator failed for (xygnard) [96.85.104.2]:59370: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 11:52:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<4vUPSrtF+tRnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 11:54:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hMfETrtF21p100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-12 11:55:10 dovecot_login authenticator failed for ([128.185.243.163]) [182.95.119.118]:48976: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 11:55:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<EdgyVbtF0uQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 11:56:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<QLyZVrtFgJGkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 11:57:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Fr/OW7tFqtDO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 11:57:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<SXNGXLtFiKJAF6S9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.84.120
country_id: 6252001
description:
Dec 12 11:58:23 host2 pure-ftpd[423329]: (?@198.199.84.120) [INFO] New connection from 198.199.84.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-12 11:58:30 dovecot_login authenticator failed for ([125.23.72.129]) [125.20.245.194]:41084: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-12 11:59:09 dovecot_login authenticator failed for ([122.185.184.134]) [182.95.226.82]:34394: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-12 12:02:00 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (alocies) [85.225.19.144]:41973: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 12:02:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<bHBybLtFFBVetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-12 12:02:50 dovecot_plain authenticator failed for (nosce) [65.20.147.45]:37396: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 12:03:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<PazybrtFLpoImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-12-12 12:03:11 dovecot_login authenticator failed for ([128.185.70.193]) [125.19.157.158]:59170: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-12 12:03:19 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:50739: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 12 12:03:22 host2 sshd[427375]: Disconnected from invalid user deploy 36.91.166.34 port 37338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-12 12:03:41 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:56716: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 12:03:49 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (truevigy) [24.15.216.41]:32796: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-12 12:03:53 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:46972: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 12:04:11 host2 sshd[427987]: Disconnected from invalid user user 2.57.121.25 port 48822 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-12 12:04:43 dovecot_login authenticator failed for ([209.202.195.148]) [209.202.195.148]:49058: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-12 12:04:55 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:40063: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 12:05:18 host2 sshd[428776]: Disconnected from invalid user  62.60.131.157 port 5206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 12 12:05:21 host2 sshd[428809]: Disconnected from invalid user test 158.69.213.129 port 51696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 12:05:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<3sxqd7tFwKdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 12:06:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<zggqfLtFILguZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-12 12:07:05 dovecot_plain authenticator failed for (nogaprie) [65.20.160.107]:59868: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.238.189
country_id: 6252001
description:
Dec 12 12:07:30 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.238.189, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TJvifrtFtsxfte69>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.55
country_id: 1831722
description:
Dec 12 12:07:30 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=188.215.235.55, lip=66.85.158.91, TLS, session=<ny7kfrtFuMy81+s3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.5
country_id: 2661886
description:
Dec 12 12:07:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=212.112.19.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tX32frtF2LbUcBMF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.18
country_id: 597427
description:
Dec 12 12:07:29 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.18, lip=66.85.158.91, session=<VAvcfrtFVKkthMIS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 12 12:07:28 host2 sshd[429936]: Disconnected from invalid user deploy 36.91.166.34 port 41918 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.25
country_id: 3932488
description:
Dec 12 12:07:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.155.25, lip=66.85.158.91, session=<Pu/efrtFRKktmpsZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.173
country_id: 732800
description:
Dec 12 12:07:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=156.146.55.173, lip=66.85.158.91, session=<QsT2frtFZNuckjet>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-12 12:08:58 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:47228: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 12:09:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<hJAdhLtFzLWkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 12 12:09:01 host2 sshd[430903]: Disconnected from invalid user gitea 103.98.176.164 port 39476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 12:09:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Hp+RhLtFvMeKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 12:08:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<GIqVg7tFvqUvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.46.115.44
country_id: 6290252
description:
Dec 12 12:08:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=37.46.115.44, lip=66.85.158.91, TLS, session=<Dbfwg7tFOpUlLnMs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.25
country_id: 3932488
description:
Dec 12 12:08:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.155.25, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5zbwg7tFMJUtmpsZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 12:08:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<isQHhLtFQL0+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 12 12:08:11 host2 sshd[430454]: Disconnected from invalid user esuser 36.91.166.34 port 54720 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.8
country_id: 3041565
description:
Dec 12 12:09:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.217.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<onMGhbtFNt2t79kI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-12 12:09:34 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:46768: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 12 12:09:35 host2 sshd[431388]: Disconnected from invalid user david 158.69.213.129 port 52154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-12 12:09:44 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:44289: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-12-12 12:09:43 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:47061: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 12 12:09:44 host2 sshd[431491]: Disconnected from invalid user rundeck 103.98.176.164 port 40712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.18
country_id: 3041565
description:
Dec 12 12:09:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.217.18, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZO4Ph7tFuret79kS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2025-12-12 12:09:53 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:55206: 535 Incorrect authentication data (set_id=domains@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 12 12:10:05 host2 sshd[431882]: Disconnected from invalid user homeassistant 158.69.213.129 port 53868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-12-12 12:09:22 dovecot_login authenticator failed for ([49.124.148.196]) [49.124.148.196]:55682: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.125.61
country_id: 1694008
description:
Dec 12 12:10:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.214.125.61, lip=66.85.158.91, TLS, session=<S/bah7tFvoC81n09>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.238.189
country_id: 6252001
description:
Dec 12 12:10:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=95.181.238.189, lip=66.85.158.91, TLS, session=<bSUCibtFlqVfte69>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 12 12:10:23 host2 sshd[432244]: Disconnected from invalid user plexuser 103.98.176.164 port 55216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-12 12:10:26 dovecot_plain authenticator failed for (expred) [94.206.93.90]:41534: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.126.157
country_id: 3703430
description:
Dec 12 12:10:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.126.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<158CibtFjqVbWn6d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-12 12:10:28 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:58387: 535 Incorrect authentication data (set_id=domains)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 12 12:10:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xbUDirtFXu5ChJmN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-12 12:10:12 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:47174: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 12 12:11:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<IViojbtFSsQjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 12 12:12:14 host2 sshd[433392]: Disconnected from invalid user ftpuser 158.69.213.129 port 38548 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 12:13:14 host2 sshd[434149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Dec 12 12:13:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.55, lip=66.85.158.92, TLS: Connection closed, session=<5mhslLtF6O+nXpI3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 12:13:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<22GplbtFFuqB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-12 12:13:57 dovecot_login authenticator failed for 61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:57540: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2025-12-12 12:13:26 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:43014: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 12:14:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<+jMLl7tFRovD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 12:15:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<oMH8mbtFuosro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 12:15:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<6HF6mrtFzMe8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-12 12:16:04 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:37607: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-12 12:16:26 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:33480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 12:17:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<GFSyo7tFGtyG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-12-12 12:19:11 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:40930: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 12:19:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<atZvqbtFrr4IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 12:19:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<tjHiqbtFhoPD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-12 12:20:02 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (erreg) [78.66.119.139]:47512: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.189.152.228
country_id: 337996
description:
Dec 12 12:21:42 host2 pure-ftpd[440905]: (?@196.189.152.228) [INFO] New connection from 196.189.152.228


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.152.228
country_id: 337996
description:
Dec 12 12:21:43 host2 sshd[440904]: Invalid user shamila@epid.gov.lk from 196.189.152.228 port 10430


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 196.189.152.228
country_id: 337996
description:
Dec 12 12:21:48 host2 pure-ftpd[440905]: (?@196.189.152.228) [WARNING] Authentication failed for user [shamila@epid.gov.lk]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-12 12:22:56 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:60929: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2025-12-12 12:23:39 dovecot_login authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:51004: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-12 12:23:24 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:36885: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.100.204.180
country_id: 2661886
description:
2025-12-12 12:23:32 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:45192: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.189.152.228
country_id: 337996
description:
Dec 12 12:25:12 host2 dovecot[3988696]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=196.189.152.228, lip=66.85.158.91, TLS handshaking, session=<NPcuvrtF5SjEvZjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-12 12:25:39 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:49434: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-12 12:26:22 dovecot_login authenticator failed for (88.255.189.21.static.ttnet.com.tr) [88.255.189.21]:49220: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-12 12:27:05 dovecot_plain authenticator failed for (suped) [102.53.15.17]:40086: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-12 12:27:09 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (lenymed) [73.176.157.57]:58924: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-12-12 12:27:53 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:61234: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.61
country_id: 6252001
description:
2025-12-12 12:28:00 dovecot_login authenticator failed for ([98.185.120.61]) [98.185.120.61]:50961: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 12:28:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<pRMmyrtFdKNntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-12 12:28:16 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:60964: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-12-12 12:28:15 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:56392: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.184
country_id: 6252001
description:
Dec 12 12:29:28 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UQ5zzbtFntzG6xi4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-12 12:30:48 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (chboolan) [66.177.30.53]:50556: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 12:31:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Ew6C07tFIL6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 12:31:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<U2UA1btFrOanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 12:33:58 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:42955: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-12 12:34:27 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:40484: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-12 12:34:38 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (pureggia) [98.227.25.115]:35754: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-12 12:34:54 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:41932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 12:35:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<PyFQ4btF/ukv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.252
country_id: 2510769
description:
2025-12-12 12:35:12 dovecot_login authenticator failed for (109-69-15-252.puntdacces.coop) [109.69.15.252]:42973: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 12:35:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<dn5m4rtF1q28pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 12:36:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<i4iw5LtFApYI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.211
country_id: 6252001
description:
Dec 12 12:36:29 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.211, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fJSU5rtFGNfG6xjT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 12:36:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<+PsO6LtF3Nk+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-12 12:38:48 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:41447: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 12:39:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<gbFG8LtFbpXAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.16.88
country_id: 2661886
description:
2025-12-12 12:39:20 dovecot_login authenticator failed for a088.broadband.quicknet.se [217.78.16.88]:55046: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 12:39:29 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:55822: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 12:39:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<jHVY8btFGOGl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-12 12:39:48 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:33473: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-12 12:39:13 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (supip) [98.192.74.183]:36052: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 12:40:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<tBo29rtF5JjCBa8Y>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.161.244
country_id: 1227603
description:
[2025-12-12 12:41:59 +0530] info [whostmgrd] 112.134.161.244 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 12:43:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<Sk69/rtFSM+LOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.233
country_id: 6252001
description:
2025-12-12 12:44:25 dovecot_login authenticator failed for wsip-184-191-242-233.fv.ks.cox.net [184.191.242.233]:39839: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-12 12:44:41 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (nodual) [174.161.27.82]:38433: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-12-12 12:44:44 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:47662: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-12 12:45:37 dovecot_plain authenticator failed for (preher) [192.34.128.202]:43890: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.183
country_id: 3175395
description:
Dec 12 12:48:21 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.15.171.183, lip=66.85.158.91, TLS, session=</gr+D7xFFKW5D6u3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-12 12:48:34 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:47156: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.111
country_id: 690791
description:
Dec 12 12:48:39 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.17.125.111, lip=66.85.158.91, TLS, session=<+fcWEbxFb5i5EX1v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-12 12:48:50 dovecot_login authenticator failed for ([27.123.105.41]) [182.95.52.206]:34476: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 12:49:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<kRiqFLxFUuakXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.88.255
country_id: 1269750
description:
2025-12-12 12:49:54 dovecot_plain authenticator failed for (V4836VC8A) [152.59.88.255]:63855: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 12:49:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<uidoFrxFakF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.114.35
country_id: 1269750
description:
2025-12-12 12:50:59 dovecot_plain authenticator failed for (pling) [103.69.114.35]:53364: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-12 12:50:22 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (senamiant) [73.0.191.33]:48064: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 12:50:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<kZnSGLxF3tdAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 12:51:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<AvgJG7xFWo4I3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2025-12-12 12:51:24 dovecot_plain authenticator failed for dsl540122f2.fixip.t-online.hu (unplortion) [84.1.34.242]:45058: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 12:51:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<CQEEHLxFTtpnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 12:51:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<IGY9HbxF2tE+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-12 12:52:43 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (triol) [68.52.119.193]:51086: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 12:53:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<TjwOIrxFct7O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-12-12 12:54:00 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:36748: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-12 12:54:11 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:26452: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.22
country_id: 6252001
description:
2025-12-12 12:53:24 dovecot_login authenticator failed for ([98.185.120.22]) [98.185.120.22]:44321: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 12:54:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<5zopKLxF1sWH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-12 12:54:57 dovecot_login authenticator failed for ([12.150.243.20]) [12.150.243.22]:36206: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2025-12-12 12:54:59 dovecot_login authenticator failed for ([122.186.230.25]) [125.19.161.150]:60794: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-12 12:55:03 dovecot_plain authenticator failed for (hirrhael) [23.30.11.253]:50482: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2025-12-12 12:55:06 dovecot_plain authenticator failed for c-98-195-138-52.hsd1.tx.comcast.net (marter) [98.195.138.52]:47962: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-12 12:55:08 dovecot_login authenticator failed for ([89.140.17.22]) [81.0.54.119]:39658: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 12:56:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<dWg3L7xFYtsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 12:57:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<FV1XMLxFrXxetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 12:58:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<uPH8M7xFPI0+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-12 12:58:20 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:57251: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 12:58:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<K9BuNbxFOrdm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-12 12:59:25 dovecot_login authenticator failed for 16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:44901: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-12-12 12:59:37 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:46316: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-12 12:58:57 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:45120: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-12 12:59:05 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (sestion) [69.142.126.37]:56226: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 12 13:00:24 host2 sshd[473591]: Disconnected from invalid user adminuser 81.215.228.18 port 58552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-12 13:00:32 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:56812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 13:00:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<DfyIPbxFSsIuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 13:01:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<yI1JPrxFmt6kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 12 13:01:12 host2 sshd[473897]: Disconnected from invalid user prova 81.215.228.18 port 45094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-12 13:00:46 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:37109: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-12 13:02:39 dovecot_plain authenticator failed for (ackes) [65.20.233.110]:39756: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Dec 12 13:02:20 host2 sshd[474364]: Disconnected from invalid user vr 81.215.228.18 port 42292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 13:03:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<OTiQRbxF/JQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 13:03:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<X1lNRrxFVtsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 13:02:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<dg25RLxFqJuKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-12 13:04:31 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:49352: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-12-12 13:04:45 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:50294: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.14.194.128
country_id: 3017382
description:
[2025-12-12 13:04:57 +0530] info [cpaneld] 45.14.194.128 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 13:05:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<KnjjTLxFopHD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-12 13:07:39 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:49594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-12 13:07:54 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:43312: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.14
country_id: 1733045
description:
2025-12-12 13:10:03 dovecot_login authenticator failed for ([49.124.153.14]) [49.124.153.14]:34088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 13:10:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<TCxnYLxFtJrD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-12 13:09:43 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:52705: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 13:09:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<m2HJXbxFaoWB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 13:12:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<B/P8ZbxFkMYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 13:12:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<77bzaLxFgIW8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 13:13:44 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:37150: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2025-12-12 13:14:02 dovecot_login authenticator failed for (cm-84.213.187.240.get.no) [84.213.187.240]:32997: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 13:15:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<7cBRcLxFgLMro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-12-12 13:14:48 dovecot_plain authenticator failed for (irings) [5.32.107.6]:59737: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 13:17:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<37IGeLxF1N+G0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2025-12-12 13:18:36 dovecot_login authenticator failed for (abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:9310: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-12 13:19:06 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:56554: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-12 13:18:44 dovecot_login authenticator failed for (cm-84.213.190.55.get.no) [84.213.190.55]:39139: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-12 13:18:53 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:54652: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-12 13:20:32 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:39727: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 13:19:42 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (acism) [174.169.224.27]:46662: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 13:22:10 host2 sshd[489424]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 13:21:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<p1KNiLxFeJIIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-12 13:21:43 dovecot_plain authenticator failed for (poscu) [24.105.248.218]:40630: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 13:23:56 host2 sshd[490635]: Disconnected from invalid user  62.60.131.157 port 12358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 13:24:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<ybcUkbxFbpZntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-12 13:24:23 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:64256: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-12 13:25:14 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:58553: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 12 13:25:20 host2 sshd[491978]: Disconnected from invalid user ubuntu 162.240.156.34 port 48420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-12 13:24:46 dovecot_login authenticator failed for ([84.210.192.240]) [84.210.192.240]:41324: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-12 13:24:47 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:35240: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-12 13:26:13 dovecot_login authenticator failed for 40-54-166-83.dyn.estpak.ee [83.166.54.40]:36375: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 12 13:26:20 host2 sshd[492623]: Disconnected from invalid user khalid 118.193.43.167 port 26684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 12 13:26:32 host2 sshd[492746]: Disconnected from invalid user user002 162.240.156.34 port 48444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-12 13:25:47 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:53222: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 12 13:25:57 host2 sshd[492327]: Disconnected from invalid user scan 162.240.156.34 port 34316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 12 13:27:46 host2 sshd[493441]: Disconnected from invalid user ubuntu 162.240.156.34 port 48484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 12 13:28:06 host2 sshd[493658]: Disconnected from invalid user amir 118.193.43.167 port 64078 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 13:28:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<fIGEoLxFFtmWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 12 13:29:19 host2 sshd[494254]: Disconnected from invalid user tester 118.193.43.167 port 25030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 13:29:39 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53875: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 13:29:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<SGUppbxFap5o1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 13:30:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<JbvIp7xFYqYv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-12 13:31:38 dovecot_plain authenticator failed for (pantrify) [176.113.155.132]:52355: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-12 13:31:34 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (oustable) [71.62.34.216]:34834: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 13:31:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<aN+Fq7xFGt8I3tq7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 12 13:31:42 host2 sshd[496450]: Disconnected from invalid user stperez 118.193.43.167 port 10916 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 13:33:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<zornsbxFms/AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-12 13:35:04 dovecot_login authenticator failed for ([149.232.203.22]) [149.232.203.22]:37146: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2025-12-12 13:35:19 dovecot_login authenticator failed for ([103.111.6.121]) [103.111.6.121]:55098: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 13:35:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<zVDuuLxFKp/CBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 13:35:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<QiPlurxFro68pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 13:36:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<XwgpvLxFpOal6L5h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 12 13:36:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<bQvJvbxFDrSLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 13:37:43 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:42002: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 13:39:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<MocIx7xFrrI+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2025-12-12 13:39:44 dovecot_login authenticator failed for ([128.185.219.54]) [128.185.219.54]:48820: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 13:40:25 host2 sshd[501945]: Disconnected from invalid user admin 2.57.121.112 port 39378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 13:41:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<4oORzrxFtLWkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 13:42:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<3+oG0rxFoKlAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-12 13:44:24 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:33294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-12 13:44:53 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:44316: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-12 13:45:25 dovecot_login authenticator failed for ([125.23.229.42]) [182.78.64.150]:59084: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 13:45:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<exd03bxFrIQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 13:44:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jlLd2rxF52F100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-12 13:44:52 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:49948: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-12 13:45:43 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:50590: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 13:46:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<xJ914rxFBOrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 13:47:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<qDB15bxFerRnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 13:49:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<HYNC67xFrLw+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-12 13:50:22 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (adetes) [73.161.96.107]:51816: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-12 13:50:26 dovecot_plain authenticator failed for (hiolous) [65.20.160.107]:46767: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 13:50:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<TELf7bxFzVxetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-12 13:50:13 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:57813: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 13:50:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<zTIM7rxFuKBm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-12 13:51:13 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:36772: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-12 13:51:32 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:55912: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-12 13:50:43 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:50342: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 13:50:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<7zpo8LxFwqukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 13:52:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<7bRU97xFuNguZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 13:53:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4IZI+LxFQLI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.102
country_id: 2750405
description:
2025-12-12 13:53:31 dovecot_login authenticator failed for (0PLYbCnjCJ) [45.80.158.102]:51306: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-12 13:53:34 dovecot_plain authenticator failed for (ertic) [102.53.15.18]:47817: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 13:53:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<eHmI+7xFMrTD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 13:54:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<XKLs+7xF4qeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-12 13:54:09 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (stels) [24.127.53.61]:39054: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-12 13:54:57 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (pularga) [174.58.87.108]:48432: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 13:55:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<6PHj/7xFEsUvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.102
country_id: 2750405
description:
2025-12-12 13:55:29 dovecot_login authenticator failed for (0kRR7xGbnA) [45.80.158.102]:57738: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-12 13:55:32 dovecot_plain authenticator failed for (semichs) [91.73.195.150]:36498: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-12 13:55:38 dovecot_plain authenticator failed for (unous) [185.214.169.10]:51274: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 13:54:48 host2 sshd[512327]: Disconnected from invalid user user 2.57.121.25 port 34986 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 13:55:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Jh0BAr1FDomH6yFP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.91
country_id: 2635167
description:
Dec 12 13:56:48 host2 pure-ftpd[513916]: (?@185.247.137.91) [INFO] New connection from 185.247.137.91


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 13:59:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=</3a5Db1FUI7D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-12 14:00:39 dovecot_plain authenticator failed for (ditess) [94.206.93.90]:60404: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.229.72.68
country_id: 1605651
description:
Dec 12 14:01:26 host2 sshd[516834]: Disconnected from invalid user admin 49.229.72.68 port 34892 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-12 14:01:32 dovecot_plain authenticator failed for (eysiesish) [65.20.205.197]:59244: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 14:00:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<W+JxFL1FgrcImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-12 14:01:05 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:33502: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 14:01:21 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:36854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.23.122.235
country_id: 895949
description:
Dec 12 14:02:15 host2 sshd[517324]: Disconnected from invalid user ubuntu 102.23.122.235 port 11165 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.255.1.48
country_id: 2750405
description:
Dec 12 14:02:18 host2 sshd[517372]: Disconnected from invalid user admin 156.255.1.48 port 32938 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 12 14:02:54 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS, session=<NkaXG71FlsBChJlx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 14:03:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<oE7aG71FvsKB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 14:03:10 host2 sshd[518135]: Disconnected from invalid user  62.60.131.157 port 13637 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 14:03:34 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (shobads) [24.15.216.41]:33266: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 14:03:58 host2 sshd[518822]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.145
country_id: 298795
description:
Dec 12 14:04:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=95.0.171.145, lip=66.85.158.91, TLS, session=<5qTUIL1Fp7dfAKuR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 12 14:03:45 host2 sshd[518623]: Disconnected from invalid user gituser 51.91.252.38 port 59972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.68
country_id: 953987
description:
Dec 12 14:04:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=102.64.43.68, lip=66.85.158.91, TLS, session=<GsqGH71F6Z9mQCtE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-12 14:04:22 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:35100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.191.118
country_id: 3144096
description:
2025-12-12 14:04:34 dovecot_login authenticator failed for (cm-178.232.191.118.get.no) [178.232.191.118]:57755: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 12 14:05:23 host2 sshd[519894]: Disconnected from invalid user ftpuser2 51.91.252.38 port 41586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Dec 12 14:06:16 host2 sshd[520539]: Disconnected from invalid user ubuntu 95.0.252.5 port 49066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 12 14:06:27 host2 sshd[520657]: Disconnected from invalid user arash 51.91.252.38 port 33624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:06:37 host2 sshd[520774]: Disconnected from invalid user eprints 98.142.247.121 port 37816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Dec 12 14:07:29 host2 sshd[521330]: Disconnected from invalid user dev 95.0.252.5 port 46402 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 14:07:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<kQCQKr1FGsoro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 14:07:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<DTqfK71FYNu8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 12 14:07:28 host2 sshd[521325]: Disconnected from invalid user tsserver 51.91.252.38 port 51426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.255.1.48
country_id: 2750405
description:
Dec 12 14:07:46 host2 sshd[521576]: Disconnected from invalid user user1 156.255.1.48 port 38358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.23.122.235
country_id: 895949
description:
Dec 12 14:08:39 host2 sshd[522062]: Disconnected from invalid user scpuser 102.23.122.235 port 11168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:08:47 host2 sshd[522134]: Disconnected from invalid user root1 98.142.247.121 port 57898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-12 14:09:29 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:42874: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 14:09:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<cRWkM71FsL+nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-12-12 14:10:16 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:35978: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-12 14:10:36 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:58334: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-12 14:11:20 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:46365: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:11:28 host2 sshd[524373]: Received disconnect from 98.142.247.121 port 48198:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:10:56 host2 sshd[523995]: Disconnected from invalid user gituser 98.142.247.121 port 54964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.121
country_id: 6252001
description:
Dec 12 14:11:58 host2 sshd[524643]: Disconnected from invalid user pivpn 98.142.247.121 port 34564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.255.1.48
country_id: 2750405
description:
Dec 12 14:12:33 host2 sshd[524914]: Disconnected from invalid user prakash 156.255.1.48 port 39298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 14:13:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<gRNrQL1FzIs+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 14:13:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<X1fGQr1FXN6G0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 14:14:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<nw7pQ71FLJo+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-12 14:14:28 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:35202: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-12 14:15:02 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:36753: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:15:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<LlF2R71FwtYDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 14:14:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<a311Rr1F4Mxntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-12 14:15:42 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:51548: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:16:02 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<teuVSr1FjIsDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-12 14:16:17 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:35486: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.80.200.216
country_id: 6252001
description:
Dec 12 14:17:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.80.200.216, lip=66.85.158.92, session=<XPooT71F/uUoUMjY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:17:51 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<rmAYUb1FFrgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:18:44 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<u5tAVL1FLKADgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 14:19:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<kx9mVr1FKM8IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.179
country_id: 3175395
description:
Dec 12 14:20:15 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=185.197.8.179, lip=66.85.158.91, TLS, session=<A9yaWL1FL9O5xQiz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:20:18 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<WuvQWb1FQokDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.160
country_id: 6290252
description:
Dec 12 14:19:56 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=109.207.35.160, lip=66.85.158.91, TLS, session=<deuIV71FL+ptzyOg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:21:18 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<LINoXb1F2IEDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:21:35 host2 dovecot[3988696]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0oxrXr1FSrgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 14:21:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<wN9XXr1F1sOWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:22:15 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<1+zOYL1F3uQDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:22:30 host2 dovecot[3988696]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<DgWyYb1F0JkDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 14:23:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<7yjLY71F3LaLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 14:23:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<2pMwZb1FlJXAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 14:23:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<cfZUY71FpMwv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:22:58 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<KlphY71FQocDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 14:24:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<O7h1Z71FdtYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 14:24:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<Wz3BZ71FhqUI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.162.246
country_id: 6252001
description:
Dec 12 14:24:25 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=130.131.162.246, lip=66.85.158.91, session=<OWCHaL1F3t+Cg6L2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 12 14:23:51 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<yOeLZr1FHIgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 14:25:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<OOcLbL1F/IuB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 14:25:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<tkkNbb1FANg+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-12 14:26:12 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:51889: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-12 14:26:26 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:44934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 14:26:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<3GyUcL1FIrrCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 14:27:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<7yj3cr1FoNG8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 14:28:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<9Nw4eL1FmKul6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-12 14:29:18 dovecot_plain authenticator failed for (lyctic) [65.20.184.80]:40280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-12 14:30:00 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (prappode) [98.40.101.10]:41922: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-12 14:30:15 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:54678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.20
country_id: 3175395
description:
Dec 12 14:30:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.26.178.20, lip=66.85.158.91, TLS, session=<WJ2afL1F0MnZGrIU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.174.73.235
country_id: 798544
description:
Dec 12 14:30:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.174.73.235, lip=66.85.158.91, TLS, session=<Bii+fb1Fa+kurknr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.49
country_id: 1733045
description:
2025-12-12 14:29:54 dovecot_login authenticator failed for ([49.124.151.49]) [49.124.151.49]:55976: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 14:31:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<q1v+f71F6MOkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 14:32:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Vlj8hL1F1LJAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.0
country_id: 3469034
description:
Dec 12 14:32:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.249.0, lip=66.85.158.91, TLS, session=<4U6ehL1FPdy60fkA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.174.40
country_id: 99237
description:
Dec 12 14:32:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=65.20.174.40, lip=66.85.158.91, TLS, session=<R+rshb1FoopBFK4o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 12 14:33:24 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rOWuiL1FOn1ChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-12 14:35:11 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:32946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-12 14:35:14 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:54539: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-12 14:35:23 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:38203: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-12 14:35:38 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:33632: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-12-12 14:34:51 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:44098: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.215
country_id: 3996063
description:
2025-12-12 14:35:41 dovecot_login authenticator failed for ([177.236.145.215]) [177.236.145.215]:53186: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-12 14:36:34 dovecot_login authenticator failed for ([128.185.201.138]) [128.185.201.138]:46188: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-12 14:36:53 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [125.17.124.75]:57392: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.217
country_id: 99237
description:
2025-12-12 14:37:59 dovecot_plain authenticator failed for (reited) [65.20.237.217]:43437: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 14:38:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2N4gm71FD8F100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 14:39:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<sv48nb1FXt0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 14:39:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=</se0nb1F5IMI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.173.36
country_id: 3469034
description:
2025-12-12 14:39:27 dovecot_plain authenticator failed for ([89.116.164.85]) [177.74.173.36]:2063: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 14:39:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<QWW4nr1FzuzO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 14:40:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<SPSAoL1FLNJm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.21.206.145
country_id: 3865483
description:
2025-12-12 14:40:18 dovecot_plain authenticator failed for ([89.116.164.85]) [181.21.206.145]:48922: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.193.212
country_id: 1694008
description:
2025-12-12 14:40:31 dovecot_plain authenticator failed for ([89.116.164.85]) [103.183.193.212]:58398: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 14:40:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<7Gkmor1F3uekXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.17.174.99
country_id: 3437598
description:
2025-12-12 14:39:45 dovecot_plain authenticator failed for ([89.116.164.85]) [186.17.174.99]:42082: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.92.217.41
country_id: 3865483
description:
2025-12-12 14:40:00 dovecot_plain authenticator failed for ([89.116.164.85]) [181.92.217.41]:43208: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.87.91.29
country_id: 3865483
description:
2025-12-12 14:40:04 dovecot_plain authenticator failed for ([89.116.164.85]) [181.87.91.29]:45868: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 14:41:27 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (overilis) [87.103.126.54]:12623: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 14:42:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<YlSlqL1FSr9npBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 14:42:24 host2 sshd[545940]: Disconnected from invalid user user 2.57.121.25 port 21636 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-12 14:42:29 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:58730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 14:42:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<8RlHqb1F35detwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-12 14:41:45 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:40546: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-12 14:42:10 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:34698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 14:43:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<rnxsrL1F8ObD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 14:43:47 dovecot_plain authenticator failed for (multe) [65.20.164.137]:49033: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2025-12-12 14:44:24 dovecot_login authenticator failed for ([49.124.146.34]) [49.124.146.34]:48374: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 14:44:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<knbkr71FBIUuZXpm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-12 14:44:41 +0530] info [cpaneld] 89.249.55.106 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-12 14:45:03 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:57856: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 14:45:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<xL1esr1FtK2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-12 14:45:32 dovecot_login authenticator failed for ([135.13.8.246]) [74.224.215.23]:9783: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-12 14:44:43 +0530] info [cpaneld] 89.249.55.106 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-12 14:46:03 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:38392: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 14:46:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<SrHZuL1FppQ+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 14:47:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<jG/wur1FqtMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 14:48:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=</CzHv71FsK7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 14:50:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<xLZHxb1FtIGH6yFP>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.73
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.73: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-12 14:52:01 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:50453: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-12 14:52:20 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (queuding) [73.88.196.91]:49414: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-12 14:52:26 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:55220: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-12 14:52:30 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (cohently) [93.145.118.40]:36638: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 12 14:54:16 host2 pure-ftpd[555819]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-12-12 14:54:39 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:37546: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-12 14:55:39 dovecot_plain authenticator failed for (berding) [91.73.195.150]:56021: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-12 14:56:09 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:35462: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-12 14:56:52 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57374: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-12 14:57:34 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (muticah) [73.13.220.220]:41134: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 14:57:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<cdmq371Fpp6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 15:00:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<utJA6L1FRtwImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 15:00:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<Cqdi6L1FtJUro2np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.10
country_id: 2921044
description:
Dec 12 15:00:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 7 secs): user=<>, rip=57.129.64.10, lip=66.85.158.91, TLS: Connection closed, session=<h0vK6b1FTY45gUAK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 15:01:05 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:44740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-12 15:01:17 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:49619: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-12 15:01:21 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54095: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-12 15:01:23 dovecot_plain authenticator failed for (spables) [24.93.140.162]:40553: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-12 15:01:34 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:39482: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-12-12 15:02:26 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:46882: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 12 15:02:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<fKe/8L1FkufBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2025-12-12 15:02:34 dovecot_login authenticator failed for ([198.8.94.171]) [181.177.9.119]:38334: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 15:02:55 dovecot_login authenticator failed for ([62.97.161.137]) [178.232.153.27]:50093: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 12 15:03:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<ZgvI8r1F1tPCw3NV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 15:03:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<xdiW871Fnoa8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:05:50 host2 sshd[564518]: Disconnected from invalid user ubuntu 174.136.203.212 port 52366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:07:30 host2 sshd[565734]: Disconnected from invalid user satya 103.13.207.125 port 47028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-12 15:07:37 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12085: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:07:00 host2 sshd[565382]: Disconnected from invalid user ruan 174.136.203.212 port 39844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:07:19 host2 sshd[565624]: Disconnected from invalid user zk 159.223.45.112 port 36702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:07:45 host2 sshd[565862]: Disconnected from invalid user dc 206.238.40.232 port 35490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:07:52 host2 sshd[565938]: Disconnected from invalid user tester 68.218.72.173 port 54642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-12 15:08:04 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:38799: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-12 15:08:26 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:57426: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:09:40 host2 sshd[567203]: Disconnected from invalid user support 174.136.203.212 port 60922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 15:09:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<e8jXB75FOpNntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:09:24 host2 sshd[567067]: Disconnected from invalid user gaurav 68.218.72.173 port 60198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:09:36 host2 sshd[567159]: Disconnected from invalid user testuser 51.178.43.161 port 53928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.166
country_id: 1269750
description:
2025-12-12 15:09:19 dovecot_login authenticator failed for (nsg-corporate-73.182.187.122.airtel.in) [182.95.178.166]:43646: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 12 15:09:30 host2 sshd[567106]: Disconnected from invalid user minerhub 165.154.205.128 port 41096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 15:08:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<KvL0Br5FVrNo1joy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:10:09 host2 sshd[567643]: Disconnected from invalid user test1 51.178.43.161 port 38198 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 12 15:09:58 host2 pure-ftpd[567384]: (?@66.132.153.115) [INFO] New connection from 66.132.153.115


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:10:11 host2 sshd[567692]: Disconnected from invalid user ubuntu 68.218.72.173 port 36106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Dec 12 15:10:38 host2 sshd[567987]: Disconnected from invalid user test 119.246.15.94 port 37868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:09:47 host2 sshd[567270]: Disconnected from invalid user marco 103.13.207.125 port 46002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:09:52 host2 sshd[567327]: Disconnected from invalid user sean 206.238.40.232 port 57552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:09:54 host2 sshd[567352]: Disconnected from invalid user ccorrea 159.223.45.112 port 44192 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:10:49 host2 sshd[568106]: Received disconnect from 174.136.203.212 port 55002:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:10:56 host2 sshd[568172]: Disconnected from invalid user test 68.218.72.173 port 47176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:11:11 host2 sshd[568444]: Disconnected from invalid user x 51.178.43.161 port 34974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:11:22 host2 sshd[568663]: Disconnected from invalid user ubuntu 206.238.40.232 port 37880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:10:49 host2 sshd[568106]: Disconnected from invalid user yf 174.136.203.212 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:11:14 host2 sshd[568525]: Disconnected from invalid user gaurav 159.223.45.112 port 39000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:12:12 host2 sshd[569484]: Disconnected from invalid user ubuntu 103.13.207.125 port 47712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 12 15:12:24 host2 sshd[569638]: Disconnected from invalid user vlad 165.154.205.128 port 51636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:12:30 host2 sshd[569705]: Disconnected from invalid user nabi 68.218.72.173 port 56206 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 12 15:12:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.168, lip=66.85.158.91, TLS, session=<RNDAEr5FFv/N0h+o>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 15:13:18 host2 sshd[570516]: Disconnected from invalid user user 2.57.121.25 port 27582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:14:03 host2 sshd[571491]: Disconnected from invalid user user 172.208.24.217 port 18054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:14:39 host2 sshd[572122]: Disconnected from invalid user sdtdserver 172.208.24.217 port 45890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Dec 12 15:15:00 host2 sshd[572399]: Disconnected from invalid user ubuntu 119.246.15.94 port 43535 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-12 15:15:45 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:60720: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 15:15:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<rZsCIL5FkMrAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 12 15:16:04 host2 sshd[573499]: Disconnected from invalid user usuario 197.211.55.20 port 53844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-12 15:16:07 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (breron) [98.204.134.124]:45992: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:15:15 host2 sshd[572751]: Disconnected from invalid user sysadmin 172.208.24.217 port 18088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 15:16:23 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:34860: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 12 15:17:27 host2 sshd[574821]: Disconnected from invalid user botuser 197.211.55.20 port 41166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-12-12 15:17:53 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:48096: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:17:30 host2 sshd[574872]: Disconnected from invalid user demo1 138.197.123.123 port 40602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:17:42 host2 sshd[574978]: Disconnected from invalid user mas 36.91.81.195 port 35888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 15:18:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<JqEiKL5FKt2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 15:18:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<O4V9KL5FsIgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-12 15:18:38 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:58625: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 15:20:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<R9vnL75F8rsI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:19:15 host2 sshd[576146]: Disconnected from invalid user demo 187.16.96.250 port 45646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.246
country_id: 6252001
description:
Dec 12 15:19:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.169.104.246, lip=66.85.158.92, session=<iQ2bLb5FFs8UqWj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 15:19:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<ZlKwLb5F4uq8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 15:20:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<L6c8L75FAJ0IgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:20:10 host2 sshd[577120]: Disconnected from invalid user nas 36.91.81.195 port 56184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.73
country_id: 6252001
description:
Dec 12 15:21:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.73, lip=66.85.158.91, session=<ThpFM75FK4Fb5qhJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 15:21:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<Znh4M75FSoaB4gum>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:20:16 host2 sshd[577228]: Received disconnect from 138.197.123.123 port 43026:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:20:49 host2 sshd[577707]: Disconnected from invalid user ubuntu 36.91.81.195 port 40090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 15:20:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<53Y9Mr5FCoXCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-12 15:22:10 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:47789: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.172
country_id: 6252001
description:
Dec 12 15:21:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.172, lip=66.85.158.91, session=<8SbvM75FZ69b5qis>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.175
country_id: 6252001
description:
Dec 12 15:21:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.175, lip=66.85.158.91, session=<fdV7NL5Fb+Zb5qiv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-12 15:21:47 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:47989: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 15:21:53 host2 sshd[578555]: Disconnected from invalid user  62.60.131.157 port 22660 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.168
country_id: 6252001
description:
Dec 12 15:21:23 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.168, lip=66.85.158.91, session=<odlMNL5FB8Vb5qio>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:21:44 host2 sshd[578422]: Disconnected from invalid user forward 187.16.96.250 port 48776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 15:23:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=</p2SOr5FYsyl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:22:21 host2 sshd[578863]: Disconnected from invalid user user 187.16.96.250 port 46940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:22:23 host2 sshd[578890]: Disconnected from invalid user botuser 138.197.123.123 port 43474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 15:23:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<+w38Ob5F4NSkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 15:23:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<p3e4Or5FLqI+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:23:32 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Z3/7O75FOJoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:24:28 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BNtTP75FiI4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 15:24:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<hMa/P75F+tlAF6S9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:24:19 host2 sshd[580294]: Disconnected from invalid user newroot 187.16.96.250 port 41744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:25:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Qca0Q75FGtIDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-12 15:27:05 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:43076: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 15:27:07 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:6287: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.204.227
country_id: 3469034
description:
Dec 12 15:28:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=177.93.204.227, lip=66.85.158.91, TLS, session=<21t/S75FOsqxXczj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:27:33 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<ZQpXSr5F2NYDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-12 15:27:33 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:59844: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-12 15:27:37 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:37200: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.141
country_id: 3865483
description:
Dec 12 15:27:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.90.141, lip=66.85.158.91, TLS, session=<DRcuSr5FspK+tVqN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-12 15:28:13 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:34891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:28:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A0MRTb5F+O0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-12 15:28:25 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:50538: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:31:06 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<1goMV75FoMYDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 15:31:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mR1XV75FIJlm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-12 15:32:02 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:58006: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 15:32:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<kOAsWr5FIIOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.168
country_id: 3996063
description:
2025-12-12 15:32:20 dovecot_login authenticator failed for ([177.236.146.168]) [177.236.146.168]:32844: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-12 15:32:51 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:35830: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 15:32:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<dbNdXb5FbuA+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-12 15:33:06 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:37616: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-12 15:34:03 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:49382: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 15:34:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4nmFYb5FmM7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 15:33:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<zHmsYL5F5KfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 15:35:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<0asXZr5FWKEI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 15:36:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<VXeJab5FULd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 15:36:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<j8xOar5FEbtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 15:36:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<u5bPar5Fit6KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 15:37:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<FB87br5F+pQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-12 15:37:23 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (hamorksts) [37.150.8.174]:46749: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 15:38:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<c9CJcb5FkIJnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 15:41:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<kyX2e75FCDEvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-12 15:42:27 dovecot_plain authenticator failed for (eambrack) [24.187.213.29]:47600: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-12 15:43:12 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:37572: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-12 15:43:32 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:45099: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 15:46:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<lCuMjL5FhKeH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-12 15:47:11 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:40594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 15:47:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<NdGGkr5FSqanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.150
country_id: 6252001
description:
2025-12-12 15:47:55 dovecot_login authenticator failed for ([70.174.167.150]) [70.174.167.150]:38669: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 15:49:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<EptimL5F3Kk+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-12 15:52:02 dovecot_login authenticator failed for ([203.193.147.41]) [203.193.147.37]:50929: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 15:53:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<z5pBpb5FJsYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-12-12 15:52:17 dovecot_login authenticator failed for ([149.54.51.162]) [149.54.51.162]:53206: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-12 15:52:23 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:50912: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-12 15:52:42 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:34017: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-12 15:53:17 dovecot_login authenticator failed for ([121.73.163.186]) [121.73.163.186]:51492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 15:53:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Anzspr5FLLCB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-12 15:53:39 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:45310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 15:54:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+AZVqb5FsuQv/lVz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 15:54:38 host2 sshd[606214]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-12-12 15:55:59 dovecot_login authenticator failed for ([2.55.88.51]) [2.55.88.51]:41892: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.6
country_id: 1733045
description:
2025-12-12 15:56:19 dovecot_login authenticator failed for ([49.124.151.6]) [49.124.151.6]:48536: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-12 15:57:59 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:46285: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-12 15:58:20 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:59035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 15:58:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ykZ1ur5F4oa8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-12 15:59:13 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:59330: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-12 15:59:34 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:50781: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.77
country_id: 3175395
description:
Dec 12 15:59:49 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=217.26.179.77, lip=66.85.158.91, TLS, session=<q8KJvL5FFLzZGrNN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 16:01:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<Z1pjwr5FSLsImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.142
country_id: 933860
description:
Dec 12 16:00:15 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=41.216.215.142, lip=66.85.158.91, TLS, session=<IKPovb5FyYwp2NeO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 16:00:39 host2 sshd[624145]: Disconnected from invalid user  62.60.131.157 port 38372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 16:01:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<hm92xL5FmrM+PIMh>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.135
country_id: 6252001
description:
Dec 12 16:02:14 host2 pure-ftpd[625371]: (?@135.237.126.135) [INFO] New connection from 135.237.126.135


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 16:02:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<UmIFyL5FuORntrtb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec 12 16:02:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS: Connection closed, session=<++uRyL5FQDdChJl3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 16:03:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<q5zjyb5F6I6LOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 16:03:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<5p/zyr5FQO4+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 12 16:03:51 host2 sshd[626934]: Disconnected from invalid user test 20.203.42.204 port 47212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.229.200.110
country_id: 298795
description:
2025-12-12 16:04:39 dovecot_plain authenticator failed for (bidess) [5.229.200.110]:54921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 12 16:06:32 host2 sshd[628815]: Disconnected from invalid user nexus 38.47.94.55 port 50670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-12 16:07:02 dovecot_plain authenticator failed for (bilomy) [65.20.129.28]:37437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-12 16:07:13 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:49270: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:07:43 host2 sshd[629697]: Disconnected from invalid user admin 172.188.75.98 port 44150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-12 16:08:01 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:41354: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.202.233
country_id: 6251999
description:
Dec 12 16:08:07 host2 pure-ftpd[629996]: (?@128.203.202.233) [INFO] New connection from 128.203.202.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.250
country_id: 1733045
description:
2025-12-12 16:09:12 dovecot_login authenticator failed for ([49.124.152.250]) [49.124.152.250]:41972: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:08:26 host2 sshd[630161]: Disconnected from invalid user analytics 172.188.75.98 port 50304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 16:08:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<9j33275F9JHAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 16:09:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<u2Ue375F7Ogv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-12 16:08:16 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:47184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 16:10:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<zj3h4r5F4MyG0Wp/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 12 16:10:21 host2 sshd[631510]: Disconnected from invalid user mini 38.47.94.55 port 37806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:10:38 host2 sshd[631655]: Disconnected from invalid user frappe 172.188.75.98 port 33184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 16:11:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<srJ45r5FBoy8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:11:19 host2 sshd[632019]: Disconnected from invalid user Oracle 172.188.75.98 port 46698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 16:11:48 host2 sshd[632185]: Disconnected from invalid user admin 2.57.121.112 port 53162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-12 16:12:16 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:42870: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 16:12:23 dovecot_plain authenticator failed for (parpradrus) [65.20.164.137]:37372: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-12 16:12:35 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:46604: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 16:12:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<TqoH7L5F1LEv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 12 16:13:05 host2 sshd[632811]: Disconnected from invalid user zvc 20.203.42.204 port 56660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 16:14:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<0gvD8b5FBteWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 16:14:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Yss/8r5FaN3CBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 16:14:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<uZqQ875FkugI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 16:15:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<MJKA9L5FSNCkXGTY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Dec 12 16:15:06 host2 sshd[634014]: Disconnected from invalid user user 20.203.42.204 port 37574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-12 16:15:10 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (ratom) [67.172.54.29]:54758: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.15.18.19
country_id: 3469034
description:
Dec 12 16:15:29 host2 sshd[634279]: Disconnected from invalid user elemental 200.15.18.19 port 43958 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 16:16:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<FeGt+b5Ffp1AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-12 16:18:07 dovecot_login authenticator failed for ([125.19.218.50]) [125.19.218.50]:35012: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-12 16:17:23 dovecot_login authenticator failed for (aes-static-105.28.22.125.airtel.in) [182.95.228.22]:49864: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-12 16:17:37 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:50664: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-12 16:17:37 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:56285: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.15.18.19
country_id: 3469034
description:
Dec 12 16:17:39 host2 sshd[636304]: Disconnected from invalid user ftpuser 200.15.18.19 port 54232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-12 16:17:50 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:56642: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 16:17:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<G4xY/r5FJJWl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-12 16:19:01 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:58120: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.113
country_id: 6252001
description:
2025-12-12 16:18:24 dovecot_login authenticator failed for wsip-184-191-250-113.fv.ks.cox.net [184.191.250.113]:53773: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.44
country_id: 6252001
description:
2025-12-12 16:18:49 dovecot_login authenticator failed for ([70.174.168.44]) [70.174.168.44]:52844: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.8
country_id: 798549
description:
Dec 12 16:20:07 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.8, lip=66.85.158.92, TLS, session=<MuBWBr9F/c9V2ZUI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 16:19:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<AflABb9FqtkIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 12 16:20:36 host2 sshd[638405]: Disconnected from invalid user kirill 122.160.46.61 port 42770 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 16:21:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<2KA5Cr9Fsps+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:22:37 host2 sshd[639864]: Disconnected from invalid user ubuntu 201.186.40.250 port 37460 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 12 16:22:49 host2 sshd[639987]: Disconnected from invalid user user 122.160.46.61 port 42748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.15.18.19
country_id: 3469034
description:
Dec 12 16:22:52 host2 sshd[640031]: Disconnected from invalid user ubuntu 200.15.18.19 port 43952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2025-12-12 16:23:11 dovecot_login authenticator failed for ([125.21.200.57]) [128.185.219.54]:60694: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 16:22:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ygqSDr9FBN1m1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-12 16:24:12 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:38673: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:23:21 host2 sshd[640378]: Disconnected from invalid user max 201.186.40.250 port 50170 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 16:23:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Lgw9Er9FKuOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-12 16:23:40 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:56459: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-12 16:23:50 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:49417: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.15.18.19
country_id: 3469034
description:
Dec 12 16:24:48 host2 sshd[641181]: Disconnected from invalid user cockpit 200.15.18.19 port 54220 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:26:08 host2 sshd[642091]: Disconnected from invalid user zs 201.186.40.250 port 44518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:25:27 host2 sshd[641650]: Disconnected from invalid user alireza 201.186.40.250 port 60044 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 16:26:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<+MGpG79F2sHD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Dec 12 16:27:09 host2 sshd[642744]: Disconnected from invalid user bitrix 109.205.114.34 port 34432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-12 16:26:40 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (berding) [73.129.57.71]:41760: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 12 16:27:15 host2 sshd[642819]: Disconnected from invalid user testtest 122.160.46.61 port 42710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Dec 12 16:27:51 host2 sshd[643320]: Disconnected from invalid user dockeruser 109.205.114.34 port 38274 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 16:28:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<OmRkIr9F7oOKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 16:28:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<wwj0Ir9FMqnO7iqJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.205.114.34
country_id: 99237
description:
Dec 12 16:28:34 host2 sshd[643672]: Disconnected from invalid user postfix 109.205.114.34 port 47492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:28:54 host2 sshd[643826]: Disconnected from invalid user ubuntu 201.186.40.250 port 38866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Dec 12 16:29:16 host2 sshd[644148]: Disconnected from invalid user jessica 109.205.114.34 port 35526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 16:29:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<HkBFJ79FmNQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 16:30:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<VCSiLL9F6QVetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 16:30:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<+/KgLL9FPOEuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 16:31:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<mqruLr9FqrXD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.74.188.179
country_id: 3469034
description:
Dec 12 16:31:58 host2 sshd[646078]: Disconnected from invalid user rajesh 177.74.188.179 port 54188 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Dec 12 16:32:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<rgS3Mr9F4qLAm1rc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 16:32:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<CDpWM79Fesl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-12-12 16:33:44 dovecot_login authenticator failed for ([182.95.222.186]) [182.95.222.186]:45574: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.72
country_id: 6252001
description:
2025-12-12 16:33:57 dovecot_login authenticator failed for ([98.185.120.72]) [98.185.120.72]:43729: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-12 16:34:43 dovecot_login authenticator failed for ([125.20.154.97]) [182.95.178.206]:44446: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 16:34:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<mDUcO79FQOFnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-12 16:35:02 dovecot_login authenticator failed for ([125.23.72.129]) [125.20.245.194]:41202: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 16:35:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<LZeEPr9F6CIvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.57
country_id: 1831722
description:
Dec 12 16:36:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.57, lip=66.85.158.91, session=<QwI6Qr9FdoG81+s5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.25
country_id: 3439705
description:
Dec 12 16:36:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.84.102.25, lip=66.85.158.91, session=<p3s1Qr9F5qktVGYZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.200.139
country_id: 1733045
description:
Dec 12 16:36:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.200.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=</PU5Qr9FLJSt78iL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-12 16:37:50 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:39488: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.92.147
country_id: 2029969
description:
2025-12-12 16:37:33 dovecot_login authenticator failed for ([202.126.92.147]) [202.126.92.147]:39072: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-12 16:38:17 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:36355: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 16:39:25 host2 sshd[651000]: Disconnected from invalid user  62.60.131.157 port 34505 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 16:41:43 host2 sshd[652298]: Disconnected from invalid user admin 2.57.121.112 port 25283 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 16:42:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<rQiAVL9FxNGH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 16:42:05 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (getrostha) [71.224.169.28]:41794: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-12 16:42:46 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:44254: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2025-12-12 16:42:54 dovecot_login authenticator failed for (nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:52046: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2025-12-12 16:42:29 dovecot_login authenticator failed for ([117.245.138.2]) [117.245.138.2]:46249: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 16:42:31 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:59151: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-12 16:43:50 dovecot_login authenticator failed for (nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:42164: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-12 16:44:02 dovecot_login authenticator failed for ([102.38.3.109]) [102.38.3.109]:58738: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-12 16:43:29 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (iserr) [73.13.220.220]:58118: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 16:45:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<ceYlYr9Fwpkro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-12 16:48:01 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:49858: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-12 16:48:11 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:53990: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-12 16:48:31 dovecot_login authenticator failed for (70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:49920: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-12 16:48:59 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:54977: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 16:49:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<CHa0bb9F5tiB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 16:49:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<vmDhbr9F5MZo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-12-12 16:49:16 dovecot_login authenticator failed for ([182.95.222.186]) [182.95.222.186]:39246: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 16:53:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<OzG8fb9F8ORntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 16:54:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<DU1tgL9FlrW8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 16:55:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<HDvOg79FztY+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-12 16:58:44 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:40451: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 16:58:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<RJV0kL9FiOA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-12 16:58:59 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:36035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 17:01:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<D/Q2mb9FBsTAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 17:01:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<J0Exmr9FUJUImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-12 17:02:52 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:42648: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-12 17:02:52 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:52269: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.88
country_id: 6252001
description:
2025-12-12 17:03:09 dovecot_login authenticator failed for ([70.174.168.88]) [70.174.168.88]:39418: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-12 17:03:11 dovecot_plain authenticator failed for (incys) [199.192.123.12]:47502: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 17:03:48 host2 sshd[669515]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-12 17:03:22 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:52435: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-12-12 17:04:19 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:42642: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 17:04:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<6AOLpL9FBqS8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.201
country_id: 1733045
description:
2025-12-12 17:05:29 dovecot_login authenticator failed for ([49.124.148.201]) [49.124.148.201]:50398: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 17:06:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<nue5rb9FjpukXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 17:07:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<wSoPrr9F+O2G0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-12 17:07:53 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:42219: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 17:08:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<RlcYsr9F8I1AF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 17:07:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<D3ibr79FzNkv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 17:07:33 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:52564: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-12 17:07:42 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:37846: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-12 17:07:47 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:43652: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 17:08:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<opi/sr9FcMMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 17:08:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<zQDdsr9FEpLCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.89.22.113
country_id: 3469034
description:
2025-12-12 17:08:54 dovecot_login authenticator failed for (177-89-22-113.cable.cabotelecom.com.br) [177.89.22.113]:52754: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-12 17:09:30 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (grassom) [73.176.157.57]:41374: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 17:10:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<dV4YvL9FqpeWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-12 17:13:28 dovecot_login authenticator failed for ([180.94.75.42]) [180.94.75.42]:42678: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-12 17:13:42 dovecot_login authenticator failed for ([124.246.114.111]) [124.246.114.111]:38465: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.242.2.250
country_id: 298795
description:
2025-12-12 17:15:01 dovecot_login authenticator failed for ([178.242.2.250]) [178.242.2.250]:49004: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-12 17:14:26 dovecot_login authenticator failed for (ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:60060: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 17:14:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Fg7gyL9FEutm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 17:14:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</GL8yb9FfsqkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-12 17:15:28 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (distagy) [73.137.7.97]:45046: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 17:16:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<wSPyz79FKOfD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 17:18:12 host2 sshd[680381]: Disconnected from invalid user admin 62.60.131.157 port 14454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-12-12 17:19:01 dovecot_login authenticator failed for ([68.71.242.113]) [72.239.139.162]:47644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 17:20:04 dovecot_plain authenticator failed for (deazinorhi) [154.144.243.93]:41516: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-12-12 17:19:26 dovecot_login authenticator failed for ([114.99.127.122]) [20.46.45.121]:64258: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 17:20:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (motoryon) [87.103.126.54]:13120: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 17:20:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<PMcE3b9FiMqKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 17:21:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<HMLK4r9FTq4IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 17:21:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<qwQk479FdIXD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 17:22:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<uoQG5r9FkurO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 17:22:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<Ooyh5r9FAOUI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2025-12-12 17:23:41 dovecot_login authenticator failed for (aes-static-097.188.22.125.airtel.in) [122.184.118.126]:40930: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 17:23:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<H9AW6r9FRNYuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 17:24:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Uqa8679FcIqnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 17:24:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<iF3d679FKpIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-12 17:24:27 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:35442: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 17:25:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<v3GQ779FaItetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 17:26:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<5ivF879FzOQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-12 17:27:39 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:33126: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 17:29:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kbmP/b9FyPR100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 17:30:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<8eA/AcBFmOwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 17:31:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<aVpOBcBFWIxnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.108
country_id: 6252001
description:
2025-12-12 17:31:48 dovecot_login authenticator failed for ([70.174.168.108]) [70.174.168.108]:51125: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-12 17:32:19 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:54758: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-12-12 17:32:18 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:47670: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-12 17:32:38 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:57861: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-12 17:33:06 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:41894: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-12 17:33:25 dovecot_login authenticator failed for ([150.129.20.234]) [150.129.20.234]:33096: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-12 17:33:51 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:53566: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 17:33:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63108: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-12 17:34:19 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:41022: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 17:35:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<v6SMFcBFuOmB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.85
country_id: 3865483
description:
Dec 12 17:37:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=181.225.195.85, lip=66.85.158.91, TLS, session=<yJtHGMBF87+14cNV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.24
country_id: 3469034
description:
Dec 12 17:36:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.248.24, lip=66.85.158.91, TLS, session=<47P5FsBF/sy60fgY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.74
country_id: 1269750
description:
Dec 12 17:36:59 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=103.30.83.74, lip=66.85.158.91, TLS, session=<gr/eF8BF+NdnHlNK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.167
country_id: 3175395
description:
Dec 12 17:37:28 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.8.167, lip=66.85.158.91, TLS, session=<Nn31GcBFuqi5xQin>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 17:38:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<YTTrHcBFSNcro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-12 17:38:45 dovecot_login authenticator failed for ([125.23.243.66]) [125.23.41.122]:58282: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.41
country_id: 1733045
description:
2025-12-12 17:39:01 dovecot_login authenticator failed for ([49.124.153.41]) [49.124.153.41]:46502: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 17:39:14 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:57471: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 17:39:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<K5uRIcBFVqmH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 17:39:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jTPMIcBFLKAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-12 17:39:49 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:65508: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 17:40:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<cy9MJMBFHJVntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 17:44:03 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (forted) [174.169.224.27]:49284: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 17:43:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<AdaoMMBFAos+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.46
country_id: 6252001
description:
Dec 12 17:44:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.228.53.46, lip=66.85.158.91, TLS, session=<ASKmM8BF8upC5DUu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 17:44:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<pNWIM8BFCrOLOxGe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.104
country_id: 6252001
description:
Dec 12 17:44:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.181.104, lip=66.85.158.92, TLS, session=<ZPR7NMBFRD0tT7Vo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 17:44:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<P7yqNMBFGMGB4kCN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 17:45:58 host2 sshd[701767]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 17:48:02 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (caleamas) [96.230.65.90]:48352: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 17:48:06 host2 sshd[703112]: Disconnected from invalid user user 2.57.121.25 port 53062 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-12 17:48:07 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:37750: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-12 17:47:59 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (frahings) [98.193.112.85]:42152: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-12 17:48:24 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:34436: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 17:49:40 host2 sshd[704190]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 17:51:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<FieQTMBFjNS8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-12-12 17:52:09 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:57404: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-12 17:52:28 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:41786: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-12 17:54:15 dovecot_plain authenticator failed for (acisly) [102.53.15.18]:51467: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 17:54:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<yaZrV8BF5ODAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 12 17:55:22 host2 sshd[708905]: Disconnected from invalid user developer 68.183.224.170 port 58730 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 17:55:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<KQh9XMBFSJ+8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.47.135.155
country_id: 2510769
description:
2025-12-12 17:57:03 dovecot_login authenticator failed for 155.red-83-47-135.dynamicip.rima-tde.net [83.47.135.155]:55293: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 12 17:56:15 host2 sshd[709757]: Disconnected from invalid user simone 68.183.224.170 port 52480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.155.88.155
country_id: 2300660
description:
2025-12-12 17:57:20 dovecot_login authenticator failed for (88-155-41-155-dedicatedinternet.vodafone.com.gh) [41.155.88.155]:55242: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2025-12-12 17:57:38 dovecot_login authenticator failed for ([59.94.39.65]) [59.94.39.65]:37982: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2025-12-12 17:57:40 dovecot_login authenticator failed for ([152.52.227.94]) [152.52.227.94]:44174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-12 17:57:42 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:43284: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-12 17:57:11 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:41314: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-12 17:57:14 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:42087: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-12 17:59:04 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:38824: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 12 17:58:34 host2 sshd[711425]: Disconnected from invalid user user 68.183.224.170 port 33670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 17:58:41 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:60287: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 17:58:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<KtxQZ8BF+L2kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 17:59:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<mH6uacBFfONAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.184
country_id: 1880251
description:
Dec 12 18:01:55 host2 sshd[714301]: Disconnected from invalid user username 101.47.143.184 port 46636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 12 18:01:56 host2 sshd[714305]: Disconnected from invalid user sajid 103.106.194.74 port 51448 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 18:02:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<qdGNcsBFxI4I3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 12 18:01:32 host2 sshd[714049]: Disconnected from invalid user vncuser 51.89.166.236 port 46560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 18:02:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<w6nec8BFmJQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 18:02:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<27hVdMBFlpzCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 12 18:02:40 host2 sshd[715062]: Disconnected from invalid user admin 177.10.201.7 port 52308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 12 18:02:47 host2 sshd[715199]: Disconnected from invalid user ansible 51.89.166.236 port 57436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-12 18:02:56 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:57306: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 12 18:03:02 host2 sshd[715468]: Disconnected from invalid user zoom 103.144.247.233 port 55962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 12 18:03:20 host2 sshd[715939]: Disconnected from invalid user user6 51.89.166.236 port 60476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-12 18:03:24 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:39184: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Dec 12 18:03:48 host2 sshd[716330]: Disconnected from invalid user zgr 35.244.25.124 port 34660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 18:03:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<xfKOecBFKsYImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-12 18:03:13 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:41961: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-12 18:03:12 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:45850: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 12 18:03:34 host2 sshd[716186]: Disconnected from invalid user yuan 177.10.201.7 port 60886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-12-12 18:03:37 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:38441: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 12 18:03:29 host2 sshd[716122]: Disconnected from invalid user library 103.106.194.74 port 47954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 18:04:47 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (nonin) [24.15.216.41]:52138: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Dec 12 18:04:48 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<8wKwfMBF6LZChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 12 18:04:12 host2 sshd[716759]: Disconnected from invalid user vncuser 103.106.194.74 port 60318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 12 18:04:16 host2 sshd[716853]: Disconnected from invalid user novinhost 103.144.247.233 port 47448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2025-12-12 18:04:18 dovecot_login authenticator failed for ([102.164.35.116]) [102.164.35.116]:40996: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 18:05:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<0rVGfcBFIOSG0Wp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Dec 12 18:05:10 host2 sshd[717588]: Disconnected from invalid user vncuser 35.244.25.124 port 58960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 12 18:05:28 host2 sshd[717822]: Disconnected from invalid user db2inst1 103.144.247.233 port 45764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 18:05:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mkaff8BFisVm1bVi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 12 18:06:01 host2 sshd[718201]: Disconnected from invalid user aj 103.144.247.233 port 59030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.6
country_id: 226074
description:
Dec 12 18:05:14 host2 sshd[717631]: Disconnected from invalid user novinhost 196.0.120.6 port 57514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-12 18:05:24 dovecot_login authenticator failed for ([182.79.87.18]) [182.79.87.18]:33054: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 12 18:05:29 host2 sshd[717829]: Disconnected from invalid user sajid 51.89.166.236 port 47926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.16
country_id: 3996063
description:
2025-12-12 18:05:48 dovecot_login authenticator failed for (201.166.222.16-clientes-izzi.mx) [201.166.222.16]:45041: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 18:06:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<8qSOg8BFhu2kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 18:06:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<rFzdg8BF0tnD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Dec 12 18:06:51 host2 sshd[718907]: Disconnected from invalid user developer 187.62.87.27 port 40630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 12 18:06:18 host2 sshd[718421]: Disconnected from invalid user sajid 177.10.201.7 port 49496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Dec 12 18:06:30 host2 sshd[718505]: Disconnected from invalid user yuan 35.244.25.124 port 55032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 18:07:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<3kWPhsBFmryl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 12 18:07:38 host2 sshd[719444]: Disconnected from invalid user mini 177.10.201.7 port 36902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 18:07:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<VUI0h8BFjoKWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Dec 12 18:07:09 host2 sshd[719152]: Disconnected from invalid user developer 101.47.48.255 port 34432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.57.170.71
country_id: 3895114
description:
Dec 12 18:07:33 host2 sshd[719401]: Disconnected from invalid user stperez 179.57.170.71 port 56624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.57.170.71
country_id: 3895114
description:
Dec 12 18:08:24 host2 sshd[719982]: Disconnected from invalid user ftpuser 179.57.170.71 port 16258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.62.87.27
country_id: 3469034
description:
Dec 12 18:08:10 host2 sshd[719878]: Disconnected from invalid user ircd 187.62.87.27 port 54656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Dec 12 18:09:42 host2 sshd[720803]: Disconnected from invalid user vivi 101.47.48.255 port 33256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.57.170.71
country_id: 3895114
description:
Dec 12 18:09:50 host2 sshd[720937]: Disconnected from invalid user zomboid 179.57.170.71 port 23254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 12 18:10:04 host2 sshd[721170]: Disconnected from invalid user devops 189.50.142.82 port 51317 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.153.64
country_id: 1880251
description:
2025-12-12 18:10:12 dovecot_login authenticator failed for ([175.156.153.64]) [175.156.153.64]:58241: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-12 18:10:36 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:55746: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 18:12:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<uGHmlsBFJuLD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.6
country_id: 226074
description:
Dec 12 18:12:19 host2 sshd[722851]: Disconnected from invalid user ftpuser 196.0.120.6 port 33398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 18:12:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<qvL2mMBF6M2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-12 18:13:31 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:41294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-12-12 18:13:43 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:39032: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-12 18:14:24 dovecot_plain authenticator failed for (empote) [192.81.229.179]:34014: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 12 18:14:36 host2 sshd[724424]: Disconnected from invalid user developer 189.50.142.82 port 43357 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.184
country_id: 1880251
description:
Dec 12 18:15:04 host2 sshd[724721]: Disconnected from invalid user egarcia 101.47.143.184 port 45784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 18:14:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pircus) [87.103.126.54]:29389: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 12 18:16:09 host2 sshd[725727]: Disconnected from invalid user deploy 189.50.142.82 port 36055 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 18:16:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<QhsopsBFDLkI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.224
country_id: 6252001
description:
2025-12-12 18:17:13 dovecot_login authenticator failed for wsip-184-191-242-224.fv.ks.cox.net [184.191.242.224]:37675: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 18:17:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<mShfqcBFWuAuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-12 18:17:24 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:56576: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 18:17:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<tzwGqsBFMLjO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.108
country_id: 1814991
description:
Dec 12 18:19:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=94.231.206.108, lip=66.85.158.91, session=<Mf3pr8BFQ65e585s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 18:19:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<S2LhssBFUk1etwuC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.108
country_id: 1814991
description:
Dec 12 18:19:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.108, lip=66.85.158.91, session=<hyySsMBFUeVe585s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.110
country_id: 1814991
description:
Dec 12 18:19:29 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.110, lip=66.85.158.91, session=<Cq43scBFxZxe585u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.35
country_id: 1814991
description:
Dec 12 18:19:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.35, lip=66.85.158.91, session=<ZJVvscBF/7Be584j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.149
country_id: 3469034
description:
Dec 12 18:20:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.209.247.149, lip=66.85.158.91, TLS, session=<It3os8BFbd260feV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 18:20:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ytjvtcBFsNo+PIde>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.246.209.88
country_id: 6252001
description:
[2025-12-12 18:20:53 +0530] info [webmaild] 185.246.209.88 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.65
country_id: 798544
description:
Dec 12 18:20:11 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=91.232.165.65, lip=66.85.158.91, TLS, session=<ka68ssBF7epb6KVB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-12 18:22:12 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:39479: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-12 18:22:30 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:39614: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-12 18:22:51 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:54192: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-12 18:23:02 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:35278: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.154.75
country_id: 1880251
description:
Dec 12 18:23:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=15.235.154.75, lip=66.85.158.91, session=<+MsPvsBFScMP65pL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.154.69
country_id: 1880251
description:
Dec 12 18:23:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=15.235.154.69, lip=66.85.158.91, session=<kfqvvsBFhacP65pF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.181
country_id: 3144096
description:
2025-12-12 18:23:21 dovecot_login authenticator failed for (181-162-97-62.cust.smartcall.no) [62.97.162.181]:58826: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.154.79
country_id: 1880251
description:
Dec 12 18:23:29 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=15.235.154.79, lip=66.85.158.91, session=<nkh+v8BFU70P65pP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.154.65
country_id: 1880251
description:
Dec 12 18:23:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=15.235.154.65, lip=66.85.158.91, session=<7zq5v8BF478P65pB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.18
country_id: 1733045
description:
2025-12-12 18:23:38 dovecot_login authenticator failed for ([49.124.151.18]) [49.124.151.18]:50266: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 18:24:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hsfDwcBFE6t100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 18:24:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<+1G7xMBFqoIIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-12 18:25:52 dovecot_plain authenticator failed for (tationders) [199.192.123.12]:39040: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 18:25:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<KuqMxcBFXBwvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-12 18:26:44 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:46346: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-12 18:26:57 dovecot_login authenticator failed for (nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:36200: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 18:27:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<9f0nzMBFVo1ntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 18:28:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<POOS0cBF+oNnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-12 18:28:59 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:46295: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-12-12 18:29:14 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:47160: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 18:30:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=</Ret2cBFDN9o1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-12 18:31:21 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:56657: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-12 18:31:28 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:50481: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 18:31:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<N3Da28BFTJAro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.191.141.128
country_id: 1512440
description:
2025-12-12 18:33:16 dovecot_plain authenticator failed for (cresemen) [185.191.141.128]:59134: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-12 18:34:26 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:51869: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 18:34:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<LZAy6MBFVqQ+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-12 18:34:12 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:57962: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 18:35:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<ipNK6sBF5KuH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 12 18:37:09 host2 sshd[741936]: Disconnected from invalid user gopal 152.42.231.101 port 44060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Dec 12 18:39:36 host2 sshd[743538]: Disconnected from invalid user mb 155.93.89.195 port 56966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.252
country_id: 6252001
description:
2025-12-12 18:39:10 dovecot_login authenticator failed for wsip-184-191-242-252.fv.ks.cox.net [184.191.242.252]:60932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-12 18:39:32 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:40398: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 18:40:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<oo18+8BFbNaB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.21
country_id: 1643084
description:
Dec 12 18:43:02 host2 sshd[746560]: Disconnected from invalid user ts 103.250.10.21 port 45198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Dec 12 18:43:37 host2 sshd[747038]: Disconnected from invalid user root2 155.93.89.195 port 39752 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-12 18:43:09 dovecot_login authenticator failed for ([186.238.157.140]) [187.9.247.58]:38718: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-12-12 18:43:22 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:37603: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.93.89.195
country_id: 2328926
description:
Dec 12 18:44:15 host2 sshd[747526]: Disconnected from invalid user frappe 155.93.89.195 port 44102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 12 18:44:31 host2 sshd[747773]: Disconnected from invalid user postgres 152.42.231.101 port 42502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Dec 12 18:45:43 host2 sshd[749440]: Disconnected from invalid user admin 168.167.228.123 port 33676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 12 18:46:19 host2 sshd[750235]: Disconnected from invalid user hussain 103.13.207.164 port 35280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 18:47:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<KVahFMFFVN3AqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.21
country_id: 1643084
description:
Dec 12 18:47:35 host2 sshd[751259]: Disconnected from invalid user cacti 103.250.10.21 port 56224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 18:47:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<labQFcFFzrS8pkxr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 12 18:47:42 host2 sshd[751338]: Disconnected from invalid user teamspeak 152.42.231.101 port 51846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-12 18:48:42 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:42760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 12 18:48:57 host2 sshd[752536]: Disconnected from invalid user ts 103.13.207.164 port 36518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 18:49:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<EXL3GsFFUq+8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Dec 12 18:48:13 host2 sshd[751948]: Disconnected from invalid user tes 168.167.228.123 port 33679 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-12 18:48:30 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:57628: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 18:48:31 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:55887: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-12 18:49:20 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:60182: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Dec 12 18:49:24 host2 sshd[752864]: Disconnected from invalid user sally 155.93.89.195 port 46948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.21
country_id: 1643084
description:
Dec 12 18:49:40 host2 sshd[752975]: Disconnected from invalid user azureuser 103.250.10.21 port 42388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Dec 12 18:49:50 host2 sshd[753083]: Disconnected from invalid user readonly 168.167.228.123 port 33681 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 12 18:50:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<XFQ/HsFFsqVog7HN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.21
country_id: 1643084
description:
Dec 12 18:50:22 host2 sshd[753722]: Disconnected from invalid user vivek 103.250.10.21 port 40884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 18:50:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<PueRIcFFhu2kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 18:51:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<wzeEI8FFYL9AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-12 18:52:10 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (thaturit) [98.204.134.124]:59930: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 12 18:52:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<o8k3JsFFhIjCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 12 18:52:21 host2 sshd[754882]: Disconnected from invalid user vivek 103.13.207.164 port 43866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-12 18:53:29 dovecot_plain authenticator failed for (heniumst) [102.53.15.56]:38016: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-12-12 18:53:51 dovecot_plain authenticator failed for (podli) [65.20.163.103]:37020: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.123
country_id: 6252001
description:
2025-12-12 18:53:53 dovecot_login authenticator failed for wsip-184-191-250-123.fv.ks.cox.net [184.191.250.123]:42813: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-12 18:54:19 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:40280: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


