# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 04:17:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<bbBQd2RFOuWPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 04:18:34 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 04:19:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<uP5MfGRFDNM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 04:21:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<pRyrhWRF7uZScUAC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 04:22:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sceast) [87.103.126.54]:6815: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 04:22:29 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 04:22:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ydzaiGRFIp9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 04:24:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<t2+4jmRFTqQ+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-08 04:24:18 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:51407: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 04:26:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<8aRElWRFQqWl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 04:26:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<RlvklmRFsr28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 04:29:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<mVIvomRFErRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-08 04:30:31 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:60053: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 04:30:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<ym9Xo2RFIJA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 04:30:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<7YhopGRFsO0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 04:30:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<QjnGpGRFENGWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-08 04:30:52 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:12079: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-08 04:32:02 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (deimakisau) [98.204.134.124]:50352: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 04:33:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=</N7wsGRFaNo+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 04:33:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<GRCQrmRF/ts+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 04:33:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WqDNrmRFdOY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 04:33:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<5mCzsGRF9LykXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 04:34:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<dwHOsWRFIJ0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 04:36:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<y4aru2RFnIU+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-08 04:38:08 dovecot_plain authenticator failed for (table) [24.187.213.29]:36372: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-08 04:38:08 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (hableers) [68.46.148.180]:60700: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-12-08 04:38:11 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (unchang) [71.229.43.123]:51080: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 04:38:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<0zEKwmRFuLM+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-12-08 04:41:21 dovecot_login authenticator failed for (2-74-194-86.kcell.kz) [2.74.194.86]:57329: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.51.177
country_id: 1168579
description:
2025-12-08 04:41:34 dovecot_login authenticator failed for ([182.184.51.177]) [182.184.51.177]:48918: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 04:43:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<jRJI0mRFOIKLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 04:44:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<5II/1mRFnog+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 04:45:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<SK+l2WRFHtSqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 04:46:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<U72t3GRFPNQ+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-08 04:45:59 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:48949: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-08 04:46:55 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:47504: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 04:46:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<2bPl32RFcuk+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-08 04:47:14 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:2485: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-08 04:48:27 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (acidingual) [144.64.157.244]:57117: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.27
country_id: 798544
description:
Dec  8 04:50:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=178.216.30.27, lip=66.85.158.91, TLS, session=<xs8P6mRFDMOy2B4b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-08 04:50:14 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:37544: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.152
country_id: 798544
description:
Dec  8 04:50:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=128.127.94.152, lip=66.85.158.91, TLS, session=<bC8b62RFjumAf16Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-08 04:50:29 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:46426: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 04:52:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<9EOE8mRFFN0+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.234
country_id: 6252001
description:
Dec  8 04:55:35 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.234, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2HTc/mRFidrG6xjq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 04:56:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (kispian) [87.103.126.54]:29550: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-08 04:56:28 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (maceamily) [73.0.235.30]:45776: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-08 04:57:19 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:38878: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-08 04:57:52 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:40988: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 04:57:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<ybM0B2VFaLg+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.54
country_id: 6252001
description:
Dec  8 04:58:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.54, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UnQuCmVFRdvG6xg2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-08 04:59:58 dovecot_plain authenticator failed for (balious) [23.30.11.253]:54410: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 05:01:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<vyRMFGVFJpM+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 05:02:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<s+w2F2VFitQP6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 05:02:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<5EuVF2VF2IU+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 05:02:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<6ye/FWVF9sOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 05:03:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<qssQGmVFJskrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 05:04:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<yUStHmVFbrk+PIcr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.206.49
country_id: 6251999
description:
Dec  8 05:07:40 host2 pure-ftpd[3356637]: (?@148.113.206.49) [INFO] New connection from 148.113.206.49


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.206.49
country_id: 6251999
description:
Dec  8 05:07:54 host2 pure-ftpd[3356785]: (?@148.113.206.49) [INFO] New connection from 148.113.206.49


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.206.49
country_id: 6251999
description:
Dec  8 05:07:58 host2 pure-ftpd[3356829]: (?@148.113.206.49) [INFO] New connection from 148.113.206.49


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 05:09:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<KiIAMWVFTqTDhTKl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-08 05:17:30 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (teness) [73.213.236.66]:35192: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-08 05:18:51 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:36292: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Dec  8 05:19:29 host2 sshd[3367266]: Disconnected from invalid user middleware 107.173.160.152 port 46486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-08 05:20:51 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:58088: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Dec  8 05:20:50 host2 sshd[3368545]: Disconnected from invalid user tempusr 107.173.160.152 port 40606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-12-08 05:22:42 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:51606: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-08 05:22:51 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:50156: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 05:23:05 host2 sshd[3370364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-08 05:23:16 dovecot_login authenticator failed for (cm-84.213.189.159.get.no) [84.213.189.159]:46541: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-08 05:23:30 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:33587: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.23.5
country_id: 2921044
description:
Dec  8 05:25:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.23.5, lip=66.85.158.91, session=<lYw4aGVFBLmd5hcF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.111.21
country_id: 2921044
description:
Dec  8 05:25:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.89.111.21, lip=66.85.158.91, session=<L9QxaGVFbTafWW8V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-08 05:26:50 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:60518: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-08 05:27:21 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:33964: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 05:28:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Kzb2cmVFY9wz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 05:29:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<uDIUeGVFUpGG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-12-08 05:29:47 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:56444: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 05:29:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<7O7veGVFtI/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-08 05:29:59 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:47151: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 05:29:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<XFBpeWVFgNgv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-08 05:31:28 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:45898: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 05:31:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=</gvrfmVF8os+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-12-08 05:31:41 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:57202: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 05:31:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+MMTgGVFoOkv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 05:35:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<wpRQjWVFZqhnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.144
country_id: 6252001
description:
Dec  8 05:35:51 host2 pure-ftpd[3381365]: (?@147.185.132.144) [INFO] New connection from 147.185.132.144


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 05:37:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<M0Vdk2VFaOs+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-08 05:37:13 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:55887: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-12-08 05:37:32 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:52858: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.144.246.132
country_id: 798544
description:
Dec  8 05:37:36 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.144.246.132, lip=66.85.158.91, TLS, session=<A9YtlGVFzLi5kPaE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.55.226.10
country_id: 798544
description:
Dec  8 05:37:54 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=92.55.226.10, lip=66.85.158.91, TLS, session=<YYM7lWVFC4dcN+IK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 05:39:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<4FC0mmVFvuePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 05:40:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<xNjHnmVFGJqiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 05:41:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<5ejNomVFYOs+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 05:42:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<9An1pWVFNTVScUAC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 05:42:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<g8PTpGVFvu0+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 05:44:13 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (phant) [87.103.126.54]:32370: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.90
country_id: 798544
description:
Dec  8 05:45:09 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=91.232.165.90, lip=66.85.158.91, TLS, session=<U4spr2VFWNlb6KVa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.106.155
country_id: 3686110
description:
Dec  8 05:45:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.96.106.155, lip=66.85.158.91, TLS, session=<1x9IsGVF17C6YGqb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 05:45:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<EbRfsmVFhtM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 05:48:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<03PcumVF0q1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 05:48:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<o2WuvGVFPNo+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 141.95.206.110
country_id: 3017382
description:
Dec  8 05:47:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=141.95.206.110, lip=66.85.158.92, TLS: Connection closed, session=<iiYlumVFOLWNX85u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.21
country_id: 3469034
description:
Dec  8 05:49:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=186.209.250.21, lip=66.85.158.91, TLS, session=<Qxebv2VFeoy60foV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.51
country_id: 1643084
description:
Dec  8 05:50:50 host2 sshd[3393451]: Disconnected from invalid user test 103.49.238.51 port 56328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.102.167
country_id: 798544
description:
Dec  8 05:50:05 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.102.167, lip=66.85.158.91, TLS, session=<ff7MwGVFN5yy22an>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec  8 05:50:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<8O3ewWVFFB+nXpI4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.201
country_id: 3469034
description:
Dec  8 05:51:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=186.209.248.201, lip=66.85.158.91, TLS, session=<7QyexmVF89a60fjJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.134.26
country_id: 99237
description:
Dec  8 05:51:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=65.20.134.26, lip=66.85.158.91, TLS, session=<r4hZxWVFBOtBFIYa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 05:51:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<giOBxmVFGN+8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 05:51:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<rVasxmVFHKel6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 05:51:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<J7+Tx2VF0MI+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-08 05:51:46 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:41115: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-12-08 05:52:27 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:36479: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.1.112
country_id: 2077456
description:
2025-12-08 05:52:00 dovecot_login authenticator failed for ([101.168.1.112]) [101.168.1.112]:58382: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-12-08 05:52:07 dovecot_login authenticator failed for ([82.102.149.88]) [82.102.149.88]:33702: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 05:52:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<5HhEyWVFuoAv+1Ve>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-12-08 05:52:16 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:37017: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-08 05:52:15 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:56918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 05:52:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<yDYDymVF3owXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.1.44
country_id: 2077456
description:
2025-12-08 05:52:51 dovecot_login authenticator failed for ([120.157.1.44]) [120.157.1.44]:37848: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-08 05:53:24 dovecot_plain authenticator failed for (hydroaddle) [41.248.243.181]:35406: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-08 05:53:24 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:42942: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-08 05:53:27 dovecot_plain authenticator failed for (untae) [65.20.184.80]:34034: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 05:54:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<NauL0mVFUrIv/lVz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 05:54:32 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.153
country_id: 3469034
description:
Dec  8 05:54:43 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=186.209.248.153, lip=66.85.158.91, TLS, session=<cQ4s0WVFSOa60fiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.192
country_id: 690791
description:
Dec  8 05:55:07 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=37.221.147.192, lip=66.85.158.91, TLS, session=<pnCF0mVFaJUl3ZPA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 05:55:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<wFNH1GVFCOJn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 05:56:39 dovecot_plain authenticator failed for (unchly) [154.144.243.93]:42938: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 05:56:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<J7xr2WVFvrWkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 05:55:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<8cXB1mVF4q2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 05:56:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0bLu2WVFrsov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 05:57:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<MLON22VF+Io+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.241
country_id: 1733045
description:
2025-12-08 05:57:47 dovecot_login authenticator failed for ([49.124.152.241]) [49.124.152.241]:38426: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 05:58:28 host2 sshd[3400015]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 05:59:07 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 05:59:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<PPlC5GVFUpk+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 05:59:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<ZN6E5GVFbqU+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.51
country_id: 1643084
description:
Dec  8 06:01:48 host2 sshd[3402762]: Disconnected from invalid user sales07 103.49.238.51 port 50880 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.51
country_id: 1643084
description:
Dec  8 06:04:18 host2 sshd[3404636]: Disconnected from invalid user moodle 103.49.238.51 port 55662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 06:05:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WINE92VFwOs+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-12-08 06:05:40 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:42251: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-08 06:06:08 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:45207: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 06:08:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<QWegAmZFZIaLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.82
country_id: 3469034
description:
Dec  8 06:09:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.120.72.82, lip=66.85.158.91, TLS, session=<3N5BB2ZFBai7eEhS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.175
country_id: 690791
description:
Dec  8 06:09:18 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=194.44.140.175, lip=66.85.158.91, TLS, session=<StZ5BWZFIb/CLIyv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 06:11:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<8banDWZFAJ4+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-08 06:12:48 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:48702: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.209.9.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 74.209.9.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-08 06:21:49 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (mantimin) [71.62.34.216]:59638: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec  8 06:22:46 host2 sshd[3418164]: Disconnected from invalid user postgres 34.91.0.68 port 48922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-08 06:21:53 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (postal) [76.97.155.25]:43546: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-08 06:21:56 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (brapus) [174.169.224.27]:53916: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 06:24:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<nxtIPGZFzrGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.217
country_id: 3469034
description:
Dec  8 06:26:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=138.255.206.217, lip=66.85.158.91, TLS, session=<DtcOQmZFSMyK/87Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 06:26:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<G4RTRGZFqs8P6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.252
country_id: 3077311
description:
Dec  8 06:25:54 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=85.163.38.252, lip=66.85.158.91, TLS, session=<hKfqQGZFYpxVoyb8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 06:28:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<m70MS2ZFPOIrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 06:29:22 host2 sshd[3422898]: Disconnected from invalid user user 2.57.121.25 port 49791 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.127.192
country_id: 2921044
description:
Dec  8 06:31:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.65.127.192, lip=66.85.158.91, TLS, session=<PYD2VGZFZP+fQX/A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-08 06:31:42 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:51644: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-12-08 06:31:55 dovecot_login authenticator failed for (syn-097-070-129-101.res.spectrum.com) [97.70.129.101]:36960: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.21
country_id: 6252001
description:
Dec  8 06:33:40 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.21, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<g82uXWZF4NCTuYQV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 06:32:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<K4PvWmZFzJHDhTKl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-08 06:34:27 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:55092: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-08 06:34:49 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:62656: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 06:35:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<SXL1ZGZFwNCeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 06:36:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sgZXZ2ZFlO0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 06:37:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<f1zYaWZFpDenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 06:37:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<oMUiamZFrqfD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 06:37:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BHuKbGZFYqBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 06:39:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<E1atcWZFHLSuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-08 06:39:32 dovecot_plain authenticator failed for (culprear) [102.53.15.56]:51322: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-08 06:39:43 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:57714: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-08 06:40:05 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:50273: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 06:40:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<QE1edGZFdJpnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-08 06:40:56 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:50472: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 06:41:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7bq+eWZFCo1n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Dec  8 06:42:24 host2 sshd[3432670]: Disconnected from invalid user dinahosting 103.154.77.48 port 43508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec  8 06:42:02 host2 sshd[3432459]: Disconnected from invalid user gnats 34.91.0.68 port 46472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.15.139
country_id: 6252001
description:
Dec  8 06:43:03 host2 sshd[3433087]: Disconnected from invalid user postgres 107.172.15.139 port 59586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-08 06:44:08 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:3134: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 06:44:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<BIvNg2ZF9Jc+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 06:44:56 host2 sshd[3434360]: Disconnected from invalid user admin 2.57.121.112 port 24321 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-08 06:45:49 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:56752: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-08 06:48:53 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:60406: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 06:49:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<jawdlmZFkK0+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec  8 06:49:33 host2 sshd[3437577]: Disconnected from invalid user infocare 34.91.0.68 port 56502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-08 06:49:39 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:41275: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-08 06:49:42 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52116: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.100.195
country_id: 6252001
description:
Dec  8 06:49:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=74.235.100.195, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WyeylGZFEuVK62TD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 06:50:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<IYGTmmZFRdoz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 06:51:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<RyfJnWZF8Oov/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 06:51:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<hg7om2ZFFow+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.235
country_id: 953987
description:
Dec  8 06:52:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=102.64.41.235, lip=66.85.158.91, TLS, session=<234toWZFcuxmQCnr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.144
country_id: 1269750
description:
Dec  8 06:53:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=103.213.195.144, lip=66.85.158.91, TLS, session=<05GComZFybBn1cOQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Dec  8 06:53:30 host2 sshd[3440288]: Disconnected from invalid user perp 152.32.189.21 port 54404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.81.125
country_id: 597427
description:
Dec  8 06:54:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=69.62.81.125, lip=66.85.158.91, session=<4km0pmZFlL5FPlF9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 06:54:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<Avrfp2ZFXtk+PIcp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.189.21
country_id: 1819730
description:
Dec  8 06:56:01 host2 sshd[3442391]: Disconnected from invalid user airbnb2024 152.32.189.21 port 56534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 06:56:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<gLsjrmZFPoGG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 06:57:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ToBmsWZF5ssv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 06:56:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<bqGKsGZF/NfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 06:58:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<1LBRt2ZFGpI+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-08 07:00:24 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:43984: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.117.94
country_id: 2510769
description:
2025-12-08 07:00:35 dovecot_login authenticator failed for ([46.35.117.94]) [46.35.117.94]:43250: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-08 07:00:12 dovecot_login authenticator failed for ([115.240.6.56]) [49.37.32.248]:33832: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-08 07:00:24 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:51450: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-08 07:00:50 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:43612: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 06:59:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<B/p9u2ZFgMM+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-08 07:00:04 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:51766: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Dec  8 07:01:12 host2 sshd[3445809]: Disconnected from invalid user jenkins 103.154.77.48 port 46144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 07:01:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<wBmOwGZFFo0+PIcl>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[60640] [Authentication Database]=[system] [Username]=[2stravel] (10/10 failures) (blocked until [Tue Dec  9 01:31:35 2025 UTC/Tue Dec  9 07:01:35 2025 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 07:01:35 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 07:01:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<pVuNwmZFhp1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 07:01:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<s1aCwmZFgKqPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Dec  8 07:03:08 host2 sshd[3447079]: Disconnected from invalid user jenkins 152.32.189.21 port 55716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 07:03:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<ukK2yGZFHp4+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 07:04:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<sCmLymZF8NeiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.76
country_id: 1269750
description:
2025-12-08 07:05:20 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.76]:44432: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Dec  8 07:05:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<5QOBz2ZFXqpQUk2L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-08 07:05:41 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:51515: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Dec  8 07:05:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 26 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, TLS: Connection closed, session=<l8D80GZFHqhQUk2L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 07:06:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<vwBp0WZFHTtScUAC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Dec  8 07:07:49 host2 sshd[3449890]: Disconnected from invalid user operations 152.32.189.21 port 50416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-08 07:08:11 dovecot_login authenticator failed for (nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:60974: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-08 07:09:17 dovecot_login authenticator failed for 14-0-142-131.static.pccw-hkt.com [14.0.142.131]:56151: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-08 07:09:27 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:39730: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 07:10:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<CGor4mZF9sc+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-08 07:10:48 dovecot_login authenticator failed for ([182.95.178.158]) [182.95.178.158]:48948: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.26.164
country_id: 294640
description:
2025-12-08 07:11:01 dovecot_login authenticator failed for ([95.35.26.164]) [95.35.26.164]:34642: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 07:12:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<U/v36GZFmNg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.201.229.165
country_id: 3469034
description:
Dec  8 07:12:49 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=128.201.229.165, lip=66.85.158.91, TLS, session=<ZsqY6GZF8qeAyeWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.171
country_id: 6290252
description:
Dec  8 07:13:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts2>, method=PLAIN, rip=109.207.35.171, lip=66.85.158.91, TLS, session=<OMS66WZF/85tzyOr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.57.26
country_id: 6252001
description:
Dec  8 07:13:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.221.57.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oaWW6mZFousU3Tka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.66
country_id: 933860
description:
Dec  8 07:13:58 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=41.216.209.66, lip=66.85.158.91, TLS, session=<16yg7GZFxegp2NFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 07:14:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<NOz+7WZFWJM+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.251
country_id: 953987
description:
Dec  8 07:14:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=102.64.32.251, lip=66.85.158.91, TLS, session=<4Xf57WZFYc5mQCD7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 07:14:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=</WA072ZF0pVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-08 07:15:49 dovecot_plain authenticator failed for (vagnicary) [149.62.239.4]:40618: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 07:15:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<4O8+9GZFjLWl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 07:16:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<u+vK9mZFtOm8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-08 07:17:44 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:50774: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.241.107
country_id: 3144096
description:
2025-12-08 07:18:10 dovecot_login authenticator failed for (cm-178.232.241.107.get.no) [178.232.241.107]:38422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 07:17:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Idnb+2ZF7M8+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-08 07:19:25 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:42161: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-08 07:19:44 dovecot_login authenticator failed for ([128.185.13.33]) [122.184.123.118]:37332: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 07:20:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2O6YBGdFDokv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 07:19:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<nUXqAmdFJrekXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 07:20:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yCpLBGdFtocv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 07:21:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<j9yeCGdFRJpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 07:22:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<6n9fCmdFsJGWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 07:22:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57458: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 07:23:42 host2 sshd[3461483]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 07:24:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<Z29cE2dF4rA+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 07:24:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<xDu3E2dFqpkv+1Ve>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 07:25:06 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 07:26:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<PBpYG2dFyKU+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 07:27:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<9BAAH2dFFIY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 07:28:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<WEi4IWdFlJ0+PIcs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 07:28:40 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 07:32:27 host2 sshd[3467596]: Disconnected from invalid user user 2.57.121.25 port 18844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-08 07:31:59 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (bitra) [71.235.225.181]:38790: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 07:34:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<7eTONWdFVumLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-08 07:34:16 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (hoidice) [174.161.27.82]:58270: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.29
country_id: 6252001
description:
Dec  8 07:34:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.29, lip=66.85.158.92, session=<pSyINmdFGzJAPsUd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec  8 07:34:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, TLS: Connection closed, session=<bQNAN2dFrt9APsUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 07:39:42 dovecot_plain authenticator failed for (pactoriane) [154.144.243.93]:56860: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-12-08 07:40:59 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:15776: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-08 07:41:08 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:60471: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec  8 07:41:19 host2 sshd[3473361]: Disconnected from invalid user tempusr 107.150.110.167 port 23496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.87.127
country_id: 3469034
description:
Dec  8 07:41:26 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.106.87.127, lip=66.85.158.91, TLS, session=<lhrxTmdF1o+zald/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.47
country_id: 1269750
description:
Dec  8 07:41:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=202.136.85.47, lip=66.85.158.91, TLS, session=<lbslUGdFE8PKiFUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-08 07:42:20 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (varte) [96.230.65.90]:60296: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 07:42:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<wW7AVGdFeN2qQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-08 07:42:55 dovecot_login authenticator failed for ([77.89.143.122]) [77.89.143.122]:44066: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.240.154
country_id: 1269750
description:
2025-12-08 07:43:15 dovecot_login authenticator failed for (static-154.240.195.14-tataidc.co.in) [14.195.240.154]:57096: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-08 07:43:47 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (aukine) [144.64.157.244]:33885: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.110.167
country_id: 6252001
description:
Dec  8 07:44:34 host2 sshd[3475509]: Disconnected from invalid user moodle 107.150.110.167 port 49058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-08 07:45:53 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:58339: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec  8 07:46:46 host2 sshd[3477469]: Disconnected from invalid user ftp2025 107.150.110.167 port 47770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-08 07:46:17 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:44796: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-08 07:46:22 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:53981: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-12-08 07:46:38 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:39939: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 07:46:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<45aMY2dFIN6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 07:47:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<YBdZZWdFBucXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 07:48:39 host2 sshd[3478842]: Disconnected from invalid user user 2.57.121.25 port 52965 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-08 07:48:58 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (crous) [68.83.181.181]:49458: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-08 07:49:02 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:42660: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-08 07:49:09 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:34058: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-08 07:50:36 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:57038: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-12-08 07:50:38 dovecot_login authenticator failed for h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:47698: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.208
country_id: 1733045
description:
2025-12-08 07:50:14 dovecot_login authenticator failed for ([49.124.149.208]) [49.124.149.208]:37554: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 07:50:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<E+cmcGdF6KAP6yH0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.65.97.67
country_id: 3469034
description:
Dec  8 07:51:51 host2 sshd[3481331]: Disconnected from invalid user jacob 177.65.97.67 port 46122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.247
country_id: 6252001
description:
2025-12-08 07:54:05 dovecot_login authenticator failed for wsip-184-191-242-247.fv.ks.cox.net [184.191.242.247]:58483: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-08 07:54:24 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:58099: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 07:54:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<DI6ofmdFdpIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 07:56:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<gLNRhmdF7OjDhTKl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 07:57:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<W/kMiGdFArM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 07:57:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<ZjD9h2dFFIU+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-08 07:57:10 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:52354: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-08 07:57:15 dovecot_plain authenticator failed for (untron) [88.149.153.106]:47920: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2025-12-08 07:57:25 dovecot_login authenticator failed for ([103.57.224.221]) [103.57.224.221]:41625: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 07:58:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<FxuBi2dFZICeRdvj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec  8 07:59:29 host2 pure-ftpd[3486835]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.209.39
country_id: 1819730
description:
Dec  8 08:00:39 host2 pure-ftpd[3487873]: (?@123.58.209.39) [INFO] New connection from 123.58.209.39


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 08:00:47 host2 sshd[3487915]: Disconnected from invalid user admin 2.57.121.112 port 52137 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 08:00:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ZRiEkmdFSMDD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-08 08:00:34 dovecot_plain authenticator failed for (detate) [24.93.140.162]:58588: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 08:01:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<11f7mGdFYMcv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-08 08:02:24 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:36900: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 08:02:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<KTEgm2dF7OynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-08 08:02:31 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:34472: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-12-08 08:03:32 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:44938: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 08:03:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<gngEoGdFrttn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.88.152.183
country_id: 3508796
description:
2025-12-08 08:02:53 dovecot_login authenticator failed for tdev152-183.codetel.net.do [200.88.152.183]:45550: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.24
country_id: 6252001
description:
Dec  8 08:04:27 host2 pure-ftpd[3490648]: (?@147.185.132.24) [INFO] New connection from 147.185.132.24


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 08:05:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<jXCspGdFBqE+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-08 08:06:56 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (plove) [24.127.53.61]:45132: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 08:07:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<PKRmrGdFkIw+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 08:07:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<nr2LrGdFRMNnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 08:07:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<uzlFrWdFRLhn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec  8 08:08:09 host2 sshd[3492718]: Disconnected from invalid user infocare 162.240.39.179 port 48102 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-08 08:07:58 dovecot_plain authenticator failed for (unlebe) [92.62.243.174]:54999: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 08:10:11 host2 sshd[3494140]: Disconnected from invalid user admin 2.57.121.112 port 36125 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 08:11:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0Ysyu2dF+Jw+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec  8 08:12:34 host2 sshd[3495532]: Disconnected from invalid user admin 181.212.81.228 port 36336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-12-08 08:12:37 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:39534: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec  8 08:17:55 host2 sshd[3499395]: Disconnected from invalid user user 181.212.81.228 port 59148 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 08:20:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<NuvG3GdFKpqG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.81.125
country_id: 597427
description:
Dec  8 08:21:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=69.62.81.125, lip=66.85.158.91, session=<a+EM32dFJqNFPlF9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.78.29.97
country_id: 2802361
description:
Dec  8 08:22:24 host2 sshd[3502061]: Disconnected from invalid user oracle 34.78.29.97 port 45768 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 08:22:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<9CxO5GdFjI4v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 08:23:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<pn0I6GdFAoHO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 08:24:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<KWjI6GdF9qg+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 08:24:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pAzL6GdFGt6PbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 08:24:37 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 08:25:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<7VuU7GdF3NA+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.65.97.67
country_id: 3469034
description:
Dec  8 08:25:45 host2 sshd[3504703]: Disconnected from invalid user oracle 177.65.97.67 port 41380 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.116
country_id: 6252001
description:
Dec  8 08:26:30 host2 pure-ftpd[3505367]: (?@66.240.236.116) [INFO] New connection from 66.240.236.116


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.116
country_id: 6252001
description:
Dec  8 08:27:52 host2 pure-ftpd[3506635]: (?@66.240.236.116) [INFO] New connection from 66.240.236.116


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 08:28:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<k9N+9mdF0oBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 08:28:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<Wm5G92dFFJGiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 08:28:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<MOfD+WdFSqs+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.19.163.70
country_id: 1269750
description:
Dec  8 08:30:58 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<training@v-deploy.com>, method=PLAIN, rip=125.19.163.70, lip=66.85.158.91, TLS, session=<mLz1AGhFsut9E6NG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 08:30:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ERg9/2dFBIw+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-08 08:33:45 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:42409: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.78.29.97
country_id: 2802361
description:
Dec  8 08:34:15 host2 sshd[3510773]: Disconnected from invalid user user 34.78.29.97 port 33560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.153
country_id: 6252001
description:
2025-12-08 08:34:26 dovecot_login authenticator failed for ([70.174.167.153]) [70.174.167.153]:58224: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-08 08:37:20 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (genting) [68.46.148.180]:58874: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-08 08:37:12 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:45616: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-08 08:37:27 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:34056: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 08:38:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<AmcMG2hF3pI+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-08 08:38:55 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (croater) [98.204.134.124]:49950: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 08:39:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<nqv3HWhF/p0+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 08:38:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=</Gg7HGhFnqA+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 08:40:16 host2 sshd[3515286]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 08:40:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<YGnxIWhF5tel6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 08:40:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<hDynI2hFgqY+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 08:41:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<N6OBJ2hFtsO8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-08 08:41:58 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (extrac) [68.83.181.181]:43220: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 08:42:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<FfTpKmhFXptn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 08:43:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Wn6ILmhFHrkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 08:43:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<us/OLmhFgOekXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.41
country_id: 798544
description:
Dec  8 08:44:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=109.125.248.41, lip=66.85.158.91, TLS, session=<iiR7MWhFjcZtffgp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:44:56 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<UHEcM2hF2q8DlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:44:57 host2 dovecot[2208013]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<dC0jM2hF1IkDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.250.47.39
country_id: 3469034
description:
Dec  8 08:45:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=167.250.47.39, lip=66.85.158.91, TLS, session=<m62UMmhFe7Wn+i8n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:45:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<2ovMNGhFtMMDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:45:24 host2 dovecot[2208013]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<FdzGNGhFpsMDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 08:46:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<aFJ5OGhF2uAv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 08:47:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<+lNyPGhF5tKWXx+e>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 08:48:48 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 08:50:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tKuNRWhFTpxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 08:50:47 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (brocy) [68.60.77.128]:40740: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 08:51:35 host2 sshd[3525472]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 08:52:56 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:53:24 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<skZlUWhFrqYDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-12-08 08:53:24 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:44754: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 08:56:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<0XxyXGhFvuMv+1Ve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 09:00:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<iXMLbGhFLLyLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-08 09:01:06 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:40070: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.154.211
country_id: 1861060
description:
2025-12-08 09:01:31 dovecot_login authenticator failed for p83212-obmd01.osaka.ocn.ne.jp [180.7.154.211]:55418: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-08 09:01:40 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:50418: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 220.247.223.56
country_id: 1227603
description:
Dec  8 09:03:16 host2 sshd[3533986]: Disconnected from invalid user middleware 220.247.223.56 port 58114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec  8 09:02:33 host2 sshd[3532947]: Disconnected from invalid user aptproxy 190.129.122.12 port 1287 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.25.120
country_id: 933860
description:
Dec  8 09:03:43 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=83.143.25.120, lip=66.85.158.91, TLS, session=<72USdWhFY5NTjxl4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.48
country_id: 933860
description:
Dec  8 09:04:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.213.48, lip=66.85.158.91, TLS, session=<LDtsdmhFLZ0p2NUw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 09:04:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<C34keWhFqtA+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Dec  8 09:06:52 host2 sshd[3536184]: Disconnected from invalid user user 220.247.223.56 port 50588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Dec  8 09:09:20 host2 sshd[3537623]: Disconnected from invalid user aptproxy 220.247.223.56 port 45580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.90.150
country_id: 3469034
description:
Dec  8 09:09:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=177.22.90.150, lip=66.85.158.91, TLS, session=<5xVQi2hFrLKxFlqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.197.253
country_id: 2510769
description:
Dec  8 09:10:14 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.135.197.253, lip=66.85.158.91, TLS, session=<otuDjGhFiMQth8X9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 09:09:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<joB3imhFhLCkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 09:09:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<f3RIi2hFbuM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 09:12:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<my47lGhFBteqQMFo>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:13 host2 sshd[3539801]: Disconnecting authenticating user root 185.188.217.121 port 52852: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:13 host2 sshd[3539801]: error: maximum authentication attempts exceeded for root from 185.188.217.121 port 52852 ssh2 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:24 host2 sshd[3539955]: error: maximum authentication attempts exceeded for root from 185.188.217.121 port 58276 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:37 host2 sshd[3540085]: Disconnecting invalid user admin 185.188.217.121 port 36594: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:24 host2 sshd[3539955]: Disconnecting authenticating user root 185.188.217.121 port 58276: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.34
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.8.225.34 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-08 09:13:42 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:41423: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-12-08 09:13:57 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:51586: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-08 09:13:24 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:48500: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.34
country_id: 1643084
description:
Dec  8 09:13:31 host2 sshd[3540624]: Invalid user cloudtourssrilan_travel from 182.8.225.34 port 11822


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-08 09:14:34 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:44226: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-08 09:14:49 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:48734: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-08 09:17:07 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:38700: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Dec  8 09:19:05 host2 sshd[3544296]: Disconnected from invalid user user 162.241.127.152 port 38536 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 09:19:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<57zCrWhFDOg+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec  8 09:19:41 host2 sshd[3544652]: Disconnected from invalid user app 190.129.122.12 port 17212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 09:20:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<uhO0sGhFSsQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 09:20:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<a7gas2hFfrIrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-08 09:20:48 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (funistwake) [73.161.96.107]:60100: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.68.54.105
country_id: 3017382
description:
Dec  8 09:22:40 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.68.54.105, lip=66.85.158.91, session=<DVgJumhFuZEzRDZp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 09:22:55 host2 sshd[3546723]: Disconnected from invalid user admin 2.57.121.112 port 45599 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.242
country_id: 6252001
description:
Dec  8 09:23:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.242, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wdcWvGhFpsaTuYTy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 09:23:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<M2lavWhFioHD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 09:23:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<AIBovmhFgLA+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec  8 09:23:59 host2 sshd[3547504]: Disconnected from invalid user ubuntu 172.191.157.64 port 40892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.242
country_id: 6252001
description:
Dec  8 09:24:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.132.242, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<lBRnv2hFavmTuYTy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 09:26:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<sKjXxWhFduM+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 09:27:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<+jdnymhF8qIv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-08 09:28:17 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (unnerribia) [174.169.224.27]:51646: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 09:27:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<HamXy2hFmLc+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 09:27:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<m20tzGhFppY+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.242
country_id: 6252001
description:
Dec  8 09:28:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.242, lip=66.85.158.92, TLS, session=<lWuV0GhFAv2TuYTy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.234
country_id: 6252001
description:
2025-12-08 09:30:08 dovecot_login authenticator failed for wsip-184-191-242-234.fv.ks.cox.net [184.191.242.234]:60805: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-08 09:30:14 dovecot_login authenticator failed for ([103.186.193.149]) [103.186.193.149]:57502: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-08 09:30:25 dovecot_login authenticator failed for ([78.156.6.163]) [78.156.6.163]:58632: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-08 09:30:28 dovecot_login authenticator failed for ([182.95.228.110]) [182.95.228.110]:42898: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-08 09:30:35 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:43283: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.192.195.122
country_id: 6252001
description:
2025-12-08 09:30:24 dovecot_login authenticator failed for ([72.192.195.122]) [72.192.195.122]:37883: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.65.144.89
country_id: 6252001
description:
2025-12-08 09:31:57 dovecot_plain authenticator failed for ([89.116.164.85]) [99.65.144.89]:59914: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-08 09:32:21 dovecot_plain authenticator failed for (macts) [65.20.149.93]:40273: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.110.128.117
country_id: 3865483
description:
2025-12-08 09:31:45 dovecot_plain authenticator failed for ([89.116.164.85]) [181.110.128.117]:50376: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-12-08 09:34:24 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:63890: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 09:34:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<kf9l5GhFfOdnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-08 09:34:40 dovecot_login authenticator failed for (nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:46558: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 09:34:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ztOH5WhFYtJn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.157.64
country_id: 6252001
description:
Dec  8 09:36:22 host2 sshd[3556329]: Disconnected from invalid user moodle 172.191.157.64 port 45442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 09:37:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ICjs7mhFhJg+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 09:37:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<NET472hF4r8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.164.150.218
country_id: 1269750
description:
Dec  8 09:37:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=194.164.150.218, lip=66.85.158.91, session=<UyAU8GhFIrPCpJba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 09:38:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ZPxP82hFtJ1n9M4G>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.183.155.132
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.183.155.132 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.116.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.151.116.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.33.117.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.33.117.80 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.177.116.42
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.177.116.42 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.45.80.159
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.45.80.159 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.6
country_id: 3703430
description:
Dec  8 09:42:09 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.6, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<FAq2/2hFkfot4/4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec  8 09:42:33 host2 sshd[3560080]: Disconnected from invalid user user 172.191.157.64 port 58104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 09:43:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<MubDAmlFApY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 09:44:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<L5RrB2lFWIA+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-08 09:43:36 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (derpal) [68.40.189.43]:49670: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 09:45:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=</iUgDWlFCOCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 09:46:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<JluzDmlFyp2G0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.252
country_id: 3469034
description:
Dec  8 09:47:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.183.92.252, lip=66.85.158.91, TLS, session=<kGZmE2lFhustt1z8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.249.18
country_id: 3469034
description:
Dec  8 09:47:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=170.245.249.18, lip=66.85.158.91, TLS, session=<MHA9EmlFxLaq9fkS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-08 09:49:03 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (fecruroph) [24.23.125.83]:48716: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 09:49:07 dovecot_plain authenticator failed for (pergic) [154.144.243.93]:42122: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 09:48:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<pKCWFmlFGLMv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 09:50:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<hcj8HGlFqK4+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 09:50:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<9ACNHWlFlK4+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 09:51:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Ea3kIWlFjIvO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 09:52:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Fi//JGlFhqc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 09:52:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<r1TxJGlFQqo+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 09:52:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<TGKxJWlFJsCiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-08 09:53:02 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (chnon) [24.127.53.61]:60730: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 09:53:25 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (semes) [87.103.126.54]:3156: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 09:54:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qh5YLGlFUORnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.29
country_id: 3469034
description:
Dec  8 09:55:30 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=191.53.131.29, lip=66.85.158.91, TLS, session=<+2dZLmlFP9+/NYMd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.65.239.60
country_id: 3469034
description:
Dec  8 09:55:50 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.65.239.60, lip=66.85.158.91, TLS, session=<iTieL2lFZ4UtQe88>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.206.192.194
country_id: 6252001
description:
[2025-12-08 09:56:58 +0530] info [whostmgrd] 162.206.192.194 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.14.175.134
country_id: 6252001
description:
[2025-12-08 09:56:59 +0530] info [cpaneld] 24.14.175.134 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-08 09:56:28 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:60464: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.215.229.166
country_id: 6252001
description:
[2025-12-08 09:56:46 +0530] info [cpaneld] 66.215.229.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-12-08 09:56:50 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:37051: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.94.155
country_id: 6252001
description:
[2025-12-08 09:56:53 +0530] info [cpaneld] 76.39.94.155 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.20.76.251
country_id: 6252001
description:
[2025-12-08 09:57:02 +0530] info [cpaneld] 99.20.76.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.176.51
country_id: 6252001
description:
[2025-12-08 09:56:44 +0530] info [cpaneld] 76.33.176.51 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-12-08 09:56:46 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:38670: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-08 09:57:53 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (caccuffes) [73.183.74.177]:53922: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Dec  8 09:59:00 host2 sshd[3573907]: Disconnected from invalid user kubernetes 103.187.147.92 port 39968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-08 10:01:07 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:58652: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-08 10:01:20 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:49294: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-08 10:02:04 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:34508: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-08 10:02:21 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:47934: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.92
country_id: 1643084
description:
Dec  8 10:03:46 host2 sshd[3578096]: Disconnected from invalid user oc 103.187.147.92 port 56760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 10:04:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<zYMoUGlFyIql6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 10:06:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<CSTCVWlFPJe8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Dec  8 10:06:17 host2 sshd[3580191]: Disconnected from invalid user tempusr 103.157.25.60 port 45186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 10:07:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VE1QWWlFMOEv+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.131.111.139
country_id: 2750405
description:
[2025-12-08 10:07:21 +0530] info [webmaild] 45.131.111.139 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.13
country_id: 1819730
description:
Dec  8 10:10:05 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.13, lip=66.85.158.91, TLS, session=<9euhY2lFbhEtjpoN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.190.163.64
country_id: 1694008
description:
2025-12-08 10:09:24 dovecot_plain authenticator failed for ([89.116.164.85]) [180.190.163.64]:42434: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.230.57.87
country_id: 6252001
description:
2025-12-08 10:09:36 dovecot_plain authenticator failed for 76-230-57-87.lightspeed.livnmi.sbcglobal.net ([89.116.164.85]) [76.230.57.87]:51267: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec  8 10:09:45 host2 sshd[3582489]: Disconnected from invalid user ansible 103.210.22.105 port 43398 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:11:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hVh+Z2lFnqADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:11:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<p2gJaWlFIOsDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 10:12:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<fj3OamlFJJQ+PIdr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 10:16:38 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:17:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<0u81fmlFDsMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:18:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<O7JwgGlFXo4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-08 10:19:43 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:58204: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-08 10:19:16 dovecot_login authenticator failed for ([88.255.189.21]) [88.255.189.21]:40612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-08 10:19:21 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:54054: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec  8 10:19:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<hysvhWlFBp1ChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-08 10:19:34 dovecot_login authenticator failed for ([102.38.3.109]) [102.38.3.109]:52129: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:20:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hwZRh2lFVuQDg9cm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 10:20:34 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-08 10:21:30 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:46394: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:21:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oBYTjWlFep0Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-08 10:21:12 dovecot_login authenticator failed for ([182.95.58.130]) [182.95.58.130]:32776: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Dec  8 10:22:19 host2 sshd[3592448]: Disconnected from invalid user user 103.157.25.60 port 57704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 10:22:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<2BUGkGlFPJM+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:22:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<UZ9akGlFDMIDg9cm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 10:22:50 host2 sshd[3592717]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.105
country_id: 1880251
description:
Dec  8 10:23:14 host2 sshd[3592986]: Disconnected from invalid user username 103.210.22.105 port 37690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec  8 10:26:24 host2 sshd[3594884]: Disconnected from invalid user tempusr 36.37.122.175 port 44222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-08 10:27:20 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:40050: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-08 10:27:31 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:52270: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-08 10:27:40 dovecot_login authenticator failed for (nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:45638: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-08 10:26:58 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:54780: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 10:27:54 host2 sshd[3595862]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.98
country_id: 6252001
description:
2025-12-08 10:28:04 dovecot_login authenticator failed for ([70.174.168.98]) [70.174.168.98]:57926: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec  8 10:28:12 host2 sshd[3596084]: Disconnected from invalid user strategy 103.210.22.105 port 49222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 10:33:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<TKxRtmlFPI4+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 10:33:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<JDmit2lF2t8+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec  8 10:35:34 host2 sshd[3601253]: Disconnected from invalid user username 103.210.22.105 port 54664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-08 10:35:39 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:47624: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.9
country_id: 1861060
description:
2025-12-08 10:36:07 dovecot_login authenticator failed for p160010-obmd01.osaka.ocn.ne.jp [61.112.103.9]:56017: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.204.132.188
country_id: 6252001
description:
[2025-12-08 10:37:20 +0530] info [whostmgrd] 71.204.132.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.190.127.74
country_id: 6252001
description:
[2025-12-08 10:37:23 +0530] info [cpaneld] 97.190.127.74 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.91.48.77
country_id: 6252001
description:
[2025-12-08 10:37:36 +0530] info [cpaneld] 50.91.48.77 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.140.51.36
country_id: 6252001
description:
[2025-12-08 10:37:44 +0530] info [cpaneld] 73.140.51.36 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 10:36:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<vqyHw2lFeKo+PIce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.76.239
country_id: 6252001
description:
[2025-12-08 10:37:01 +0530] info [cpaneld] 129.222.76.239 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.6.173.66
country_id: 6252001
description:
[2025-12-08 10:37:17 +0530] info [cpaneld] 67.6.173.66 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 10:38:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<FmQvymlFLNc+PIcl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 10:39:17 host2 sshd[3603562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-08 10:39:34 dovecot_login authenticator failed for ([125.19.156.2]) [125.19.156.2]:53284: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-08 10:39:20 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:56485: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 10:39:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<stUSzmlFcpo+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.178.81.97
country_id: 6252001
description:
2025-12-08 10:40:44 dovecot_plain authenticator failed for ([89.116.164.85]) [72.178.81.97]:42514: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Dec  8 10:41:07 host2 sshd[3604852]: Disconnected from invalid user postgres 36.37.122.175 port 33832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 10:41:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 22 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7yV902lF7dcjy9Nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.188.151.33
country_id: 3573345
description:
2025-12-08 10:40:55 dovecot_plain authenticator failed for ([89.116.164.85]) [206.188.151.33]:37528: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.104.242.58
country_id: 3895114
description:
2025-12-08 10:41:08 dovecot_plain authenticator failed for pc-58-242-104-200.cm.vtr.net ([89.116.164.85]) [200.104.242.58]:51482: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 10:41:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<7CV51WlFuqYXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 10:42:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wafB12lFVvEjy9Nr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec  8 10:43:39 host2 sshd[3606650]: Disconnected from invalid user postgres 142.93.27.16 port 53508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 10:42:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<4vYM2WlFqvkjy9Nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-12-08 10:47:27 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:64458: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec  8 10:47:31 host2 sshd[3609501]: Disconnected from invalid user dogecoin 36.37.122.175 port 57616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-08 10:47:37 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:36452: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 10:48:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS, session=<ydJk7WlFIPgjy9Nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.241.195
country_id: 99237
description:
2025-12-08 10:49:00 dovecot_plain authenticator failed for ([89.116.164.85]) [62.201.241.195]:33359: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.191.207.85
country_id: 1694008
description:
2025-12-08 10:49:15 dovecot_plain authenticator failed for ([89.116.164.85]) [180.191.207.85]:27346: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 10:50:10 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (doctur) [87.103.126.54]:56741: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-08 10:50:52 dovecot_plain authenticator failed for (haugn) [103.51.26.198]:38314: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 10:50:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4pZA9WlFKIY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-08 10:50:55 dovecot_plain authenticator failed for (otiole) [81.0.54.119]:38614: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 10:51:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ztkG9mlF5Lw+PIcd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.189.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.189.56 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.178.104.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.178.104.12 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.231.224.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.231.224.217 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.26.106
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.30.26.106 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.217.78.74
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 107.217.78.74 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.47.77.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.47.77.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 10:56:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<TAYXCGpFooY+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.203
country_id: 6252001
description:
Dec  8 10:59:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.203, lip=66.85.158.92, TLS: Connection closed, session=<T4KYFGpFs7tb5qjL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 10:59:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<XKmSFGpFgs0+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 10:59:37 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (supettoph) [87.103.126.54]:54820: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.106
country_id: 6252001
description:
Dec  8 10:59:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.106, lip=66.85.158.92, TLS handshaking: Connection closed, session=</5YLE2pF/5Bb5qhq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.201
country_id: 6252001
description:
Dec  8 10:59:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.201, lip=66.85.158.92, TLS: Connection closed, session=<Ke+xE2pFl+Nb5qjJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.105
country_id: 6252001
description:
Dec  8 10:59:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.105, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rxhqFGpFI+Zb5qhp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-08 11:00:00 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:38177: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-12-08 11:00:27 dovecot_login authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:53826: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.62.248.21
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 194.62.248.21 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 11:01:38 host2 sshd[3619039]: Disconnected from invalid user user 2.57.121.25 port 35306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 11:01:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<d1eKHGpFeJM+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-08 11:02:01 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (rentlevoid) [73.183.74.177]:42604: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 11:02:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<oewRH2pFDsg+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 11:02:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49631: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec  8 11:03:22 host2 sshd[3620418]: Disconnected from invalid user oracle 182.253.156.184 port 52930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 11:05:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<rugnKGpFqsw+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-08 11:05:34 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:36162: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-12-08 11:05:53 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:59507: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 11:07:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<SMSNMGpFNMg+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.62
country_id: 3175395
description:
Dec  8 11:08:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.197.9.62, lip=66.85.158.91, TLS, session=<679CNWpF+tS5xQk+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.204
country_id: 3469034
description:
Dec  8 11:09:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.250.204, lip=66.85.158.91, TLS, session=<1B5tNmpF/Zm60frM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.25.233
country_id: 6252001
description:
[2025-12-08 11:11:06 +0530] info [cpaneld] 98.97.25.233 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.58.47
country_id: 6252001
description:
[2025-12-08 11:11:08 +0530] info [cpaneld] 47.157.58.47 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.126.205.7
country_id: 6252001
description:
[2025-12-08 11:11:21 +0530] info [cpaneld] 172.126.205.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.128.246
country_id: 99237
description:
Dec  8 11:11:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=65.20.128.246, lip=66.85.158.91, TLS, session=<lQxKPmpFnNhBFID2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.24.202.154
country_id: 798544
description:
Dec  8 11:11:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=193.24.202.154, lip=66.85.158.91, TLS, session=<6udeP2pFK9PBGMqa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Dec  8 11:11:00 host2 sshd[3627124]: Disconnected from invalid user moodle 182.253.156.184 port 43520 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.154.231
country_id: 6252001
description:
[2025-12-08 11:11:18 +0530] info [whostmgrd] 76.175.154.231 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.18.129
country_id: 6252001
description:
[2025-12-08 11:11:20 +0530] info [cpaneld] 47.141.18.129 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.88.81.204
country_id: 6252001
description:
[2025-12-08 11:10:53 +0530] info [cpaneld] 75.88.81.204 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  8 11:11:00 host2 sshd[3627130]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:12:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<niK/QmpFIL4DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec  8 11:12:18 host2 sshd[3627813]: Disconnected from invalid user jacob 182.253.156.184 port 41952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:13:16 host2 sshd[3628402]: Disconnected from invalid user aws 103.76.120.90 port 50908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-08 11:13:33 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:40656: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:13:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<69avR2pFfskDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-08 11:14:04 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:47478: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 11:14:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<neGeSGpFEuYv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-08 11:14:35 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:39722: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec  8 11:14:51 host2 sshd[3629335]: Disconnected from invalid user spring2024 182.253.156.184 port 38812 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:15:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<H0DcTmpFnIcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:17:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<jn68U2pFcO0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:18:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<LX08V2pFaKcDjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 11:17:57 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:19:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cW/gXGpFCI8DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:20:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<w13jXWpF7swDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 11:20:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<jGXrXmpFFqo+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:21:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lLH9YWpFJtoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:22:34 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<3dPcZmpFGMcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-08 11:23:10 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:50208: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.244.245.134
country_id: 6252001
description:
[2025-12-08 11:24:42 +0530] info [webmaild] 207.244.245.134 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-08 11:25:51 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:45111: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.26.151.98
country_id: 3865483
description:
2025-12-08 11:26:31 dovecot_plain authenticator failed for ([89.116.164.85]) [181.26.151.98]:59779: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.122.219.227
country_id: 3625428
description:
2025-12-08 11:26:49 dovecot_plain authenticator failed for ([89.116.164.85]) [190.122.219.227]:34932: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-08 11:26:06 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:49248: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-08 11:26:24 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:46938: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.122.219.227
country_id: 3625428
description:
2025-12-08 11:26:55 dovecot_login authenticator failed for ([89.116.164.85]) [190.122.219.227]:34932: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-08 11:27:47 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:58918: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-08 11:28:00 dovecot_plain authenticator failed for (oboxis) [92.62.243.175]:45383: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-08 11:27:59 dovecot_login authenticator failed for (246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:56814: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:28:37 host2 sshd[3640473]: Disconnected from invalid user jacob 103.76.120.90 port 39772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.172.11.186
country_id: 1269750
description:
Dec  8 11:29:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.172.11.186, lip=66.85.158.91, TLS, session=<QtZ8fWpFo+RnrAu6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec  8 11:29:25 host2 sshd[3641004]: Disconnected from invalid user infocare 190.181.27.22 port 59640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.160
country_id: 798544
description:
Dec  8 11:29:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.160, lip=66.85.158.91, TLS, session=<S0CyfmpF/a0u4yeg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.214.95.31
country_id: 3469034
description:
2025-12-08 11:30:16 dovecot_plain authenticator failed for ([89.116.164.85]) [186.214.95.31]:53612: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.21.144.230
country_id: 3895114
description:
2025-12-08 11:30:29 dovecot_plain authenticator failed for ([89.116.164.85]) [190.21.144.230]:49890: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.255.186.21
country_id: 3469034
description:
2025-12-08 11:30:02 dovecot_plain authenticator failed for ([89.116.164.85]) [143.255.186.21]:55448: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-08 11:31:32 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (evermulf) [67.173.58.47]:45644: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec  8 11:32:06 host2 sshd[3643509]: Disconnected from invalid user infocare 190.181.27.22 port 36112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.30
country_id: 2635167
description:
Dec  8 11:32:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.30, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XpzliWpF1a1X7LAe>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.120
country_id: 2635167
description:
Dec  8 11:32:21 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.120, lip=66.85.158.91, TLS, session=<c8zQiWpFwY2594l4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.19
country_id: 2635167
description:
Dec  8 11:32:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.19, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<k+bgi2pFLaVX7LAT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Dec  8 11:33:29 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kEHcjWpFq5m594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.37
country_id: 2635167
description:
Dec  8 11:34:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.37, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<06vXj2pF9ZpX7LAl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.4
country_id: 2635167
description:
Dec  8 11:34:35 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.4, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<nAzTkWpFG42594kE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.133.4
country_id: 99237
description:
Dec  8 11:34:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=65.20.133.4, lip=66.85.158.91, TLS, session=<zBzGkWpFarNBFIUE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.31
country_id: 2635167
description:
Dec  8 11:35:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.31, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<TIXMk2pFn96594kf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.16
country_id: 2635167
description:
Dec  8 11:35:42 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.16, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<oarJlWpF18m594kQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 11:35:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<AIvalWpFQJU+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.30.161.197
country_id: 690791
description:
Dec  8 11:35:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=46.30.161.197, lip=66.85.158.91, TLS, session=<8vvpkmpFr78uHqHF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 11:36:04 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.33
country_id: 2635167
description:
Dec  8 11:36:15 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.33, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<uy3Fl2pFX8C594kh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.18
country_id: 2635167
description:
Dec  8 11:36:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.18, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<4Ze+mWpFj8S594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.33
country_id: 2635167
description:
Dec  8 11:37:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.33, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<A9m5m2pFN7S594kh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.102
country_id: 6252001
description:
2025-12-08 11:37:36 dovecot_login authenticator failed for ([98.185.120.102]) [98.185.120.102]:52983: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.6
country_id: 3703430
description:
Dec  8 11:38:41 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.6, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<M+97oGpFzfot4/4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.193.134
country_id: 1269750
description:
2025-12-08 11:37:53 dovecot_login authenticator failed for ([122.175.193.134]) [122.175.193.134]:50098: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 11:38:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+LYcn2pFgokv/lVz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 11:38:54 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-08 11:39:32 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:32861: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-08 11:40:09 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:34380: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-08 11:40:12 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:55768: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:40:42 host2 sshd[3649219]: Disconnected from invalid user jenkins 103.76.120.90 port 53710 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 11:41:25 dovecot_plain authenticator failed for (ationo) [154.144.243.93]:33088: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.171.38.111
country_id: 3469034
description:
2025-12-08 11:43:06 dovecot_plain authenticator failed for ([89.116.164.85]) [177.171.38.111]:55321: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.27.33
country_id: 3865483
description:
2025-12-08 11:43:22 dovecot_plain authenticator failed for ([89.116.164.85]) [168.196.27.33]:45334: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 11:46:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<7DrQvWpFnIk+PIcp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec  8 11:47:00 host2 pure-ftpd[3654199]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 11:47:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<ZeuCwGpFjJk+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 11:50:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<v7dhyWpF8J8+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:51:34 host2 sshd[3657209]: Disconnected from invalid user oracle 103.76.120.90 port 52226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 11:51:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<xHWtzGpFHrc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-08 11:52:51 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:51872: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-08 11:51:56 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:50822: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.34.34.142
country_id: 6252001
description:
[2025-12-08 11:52:02 +0530] info [cpaneld] 136.34.34.142 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec  8 11:52:41 host2 sshd[3658130]: Disconnected from invalid user dell 190.181.27.22 port 40804 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.197.25.119
country_id: 6252001
description:
[2025-12-08 11:52:11 +0530] info [cpaneld] 107.197.25.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.115.234
country_id: 6252001
description:
[2025-12-08 11:52:19 +0530] info [cpaneld] 73.199.115.234 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.207.225.217
country_id: 6252001
description:
[2025-12-08 11:52:17 +0530] info [cpaneld] 107.207.225.217 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 11:52:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<xtkr0WpFPqM+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-08 11:51:56 dovecot_plain authenticator failed for (grapopyrs) [24.93.140.162]:59744: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.79.122.75
country_id: 6252001
description:
[2025-12-08 11:52:00 +0530] info [cpaneld] 173.79.122.75 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.253.203.214
country_id: 6252001
description:
[2025-12-08 11:52:06 +0530] info [cpaneld] 98.253.203.214 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.52.150.61
country_id: 6252001
description:
[2025-12-08 11:52:07 +0530] info [whostmgrd] 98.52.150.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-08 11:53:32 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:59728: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-08 11:53:37 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:64097: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:53:09 host2 sshd[3658464]: Disconnected from invalid user jacob 103.76.120.90 port 34126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-08 11:53:13 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:37416: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.32
country_id: 6252001
description:
2025-12-08 11:53:16 dovecot_login authenticator failed for ([98.181.46.32]) [98.181.46.32]:54517: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.159.209.200
country_id: 6252001
description:
[2025-12-08 11:54:02 +0530] info [cpaneld] 50.159.209.200 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.142.161.81
country_id: 6252001
description:
[2025-12-08 11:54:11 +0530] info [whostmgrd] 69.142.161.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.222.79.143
country_id: 6252001
description:
[2025-12-08 11:54:18 +0530] info [cpaneld] 73.222.79.143 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.133.196.68
country_id: 6252001
description:
[2025-12-08 11:53:58 +0530] info [cpaneld] 75.133.196.68 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.41.61.33
country_id: 6252001
description:
[2025-12-08 11:54:25 +0530] info [cpaneld] 38.41.61.33 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.203.112.182
country_id: 6252001
description:
[2025-12-08 11:54:38 +0530] info [cpaneld] 170.203.112.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.168.50
country_id: 6252001
description:
[2025-12-08 11:54:05 +0530] info [cpaneld] 98.97.168.50 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-08 11:56:08 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:55599: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.146
country_id: 3996063
description:
2025-12-08 11:56:19 dovecot_login authenticator failed for (187.161.222.146-clientes-izzi.mx) [187.161.222.146]:35787: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-08 11:56:35 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:59584: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 11:56:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<faYZ4WpFLp0+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.95
country_id: 6252001
description:
Dec  8 11:57:36 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.95, lip=66.85.158.92, TLS, session=<g+Yj5GpF6PLG6xhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-08 11:56:55 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:43800: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.6.216
country_id: 3144096
description:
2025-12-08 12:01:56 dovecot_login authenticator failed for ([178.232.6.216]) [178.232.6.216]:52654: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-08 12:03:29 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:33236: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 12:03:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0Onl+WpFGO4+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 12:04:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Pe7X/GpFjLg+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-08 12:03:58 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:42470: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-08 12:07:56 dovecot_plain authenticator failed for (raphewhing) [102.53.15.180]:47955: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-08 12:08:06 dovecot_plain authenticator failed for (ineating) [65.20.143.159]:47409: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 12:08:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<OMmWDGtFOtM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 12:12:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<RJ1UGmtFers+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 12:13:04 host2 sshd[3674646]: Disconnected from invalid user admin 2.57.121.112 port 31254 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 12:13:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<RRW2G2tFaL0+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 12:13:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<IJyAHmtFRqA+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 12:15:50 host2 sshd[3676885]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.161.218.35
country_id: 290291
description:
2025-12-08 12:14:56 dovecot_plain authenticator failed for 109-161-218-35.rev.bb.zain.com ([89.116.164.85]) [109.161.218.35]:56690: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.52.219.236
country_id: 1694008
description:
2025-12-08 12:15:13 dovecot_plain authenticator failed for ([89.116.164.85]) [122.52.219.236]:58952: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.21.78.198
country_id: 1269750
description:
2025-12-08 12:15:28 dovecot_plain authenticator failed for ([89.116.164.85]) [103.21.78.198]:13710: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 12:17:30 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (noneemeeze) [87.103.126.54]:46552: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 12:18:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<WFDtLWtFlpk+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 12:20:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (delige) [87.103.126.54]:60653: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.51
country_id: 1269750
description:
Dec  8 12:20:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.109.178.51, lip=66.85.158.91, TLS, session=<1AGZM2tFDrVnbbIz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.222.40
country_id: 798544
description:
Dec  8 12:20:26 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=213.92.222.40, lip=66.85.158.91, TLS, session=<0BHQNGtFZMzVXN4o>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 12:20:58 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 12:21:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<UK5sOGtFgLw+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-08 12:23:20 dovecot_plain authenticator failed for (yewingstne) [41.248.243.181]:47342: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.197.82
country_id: 2186224
description:
2025-12-08 12:22:52 dovecot_login authenticator failed for 219-89-197-82.adsl.xtra.co.nz [219.89.197.82]:57706: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-08 12:23:05 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:33398: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-08 12:24:04 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:50695: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-08 12:24:23 dovecot_login authenticator failed for ([182.78.241.30]) [182.78.241.30]:55814: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-12-08 12:26:36 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:51872: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-08 12:26:45 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:34870: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.226
country_id: 3469034
description:
Dec  8 12:26:49 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=186.209.251.226, lip=66.85.158.91, TLS, session=<hd+MS2tFu6a60fvi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 12:27:13 host2 sshd[3685574]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.250
country_id: 3469034
description:
Dec  8 12:27:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.248.250, lip=66.85.158.91, TLS, session=<ZWH6TGtFmK260fj6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 12:28:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<6GvuUWtFhIQ+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.47
country_id: 6252001
description:
2025-12-08 12:28:26 dovecot_login authenticator failed for ([98.181.46.47]) [98.181.46.47]:55006: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-12-08 12:28:41 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:38920: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-08 12:28:59 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:38638: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-08 12:29:21 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:33152: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-08 12:30:53 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:53339: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-08 12:31:03 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:56135: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 12:33:44 host2 sshd[3689512]: Disconnected from invalid user user 2.57.121.25 port 6084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-08 12:37:46 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:49534: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-08 12:37:56 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:41394: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 12:39:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<CPsxeGtFJugv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 12:40:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<boF7fGtF3JAXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Dec  8 12:40:16 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<2LG0fGtFaOtHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Dec  8 12:40:18 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<gN7YfGtFkoNHBpK5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.233.246.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.233.246.219 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.162.80.98
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.162.80.98 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.135.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.66.135.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.174.233.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.174.233.54 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.120.106
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.120.106 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.93.54.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.93.54.130 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-08 12:45:56 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:37662: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.90
country_id: 1269750
description:
2025-12-08 12:46:17 dovecot_login authenticator failed for ([182.95.228.90]) [182.95.228.90]:37552: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.113
country_id: 2186224
description:
2025-12-08 12:48:04 dovecot_login authenticator failed for ([121.73.168.113]) [121.73.168.113]:56280: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.185.164.76
country_id: 2077456
description:
2025-12-08 12:48:23 dovecot_login authenticator failed for (cpe-101-185-164-76.wb06.wa.asp.telstra.net) [101.185.164.76]:43482: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-08 12:48:39 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:52362: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-08 12:48:47 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:48028: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.209.110
country_id: 1269750
description:
2025-12-08 12:49:05 dovecot_login authenticator failed for ([182.95.12.209]) [152.52.209.110]:55274: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.148
country_id: 953987
description:
Dec  8 12:49:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=102.129.55.148, lip=66.85.158.91, TLS, session=<g/NEm2tF77FmgTeU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.100
country_id: 3175395
description:
Dec  8 12:49:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.8.100, lip=66.85.158.91, TLS, session=<nnp9nGtFP6m5xQhk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-08 12:51:14 dovecot_plain authenticator failed for ool-457e901e.dyn.optonline.net (whiseepida) [69.126.144.30]:63472: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-08 12:52:55 dovecot_login authenticator failed for (182.239.78.49.hk.chinamobile.com) [182.239.78.49]:21404: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-08 12:54:16 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:39246: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-12-08 12:54:30 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:33196: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.33.101.74
country_id: 3077311
description:
Dec  8 12:58:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=46.33.101.74, lip=66.85.158.91, TLS, session=<QgBbu2tFqQwuIWVK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.44
country_id: 953987
description:
Dec  8 12:58:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.57.44, lip=66.85.158.91, TLS, session=<hexzvGtF96FmgTks>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.82.78.37
country_id: 1269750
description:
2025-12-08 12:58:32 dovecot_plain authenticator failed for (LE7AQH53ZALJ4) [103.82.78.37]:28718: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.216.154.78
country_id: 2635167
description:
2025-12-08 12:59:38 dovecot_login authenticator failed for ([62.216.154.78]) [62.216.154.78]:51983: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-08 13:00:48 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:50796: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 13:00:47 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (idisreval) [68.60.77.128]:51272: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-08 12:59:57 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:40202: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.252
country_id: 3469034
description:
Dec  8 13:00:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=200.196.143.252, lip=66.85.158.91, TLS, session=<esmAw2tFiIzIxI/8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 13:00:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<QZW+xGtFWoE+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.2
country_id: 226074
description:
Dec  8 13:00:42 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.119.2, lip=66.85.158.91, TLS, session=<nGOoxGtFp4rEAHcC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-08 13:00:58 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:51388: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 13:02:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jFCEzWtFUq4v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-08 13:03:51 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:56342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-08 13:04:08 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:54486: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-08 13:05:04 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:54798: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-08 13:05:10 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:44106: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-08 13:05:21 dovecot_login authenticator failed for a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:48548: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-08 13:05:20 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:59914: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-08 13:05:45 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:49029: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-12-08 13:05:46 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61396: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-08 13:07:28 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (domangneus) [24.61.199.212]:51294: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.164.121.172
country_id: 1643084
description:
2025-12-08 13:06:59 dovecot_plain authenticator failed for (CEJ5O) [125.164.121.172]:54480: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-08 13:09:10 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl (sysciones) [91.202.230.214]:33189: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-08 13:18:07 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:39308: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-08 13:18:17 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (nohen) [24.61.199.212]:51462: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-08 13:18:21 dovecot_plain authenticator failed for (stable) [41.248.243.181]:52628: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-08 13:18:20 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:33836: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 13:22:31 host2 sshd[3715569]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.118.202
country_id: 226074
description:
Dec  8 13:23:24 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=196.0.118.202, lip=66.85.158.91, TLS, session=<FFXMFWxFpuzEAHbK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.210.57
country_id: 933860
description:
Dec  8 13:23:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.210.57, lip=66.85.158.91, TLS, session=<qCQmF2xFhcYp2NI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-08 13:24:38 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:55768: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-12-08 13:24:13 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:37786: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.71.7
country_id: 1643084
description:
2025-12-08 13:25:44 dovecot_plain authenticator failed for ([89.116.164.85]) [103.172.71.7]:42568: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 13:24:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ydF3HGxFLJQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.194.80.205
country_id: 3865483
description:
2025-12-08 13:25:57 dovecot_plain authenticator failed for ([89.116.164.85]) [190.194.80.205]:49395: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.99.35.165
country_id: 102358
description:
2025-12-08 13:26:10 dovecot_plain authenticator failed for ([89.116.164.85]) [94.99.35.165]:51075: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.71.7
country_id: 1643084
description:
2025-12-08 13:25:51 dovecot_login authenticator failed for ([89.116.164.85]) [103.172.71.7]:42568: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 13:26:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<IJewI2xFGMEXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec  8 13:29:28 host2 sshd[3718685]: Disconnected from invalid user user 125.20.16.22 port 61258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.225.161
country_id: 1210997
description:
2025-12-08 13:31:11 dovecot_plain authenticator failed for (L7V1JJ7) [103.111.225.161]:64105: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.78
country_id: 1269750
description:
2025-12-08 13:31:25 dovecot_login authenticator failed for (nsg-corporate-78.225.187.122.airtel.in) [122.187.225.78]:46775: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-08 13:31:37 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:41186: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.206.160
country_id: 6252001
description:
Dec  8 13:30:54 host2 sshd[3719719]: Disconnected from invalid user postgres 152.32.206.160 port 40500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 13:32:43 host2 sshd[3720518]: Disconnected from invalid user admin 2.57.121.112 port 11776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec  8 13:33:46 host2 sshd[3721028]: Disconnected from invalid user ansible 64.23.180.137 port 52704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 13:35:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cySqQmxFYtYXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec  8 13:38:06 host2 sshd[3723134]: Disconnected from invalid user linode 64.23.180.137 port 43676 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.81.90
country_id: 6252001
description:
Dec  8 13:40:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.81.90, lip=66.85.158.91, session=<CTKcU2xF7IYUqVFa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec  8 13:40:59 host2 sshd[3724733]: Disconnected from invalid user admin 152.200.205.179 port 53280 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec  8 13:41:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: Connection closed, session=<uqrwVmxFRmNChJmA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.82.78.37
country_id: 1269750
description:
2025-12-08 13:41:54 dovecot_plain authenticator failed for (E7G74M1Q) [103.82.78.37]:28372: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.18.151
country_id: 2921044
description:
Dec  8 13:41:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.18.151, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<frhEWWxF+W6fWRKX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.60.8
country_id: 2921044
description:
Dec  8 13:42:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=206.189.60.8, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LHRiW2xFHg/OvTwI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Dec  8 13:42:35 host2 sshd[3725330]: Disconnected from invalid user admin 64.23.180.137 port 42228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-08 13:44:28 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (chomnoning) [24.15.216.41]:39250: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-08 13:45:09 dovecot_plain authenticator failed for (commencys) [105.72.176.66]:52866: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 13:45:50 host2 sshd[3727923]: Disconnected from invalid user user 2.57.121.25 port 28644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec  8 13:45:52 host2 sshd[3727985]: Disconnected from invalid user postgres 64.23.180.137 port 47558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec  8 13:45:54 host2 sshd[3728021]: Disconnected from invalid user middleware 152.200.205.179 port 33746 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.105
country_id: 6252001
description:
Dec  8 13:48:33 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.105, lip=66.85.158.92, TLS, session=<HHrscGxFrO2TuYRp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-08 13:48:58 dovecot_plain authenticator failed for (purabledly) [149.62.239.4]:60594: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Dec  8 13:50:13 host2 sshd[3730435]: Disconnected from invalid user user 152.32.206.160 port 38786 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 13:50:18 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec  8 13:50:48 host2 sshd[3730725]: Disconnected from invalid user hyperv 152.200.205.179 port 45636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec  8 13:52:34 host2 sshd[3731508]: Disconnected from invalid user postgres 125.20.16.22 port 49934 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.205.179
country_id: 3686110
description:
Dec  8 13:52:03 host2 sshd[3731332]: Disconnected from invalid user tempusr 152.200.205.179 port 55896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec  8 13:53:18 host2 sshd[3731856]: Disconnected from invalid user dell 152.200.205.179 port 59378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 13:54:56 host2 sshd[3732926]: Disconnected from invalid user user 2.57.121.25 port 11056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec  8 13:56:23 host2 sshd[3734111]: Disconnected from invalid user petastar 125.20.16.22 port 59464 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.83
country_id: 6252001
description:
Dec  8 13:57:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.83, lip=66.85.158.92, session=<YF3qkGxFPLoUQcFT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-12-08 14:02:22 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:51762: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-08 14:02:38 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:58494: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-12-08 14:02:43 dovecot_login authenticator failed for ([207.188.158.216]) [207.188.158.216]:37129: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-12-08 14:02:11 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:58930: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2025-12-08 14:02:14 dovecot_login authenticator failed for (abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:48888: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-08 14:03:11 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:54832: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.154
country_id: 3017382
description:
Dec  8 14:04:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=91.196.152.154, lip=66.85.158.92, TLS: Connection closed, session=<djsJqmxFo4tbxJia>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.159
country_id: 3017382
description:
Dec  8 14:04:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.159, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<noaCqmxFd8lbxJif>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.153
country_id: 3017382
description:
Dec  8 14:04:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.153, lip=66.85.158.92, TLS: Connection closed, session=<012yqmxFcbZbxJiZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.63
country_id: 3017382
description:
Dec  8 14:04:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=91.196.152.63, lip=66.85.158.92, TLS: Connection closed, session=<bt7WqmxFh7dbxJg/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.225
country_id: 3017382
description:
Dec  8 14:04:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.196.152.225, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pWUrqWxFa51bxJjh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.85
country_id: 3017382
description:
Dec  8 14:04:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.196.152.85, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oBv7qWxFTeBbxJhV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 14:05:06 host2 sshd[3738396]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.87
country_id: 3017382
description:
Dec  8 14:04:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.87, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dP1kq2xFG+BbxJhX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.83
country_id: 3017382
description:
Dec  8 14:04:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.83, lip=66.85.158.92, TLS: Connection closed, session=<uTmVq2xFkaBbxJhT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 14:05:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<fzejq2xF9s0v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-08 14:06:54 dovecot_plain authenticator failed for (zergs) [5.76.44.40]:52736: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-12-08 14:06:57 dovecot_plain authenticator failed for (encte) [84.238.92.245]:35895: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec  8 14:07:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3nnys2xFxkxChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-08 14:07:34 dovecot_plain authenticator failed for (panced) [199.192.123.12]:53014: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 14:16:39 host2 sshd[3745964]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.45
country_id: 953987
description:
Dec  8 14:22:38 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=102.129.53.45, lip=66.85.158.91, TLS, session=<iJ2u6WxFsa5mgTUt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.184.80.147
country_id: 3469034
description:
Dec  8 14:22:58 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.184.80.147, lip=66.85.158.91, TLS, session=<TZHx6mxF7LctuFCT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Dec  8 14:24:39 host2 sshd[3750602]: Disconnected from invalid user moodle 103.186.1.197 port 42322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
country_id: 1149361
description:
2025-12-08 14:25:54 dovecot_login authenticator failed for ([149.54.15.162]) [149.54.15.162]:46272: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-08 14:27:20 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:32475: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-08 14:27:33 dovecot_login authenticator failed for ([80.88.102.128]) [80.88.102.128]:52896: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 14:29:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<olsMA21FiIcv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.18
country_id: 130758
description:
Dec  8 14:29:50 host2 sshd[3753876]: Disconnected from invalid user jacob 109.122.251.18 port 54810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-12-08 14:30:24 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:38343: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-08 14:30:34 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:10835: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 14:35:07 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-12-08 14:36:03 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:37067: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-08 14:36:28 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:45764: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.224
country_id: 6252001
description:
Dec  8 14:37:15 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.224, lip=66.85.158.91, session=<ms0PH21FRvnN0h/g>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.116.39
country_id: 1819730
description:
Dec  8 14:39:05 host2 sshd[3760820]: Disconnected from invalid user moodle 154.219.116.39 port 42818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 14:39:21 dovecot_plain authenticator failed for (ingian) [154.144.243.93]:39788: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.116.39
country_id: 1819730
description:
Dec  8 14:42:48 host2 sshd[3763162]: Disconnected from invalid user workshop 154.219.116.39 port 40904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.63.126.250
country_id: 1733045
description:
2025-12-08 14:44:03 dovecot_plain authenticator failed for ([89.116.164.85]) [182.63.126.250]:27090: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.213.202.78
country_id: 1643084
description:
2025-12-08 14:44:18 dovecot_plain authenticator failed for ([89.116.164.85]) [140.213.202.78]:21549: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.19.66
country_id: 1269750
description:
2025-12-08 14:44:32 dovecot_plain authenticator failed for ([89.116.164.85]) [36.255.19.66]:8618: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-12-08 14:46:06 dovecot_login authenticator failed for ([125.215.199.37]) [125.215.199.37]:52351: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-08 14:46:17 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:46850: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 14:46:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60243: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.116.39
country_id: 1819730
description:
Dec  8 14:47:51 host2 sshd[3767052]: Disconnected from invalid user jacob 154.219.116.39 port 38532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-08 14:49:03 dovecot_plain authenticator failed for ([178.16.55.198]) [178.16.55.198]:61027: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.28.122
country_id: 1643084
description:
Dec  8 14:49:01 host2 sshd[3767812]: Disconnected from invalid user admin 36.88.28.122 port 33032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec  8 14:53:45 host2 sshd[3771374]: Disconnected from invalid user ubuntu 103.249.84.18 port 46276 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 14:54:44 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.28.122
country_id: 1643084
description:
Dec  8 14:57:41 host2 sshd[3774666]: Disconnected from invalid user tempusr 36.88.28.122 port 51880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  8 14:57:16 host2 sshd[3774283]: Disconnected from invalid user jenkins 203.150.107.244 port 45638 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 52.159.145.175
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 52.159.145.175: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.32.186
country_id: 1168579
description:
Dec  8 14:58:08 host2 sshd[3774921]: Disconnected from invalid user user 175.107.32.186 port 35377 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec  8 14:58:13 host2 sshd[3774974]: Disconnected from invalid user tempusr 85.18.236.229 port 45268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  8 14:58:22 host2 sshd[3775053]: Disconnected from invalid user user 203.150.107.244 port 43398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.151
country_id: 3469034
description:
Dec  8 14:58:50 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=186.209.248.151, lip=66.85.158.91, TLS, session=<Ojkoa21FYLa60fiX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.224
country_id: 3469034
description:
Dec  8 14:59:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.249.224, lip=66.85.158.91, TLS, session=<ik1pbG1FoMG60fng>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec  8 14:59:25 host2 sshd[3775845]: Disconnected from invalid user user 103.249.84.18 port 40532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  8 14:59:35 host2 sshd[3776030]: Disconnected from invalid user admin 203.150.107.244 port 41156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec  8 15:00:33 host2 sshd[3777120]: Disconnected from invalid user tempusr 52.250.16.220 port 32798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec  8 15:00:58 host2 sshd[3777455]: Disconnected from invalid user dell 201.249.192.30 port 59026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Dec  8 15:01:56 host2 sshd[3778128]: Disconnected from invalid user rsv 74.243.236.86 port 36056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.170
country_id: 6252001
description:
2025-12-08 15:01:54 dovecot_login authenticator failed for ([72.214.132.170]) [72.214.132.170]:52621: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  8 15:01:54 host2 sshd[3778117]: Disconnected from invalid user ubuntu 203.150.107.244 port 36672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.181.42
country_id: 3686110
description:
Dec  8 15:02:42 host2 sshd[3778801]: Disconnected from invalid user ubuntu 152.200.181.42 port 56276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.75.170
country_id: 3175395
description:
Dec  8 15:03:52 host2 sshd[3779798]: Disconnected from invalid user username 151.19.75.170 port 60075 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.180.237.36
country_id: 1269750
description:
Dec  8 15:04:40 host2 sshd[3780196]: Disconnected from invalid user ubuntu 103.180.237.36 port 58552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Dec  8 15:05:34 host2 sshd[3780805]: Disconnected from invalid user jacob 74.243.236.86 port 38748 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.243.236.86
country_id: 290557
description:
Dec  8 15:06:51 host2 sshd[3781543]: Disconnected from invalid user a2025 74.243.236.86 port 51146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec  8 15:07:06 host2 sshd[3781735]: Disconnected from invalid user admin 52.250.16.220 port 35650 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.222.40.122
country_id: 6252001
description:
Dec  8 15:08:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.222.40.122, lip=66.85.158.91, session=<N+CRjm1FtNaH3ih6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec  8 15:08:58 host2 sshd[3782786]: Disconnected from invalid user middleware 102.88.137.80 port 49844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec  8 15:09:36 host2 sshd[3783123]: Disconnected from invalid user jacob 103.249.84.18 port 46350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.32.186
country_id: 1168579
description:
Dec  8 15:09:57 host2 sshd[3783285]: Disconnected from invalid user ubuntu 175.107.32.186 port 10468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec  8 15:10:05 host2 sshd[3783562]: Disconnected from invalid user username 201.249.192.30 port 8208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.32.186
country_id: 1168579
description:
Dec  8 15:10:54 host2 sshd[3783998]: Disconnected from invalid user tempusr 175.107.32.186 port 60255 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-08 15:11:18 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (underef) [76.16.7.82]:47798: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec  8 15:11:49 host2 sshd[3784645]: Disconnected from invalid user ubuntu 85.18.236.229 port 44090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Dec  8 15:11:54 host2 sshd[3784693]: Disconnected from invalid user jenkins 41.223.40.77 port 40456 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.107.32.186
country_id: 1168579
description:
Dec  8 15:12:58 host2 sshd[3785315]: Disconnected from invalid user jenkins 175.107.32.186 port 38381 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Dec  8 15:14:33 host2 sshd[3786500]: Disconnected from invalid user whatsapp 41.223.40.77 port 56382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.153.196.154
country_id: 3865483
description:
Dec  8 15:15:22 host2 sshd[3787462]: Disconnected from invalid user jacob 186.153.196.154 port 40856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.32.35
country_id: 3175395
description:
Dec  8 15:17:08 host2 sshd[3788188]: Disconnected from invalid user admin 151.19.32.35 port 23120 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.77
country_id: 3351879
description:
Dec  8 15:19:55 host2 sshd[3789396]: Disconnected from invalid user tempusr 41.223.40.77 port 53296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-08 15:21:03 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (derlums) [73.145.107.251]:44218: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.153.33
country_id: 3658394
description:
2025-12-08 15:22:49 dovecot_plain authenticator failed for ([89.116.164.85]) [200.24.153.33]:56842: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.153.202.12
country_id: 6252001
description:
2025-12-08 15:23:00 dovecot_plain authenticator failed for ([89.116.164.85]) [184.153.202.12]:48222: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2025-12-08 15:23:04 dovecot_login authenticator failed for ([208.69.161.214]) [208.69.161.214]:45698: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.185.159.39
country_id: 1733045
description:
2025-12-08 15:23:13 dovecot_plain authenticator failed for ([89.116.164.85]) [202.185.159.39]:48089: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.41
country_id: 1733045
description:
2025-12-08 15:22:53 dovecot_login authenticator failed for ([49.124.146.41]) [49.124.146.41]:34814: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.153.33
country_id: 3658394
description:
2025-12-08 15:22:55 dovecot_login authenticator failed for ([89.116.164.85]) [200.24.153.33]:56842: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.81
country_id: 6252001
description:
Dec  8 15:24:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.81, lip=66.85.158.92, session=<sUalx21FDOEUQcJR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec  8 15:24:57 host2 sshd[3792650]: Disconnected from invalid user tempusr 103.249.84.18 port 45346 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 15:31:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<xx1f321FptEv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-12-08 15:33:20 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net (slaters) [74.90.213.28]:56850: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec  8 15:33:35 host2 sshd[3798489]: Disconnected from invalid user dell 102.88.137.80 port 49420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.209
country_id: 6252001
description:
Dec  8 15:34:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.209, lip=66.85.158.91, TLS, session=<oOKP7W1FAuHG6xjR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.120
country_id: 3996063
description:
2025-12-08 15:35:21 dovecot_login authenticator failed for (201.173.216.120-clientes-izzi.mx) [201.173.216.120]:58539: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-08 15:36:11 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:45671: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 15:37:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<2uJg9W1FDpGqQMFo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 15:41:22 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.61.160.114
country_id: 3017382
description:
Dec  8 15:43:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=72.61.160.114, lip=66.85.158.91, session=<hUQmC25FgJZIPaBy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 15:44:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<mKKwDW5F4K1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 15:44:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<UVPiDW5F6oCeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-08 15:46:12 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (vialmid) [73.197.194.98]:52082: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 15:46:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ckC0F25Fdp0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-12-08 15:47:03 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:38096: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-08 15:47:16 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:55060: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-08 15:48:18 dovecot_plain authenticator failed for (ruthis) [91.73.188.251]:38284: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 15:49:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Qu6DIm5FJJjO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 15:51:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<YXWIJ25F4MSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 15:51:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<XYjBJ25FcoBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.119.20.74
country_id: 298795
description:
2025-12-08 15:52:48 dovecot_plain authenticator failed for ([89.116.164.85]) [188.119.20.74]:48483: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.73.203.19
country_id: 3469034
description:
2025-12-08 15:52:34 dovecot_plain authenticator failed for host-203-19.host.stetnet.com.br ([89.116.164.85]) [187.73.203.19]:8297: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 15:53:29 host2 sshd[3812754]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.52.30.149
country_id: 3469034
description:
2025-12-08 15:53:01 dovecot_plain authenticator failed for ([89.116.164.85]) [177.52.30.149]:40997: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.119.20.74
country_id: 298795
description:
2025-12-08 15:52:55 dovecot_login authenticator failed for ([89.116.164.85]) [188.119.20.74]:48483: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.159.201
country_id: 2510769
description:
Dec  8 15:54:06 host2 sshd[3813322]: Disconnected from invalid user jenkins 187.33.159.201 port 45422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 15:54:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<Egf7M25FUJQ+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.35.25
country_id: 6252001
description:
Dec  8 15:54:47 host2 sshd[3813818]: Disconnected from invalid user jenkins 43.130.35.25 port 41258 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 15:55:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<lx1TN25FcIEv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-08 15:55:43 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (distauts) [69.123.219.82]:41818: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-12-08 15:55:22 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:38091: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-08 15:55:31 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:57965: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 15:55:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<SkYhOG5FUJcv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-08 15:55:54 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (regma) [73.145.107.251]:50926: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-08 15:56:40 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (hemic) [66.177.30.53]:60674: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.194.198.22
country_id: 1694008
description:
2025-12-08 15:58:31 dovecot_plain authenticator failed for ([89.116.164.85]) [180.194.198.22]:27630: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.106.127
country_id: 1269750
description:
2025-12-08 15:58:51 dovecot_plain authenticator failed for ([89.116.164.85]) [103.59.106.127]:15595: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 15:57:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<1ch0P25FbLk+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 15:58:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<0IgUQW5FqtE+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 15:58:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<0SKSQm5FTrtn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 15:59:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<91nSQ25F4ok+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-08 15:59:47 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:46244: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 15:58:54 host2 sshd[3816586]: Disconnected from invalid user user 197.138.129.15 port 52490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.106.127
country_id: 1269750
description:
2025-12-08 15:58:58 dovecot_login authenticator failed for ([89.116.164.85]) [103.59.106.127]:15595: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.114
country_id: 1269750
description:
2025-12-08 16:00:17 dovecot_login authenticator failed for ([182.78.120.220]) [182.95.49.114]:53286: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 16:00:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ukFtSG5FFNw+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 16:00:45 host2 sshd[3818084]: Disconnected from invalid user admin 2.57.121.112 port 58442 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 16:01:04 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 16:01:50 host2 sshd[3818781]: Disconnected from invalid user tempusr 197.138.129.15 port 58088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Dec  8 16:01:54 host2 sshd[3818804]: Disconnected from invalid user apple_store 104.248.17.208 port 50994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 16:03:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ROQuUm5FHMiuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 16:03:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<3jbAUm5FJuo+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-12-08 16:03:50 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:42923: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 16:04:03 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.235
country_id: 1733045
description:
2025-12-08 16:04:19 dovecot_login authenticator failed for ([49.124.152.235]) [49.124.152.235]:45946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 16:05:06 host2 sshd[3822417]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.228
country_id: 953987
description:
Dec  8 16:05:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.64.40.228, lip=66.85.158.91, TLS, session=<LItuWm5F2KBmQCjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.189
country_id: 3175395
description:
Dec  8 16:05:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=171.22.234.189, lip=66.85.158.91, TLS, session=<EixMWW5FpJmrFuq9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-08 16:05:29 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:55088: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-08 16:05:42 dovecot_login authenticator failed for (syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:39110: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-08 16:06:02 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:20958: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 16:06:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7OjhXG5FvtFn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-08 16:06:13 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:39708: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-12-08 16:06:23 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:44754: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-08 16:06:41 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:54453: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 16:06:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<JQFpX25FsKc+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 16:06:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ifbWX25FrrRnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.169.185
country_id: 2635167
description:
Dec  8 16:07:22 host2 sshd[3824376]: Disconnected from invalid user postgres 188.166.169.185 port 42536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.35.25
country_id: 6252001
description:
Dec  8 16:08:22 host2 sshd[3825090]: Disconnected from invalid user user 43.130.35.25 port 37518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Dec  8 16:09:24 host2 sshd[3825980]: Disconnected from invalid user user 104.248.17.208 port 56706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 16:09:39 host2 sshd[3826167]: Disconnected from invalid user admin 2.57.121.112 port 46193 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.134.123
country_id: 2802361
description:
Dec  8 16:10:24 host2 pure-ftpd[3826881]: (?@34.76.134.123) [INFO] New connection from 34.76.134.123


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.130.35.25
country_id: 6252001
description:
Dec  8 16:10:48 host2 sshd[3827124]: Disconnected from invalid user apple_store 43.130.35.25 port 36920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 16:11:10 host2 sshd[3827337]: Disconnected from invalid user apple_store 197.138.129.15 port 35320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.169.185
country_id: 2635167
description:
Dec  8 16:11:24 host2 sshd[3827491]: Disconnected from invalid user jenkins 188.166.169.185 port 50506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-08 16:16:54 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:64854: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec  8 16:17:32 host2 pure-ftpd[3832380]: (?@66.132.153.119) [INFO] New connection from 66.132.153.119


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 16:18:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<billing@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<2BK0h25FgLk+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.159.201
country_id: 2510769
description:
Dec  8 16:19:27 host2 sshd[3833885]: Disconnected from invalid user tempusr 187.33.159.201 port 48176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-08 16:18:44 dovecot_plain authenticator failed for (unonit) [75.97.190.237]:45471: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-08 16:18:57 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:59068: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 16:19:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<yoAdjG5Fru0+PIce>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Dec  8 16:20:14 host2 sshd[3834696]: Disconnected from invalid user apple_store 159.223.8.81 port 60072 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 16:20:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4hj2j25FzqPD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-08 16:19:40 dovecot_plain authenticator failed for (vivier) [65.20.133.4]:45921: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.199.240
country_id: 2921044
description:
Dec  8 16:20:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.154.199.240, lip=66.85.158.92, session=<UFV5kG5FBozPmsfw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec  8 16:21:14 host2 sshd[3835526]: Disconnected from invalid user postgres 159.223.8.81 port 48060 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.165.198
country_id: 2921044
description:
Dec  8 16:20:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=164.90.165.198, lip=66.85.158.92, session=<8RVqkG5F5ZOkWqXG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 16:21:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<CBGKlG5F2MjDhTKl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 16:22:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<oquzlW5FUI8+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 16:22:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<y2Kulm5FTrcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 16:22:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<32bhmG5FJqGLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.159.201
country_id: 2510769
description:
Dec  8 16:24:09 host2 sshd[3837850]: Disconnected from invalid user user 187.33.159.201 port 58474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.159.201
country_id: 2510769
description:
Dec  8 16:25:19 host2 sshd[3838927]: Disconnected from invalid user postgres 187.33.159.201 port 60834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 16:25:24 host2 sshd[3838983]: Disconnected from invalid user user 2.57.121.25 port 35615 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-08 16:25:33 dovecot_plain authenticator failed for (prophotor) [65.20.174.63]:38787: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 16:26:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<WecPpG5FlIYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 16:26:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<pbUMpm5FKOKl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Dec  8 16:27:50 host2 sshd[3840953]: Disconnected from invalid user apple_store 193.122.200.89 port 32996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 16:28:07 host2 sshd[3841166]: Disconnected from invalid user postgres 197.138.129.15 port 35908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 16:29:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<2AQJr25FroE+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-08 16:30:25 dovecot_plain authenticator failed for (strado) [64.72.74.162]:51511: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 16:30:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OPkpsm5FBOpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.9.164.202
country_id: 6252001
description:
2025-12-08 16:35:59 dovecot_plain authenticator failed for ([89.116.164.85]) [73.9.164.202]:33122: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.164.52.31
country_id: 1733045
description:
2025-12-08 16:36:12 dovecot_plain authenticator failed for ([89.116.164.85]) [115.164.52.31]:32830: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.157.13
country_id: 298795
description:
2025-12-08 16:36:26 dovecot_plain authenticator failed for ([89.116.164.85]) [78.188.157.13]:42770: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 16:36:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1Creym5FEscXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 16:37:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<IFbHy25F1OfANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.157.13
country_id: 298795
description:
2025-12-08 16:36:33 dovecot_login authenticator failed for ([89.116.164.85]) [78.188.157.13]:42770: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 16:37:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<notify@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<dNk6zm5Fxss+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.47.243.113
country_id: 6252001
description:
2025-12-08 16:38:07 dovecot_login authenticator failed for ool-182ff371.dyn.optonline.net [24.47.243.113]:50603: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-08 16:38:14 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:41984: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.75.13.194
country_id: 6251999
description:
Dec  8 16:38:19 host2 sshd[3848929]: Disconnected from invalid user engineer 206.75.13.194 port 55318 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-08 16:38:25 dovecot_login authenticator failed for (nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:33126: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-12-08 16:37:43 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:44950: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 16:38:02 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:58718: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2025-12-08 16:38:21 dovecot_login authenticator failed for ([197.251.249.72]) [197.251.249.72]:52965: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-08 16:38:00 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:59704: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-08 16:38:39 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:36566: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.138.129.15
country_id: 192950
description:
Dec  8 16:38:54 host2 sshd[3849162]: Disconnected from invalid user jenkins 197.138.129.15 port 39560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 16:38:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<OyBS0m5F+L6nYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.95.214
country_id: 6252001
description:
Dec  8 16:40:31 host2 sshd[3850339]: Disconnected from invalid user dell 43.153.95.214 port 38952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 16:40:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<UTdw2G5FfteiAOAm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.75.13.194
country_id: 6251999
description:
Dec  8 16:41:50 host2 sshd[3851126]: Disconnected from invalid user ansible 206.75.13.194 port 38836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.131.133.146
country_id: 6252001
description:
2025-12-08 16:42:06 dovecot_plain authenticator failed for 107-131-133-146.lightspeed.irvnca.sbcglobal.net ([89.116.164.85]) [107.131.133.146]:51548: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.210.86.252
country_id: 3469034
description:
2025-12-08 16:42:20 dovecot_plain authenticator failed for ([89.116.164.85]) [179.210.86.252]:45537: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.222.0.185
country_id: 3469034
description:
2025-12-08 16:42:34 dovecot_plain authenticator failed for ([89.116.164.85]) [181.222.0.185]:33548: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.94
country_id: 1880251
description:
Dec  8 16:42:37 host2 sshd[3851552]: Disconnected from invalid user xiaowk 45.78.221.94 port 37664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 16:43:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<t0Qs4W5F4tgP6yH0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.75.13.194
country_id: 6251999
description:
Dec  8 16:46:17 host2 sshd[3854702]: Disconnected from invalid user dell 206.75.13.194 port 35671 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 16:47:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<upSv8G5F9qsv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.95.214
country_id: 6252001
description:
Dec  8 16:46:36 host2 sshd[3854856]: Disconnected from invalid user tempusr 43.153.95.214 port 37732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Dec  8 16:47:21 host2 sshd[3855370]: Disconnected from invalid user postgres 193.122.200.89 port 32916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-08 16:49:09 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:51782: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.17
country_id: 6252001
description:
2025-12-08 16:49:16 dovecot_login authenticator failed for ([98.181.44.17]) [98.181.44.17]:59803: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.75.13.194
country_id: 6251999
description:
Dec  8 16:48:35 host2 sshd[3856119]: Disconnected from invalid user jenkins 206.75.13.194 port 34106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.153.95.214
country_id: 6252001
description:
Dec  8 16:49:01 host2 sshd[3856600]: Disconnected from invalid user ansible 43.153.95.214 port 37242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec  8 16:49:52 host2 sshd[3857109]: Disconnected from invalid user jacob 67.207.83.103 port 38462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-08 16:49:57 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:50611: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-08 16:50:18 dovecot_login authenticator failed for ([154.208.47.13]) [154.208.47.13]:52164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 16:51:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ZdP9/25FkuIz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 16:51:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<MvnHAG9F8IKG0Wp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.95.214
country_id: 6252001
description:
Dec  8 16:52:35 host2 sshd[3858894]: Disconnected from invalid user xiaowk 43.153.95.214 port 36500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec  8 16:52:59 host2 sshd[3859083]: Disconnected from invalid user devops2025 67.207.83.103 port 41032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.109
country_id: 6252001
description:
Dec  8 16:53:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.109, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cmz3BW9FezRAPpxt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Dec  8 16:53:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yicNB29FNkVAPpxs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.21.83.111
country_id: 3895114
description:
2025-12-08 16:54:19 dovecot_plain authenticator failed for ([89.116.164.85]) [190.21.83.111]:46498: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.86.159.128
country_id: 2510769
description:
2025-12-08 16:54:32 dovecot_plain authenticator failed for static-128-159-86-188.ipcom.comunitel.net ([89.116.164.85]) [188.86.159.128]:57594: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.18.39.77
country_id: 3469034
description:
2025-12-08 16:54:46 dovecot_plain authenticator failed for ([89.116.164.85]) [177.18.39.77]:44799: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 16:55:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ONGwDW9F+NSPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.207.83.103
country_id: 6252001
description:
Dec  8 16:56:19 host2 sshd[3861785]: Disconnected from invalid user jenkins 67.207.83.103 port 40388 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 16:56:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<pVV1EW9FQOg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 16:56:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<jo7mEW9FPtykXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 16:56:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<XjVnEm9Fqusv/lVz>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.254.85.115
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.254.85.115] [Remote Port]=[60330] [Authentication Database]=[mail] [Username]=[test@seyawin.com] (10/10 failures) (blocked until [Tue Dec  9 11:26:52 2025 UTC/Tue Dec  9 16:56:52 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 16:59:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<SRf0HG9Fkoy8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-08 16:59:56 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:41971: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.188
country_id: 3996063
description:
2025-12-08 17:00:11 dovecot_login authenticator failed for ([177.239.164.188]) [177.239.164.188]:33380: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 17:04:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<rzx1LG9FiOeeRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec  8 17:03:42 host2 sshd[3867106]: Disconnected from invalid user ubuntu 67.207.83.103 port 56794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 17:05:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<ijWiL29FPIeqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 17:04:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<XLh4Lm9FpqI+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-08 17:05:01 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (mosion) [68.52.119.193]:44752: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.94
country_id: 1880251
description:
Dec  8 17:06:21 host2 sshd[3868884]: Disconnected from invalid user dell 45.78.221.94 port 50484 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 17:08:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<r72yOm9FPus+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 17:09:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<billing@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<UqWEPm9FFM4+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.218.242.181
country_id: 1819730
description:
Dec  8 17:08:46 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=103.218.242.181, lip=66.85.158.92, TLS, session=<Vk72PG9FCH1n2vK1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-08 17:09:33 dovecot_plain authenticator failed for (menloce) [65.20.160.107]:56622: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 17:09:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<+B0DQW9Fas4+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 17:10:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<bKvkQW9Fkuc+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-08 17:10:55 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:43248: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2025-12-08 17:11:04 dovecot_login authenticator failed for ([5.11.161.152]) [5.11.161.152]:38774: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 17:11:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tatighbont) [87.103.126.54]:54161: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 17:12:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<lMMDS29FeoukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 17:13:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<fXluTm9FOJE+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 17:14:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Ov3QT29FWJrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 17:15:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<UFukVm9FHsw+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2025-12-08 17:16:02 dovecot_plain authenticator failed for (asionatous) [50.215.95.14]:42468: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec  8 17:16:56 host2 sshd[3876145]: Disconnected from invalid user jacob 58.98.199.45 port 40273 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.118.106.53
country_id: 1269750
description:
Dec  8 17:17:41 host2 sshd[3876498]: Disconnected from invalid user admin 45.118.106.53 port 33406 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Dec  8 17:18:51 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<DlP+YG9FxthHBpK5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Dec  8 17:18:51 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<Xgv9YG9FSthHBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 17:18:32 host2 sshd[3876918]: Disconnected from invalid user admin 2.57.121.112 port 33788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 17:18:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<VWHJX29FLsgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 17:20:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<vmwdaG9FIMkv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-08 17:21:32 dovecot_login authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:53341: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.233
country_id: 6252001
description:
2025-12-08 17:21:37 dovecot_login authenticator failed for wsip-184-191-242-233.fv.ks.cox.net [184.191.242.233]:34209: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.188
country_id: 1733045
description:
2025-12-08 17:21:55 dovecot_login authenticator failed for ([49.124.159.188]) [49.124.159.188]:55978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.167
country_id: 3996063
description:
2025-12-08 17:21:54 dovecot_login authenticator failed for ([177.236.146.167]) [177.236.146.167]:44462: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.99.110.136
country_id: 3469034
description:
2025-12-08 17:23:04 dovecot_plain authenticator failed for ([89.116.164.85]) [179.99.110.136]:56558: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.41.0.178
country_id: 6252001
description:
2025-12-08 17:23:15 dovecot_plain authenticator failed for 75-41-0-178.lightspeed.austtx.sbcglobal.net ([89.116.164.85]) [75.41.0.178]:43846: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.41.148.216
country_id: 102358
description:
2025-12-08 17:23:28 dovecot_plain authenticator failed for ([89.116.164.85]) [5.41.148.216]:2987: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 17:22:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<Pv9Ob29FnrA+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 17:22:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<+hqjb29FYsU+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.41.148.216
country_id: 102358
description:
2025-12-08 17:23:35 dovecot_login authenticator failed for ([89.116.164.85]) [5.41.148.216]:2987: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.53
country_id: 1269750
description:
Dec  8 17:23:47 host2 sshd[3879727]: Disconnected from invalid user admin 45.118.106.53 port 39138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 17:24:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<YIjfdW9FOviuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.19.170
country_id: 1269750
description:
2025-12-08 17:25:06 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:33074: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-08 17:25:35 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:57777: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 17:25:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<JwwgeW9F1Ik+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 17:27:27 host2 sshd[3882173]: Disconnected from invalid user admin 2.57.121.112 port 5397 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 17:28:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<rWSpg29FTNY+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.226
country_id: 192950
description:
Dec  8 17:29:04 host2 sshd[3883157]: Disconnected from invalid user username 102.220.23.226 port 34298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 17:29:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<eDqThW9F1I0+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 17:30:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<IU8JiW9Fut5noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 17:29:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<guy3h29FsKo+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.53
country_id: 1269750
description:
Dec  8 17:31:09 host2 sshd[3884997]: Disconnected from invalid user user 45.118.106.53 port 60427 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 17:30:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<D8mQim9F6qc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 17:31:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4AKLjG9FZLQ+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-08 17:32:17 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (frerliths) [68.46.148.180]:51346: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-08 17:31:40 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:43144: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-08 17:32:14 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52490: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 17:33:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<o7r2lW9FjuY+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-12-08 17:34:46 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:43886: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.226
country_id: 192950
description:
Dec  8 17:36:40 host2 sshd[3888516]: Disconnected from invalid user admin 102.220.23.226 port 48498 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 17:37:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<TBqcom9FBu4+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:37:56 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<uoI/pW9FXsEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:40:12 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<g5lYrW9FmoUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 17:39:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<7SW+q29FFujD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-08 17:40:51 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:41575: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.226
country_id: 192950
description:
Dec  8 17:41:24 host2 sshd[3891710]: Disconnected from invalid user username 102.220.23.226 port 57020 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-08 17:41:27 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:35488: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-08 17:41:26 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:50776: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.208.55
country_id: 6252001
description:
2025-12-08 17:40:44 dovecot_login authenticator failed for ([216.21.208.55]) [216.21.208.55]:53113: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 17:42:04 host2 sshd[3892117]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.39.230
country_id: 3202326
description:
2025-12-08 17:41:55 dovecot_login authenticator failed for ([5.59.39.230]) [5.59.39.230]:44246: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:42:10 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Da5ktG9FKIEDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2025-12-08 17:41:42 dovecot_login authenticator failed for (173-31-197-108.client.mchsi.com) [173.31.197.108]:54710: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-08 17:41:55 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (upsinly) [24.23.125.83]:46278: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-12-08 17:41:53 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:36517: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 17:42:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<VHz9s29FtOanYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-08 17:42:08 dovecot_plain authenticator failed for (twiele) [23.30.11.253]:60109: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 17:41:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<HhFHsm9Fir/DhTKl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-08 17:41:44 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:50004: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-08 17:43:28 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (boless) [98.193.112.85]:41184: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 17:44:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<C6AovG9FAMs+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-08 17:44:25 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:56912: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-08 17:44:17 dovecot_login authenticator failed for ([125.19.110.89]) [182.78.107.6]:56930: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:44:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<UDxGvG9FxJsDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-08 17:44:38 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:52164: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:44:37 host2 dovecot[2208013]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<IoslvW9FdpADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-08 17:44:47 dovecot_login authenticator failed for ([124.246.114.111]) [124.246.114.111]:44992: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-08 17:44:48 dovecot_login authenticator failed for ([154.208.47.13]) [154.208.47.13]:41560: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 17:44:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<YwMkvm9FgreLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-12-08 17:45:21 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:57735: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 17:45:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<hdVtwW9FRugrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 17:46:13 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<2RXewm9FWpUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 17:46:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<1UUAxG9F5OWl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 17:48:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<udHMyW9FOKc+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 17:50:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<qM1k0G9FPqIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 17:53:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Ym1u3G9FKptnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 17:53:35 host2 sshd[3900682]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-08 17:56:13 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:56436: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-08 17:57:00 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (rosid) [71.224.169.28]:49806: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-08 17:57:02 dovecot_plain authenticator failed for (caninur) [65.20.149.93]:48146: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec  8 17:57:56 host2 sshd[3904633]: Disconnected from invalid user agent 58.98.199.45 port 38126 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 17:59:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<YXhw8W9Fwrw+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-08 17:59:34 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (spering) [73.224.171.101]:36234: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.123.101.50
country_id: 3865483
description:
Dec  8 18:00:18 host2 sshd[3906769]: Disconnected from invalid user jacob 186.123.101.50 port 56134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-08 18:02:06 dovecot_plain authenticator failed for (dions) [149.62.239.4]:40492: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-08 18:03:20 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:33704: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 18:02:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<xwgX/m9FpNPANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-08 18:02:58 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:47456: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 18:03:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<k1nuAHBF7LMP6yH0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-08 18:03:49 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (noster) [196.47.172.253]:58931: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-08 18:04:25 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:50831: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-12-08 18:04:44 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:34374: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 18:05:04 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (myines) [87.103.126.54]:22633: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 18:07:09 host2 sshd[3911160]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 18:07:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<9GGVEHBFqqI+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 18:08:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<eTAgEXBFHNAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 18:11:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<d4W0G3BFUM8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 18:16:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<g26NLnBFfLaPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 18:16:41 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 18:16:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<OfhaMHBFxNqG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-08 18:16:58 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (monticalt) [73.213.237.28]:53996: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-08 18:19:31 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:50069: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 18:19:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<dQWNOnBFMpCkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-08 18:19:56 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:59716: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 18:20:30 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 18:22:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<RW16Q3BF/qEv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.127.192
country_id: 2921044
description:
Dec  8 18:23:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.65.127.192, lip=66.85.158.92, TLS, session=<YDHTR3BFbK+fQX/A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 18:23:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<9eRHSXBFSrIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 18:25:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<fTOeTXBF2si8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-08 18:25:37 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:43702: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-08 18:26:34 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:65191: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 18:27:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<OfWHV3BFRtCeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-08 18:26:57 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:50034: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-08 18:29:09 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:39980: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-12-08 18:29:18 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:54287: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.186.46.96
country_id: 6252001
description:
Dec  8 18:31:43 host2 sshd[3929338]: Disconnected from invalid user ubuntu 34.186.46.96 port 44250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec  8 18:33:00 host2 sshd[3930275]: Disconnected from invalid user developer 58.98.199.45 port 47299 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 18:34:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<8xDwbnBFLoOqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 18:36:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<CIZrdnBFyrCkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 18:37:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<BnUceXBF7rY+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-08 18:38:10 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:48711: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-08 18:38:28 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:54821: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-08 18:40:28 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (mooked) [24.15.216.41]:54532: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 18:40:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<RRuThXBFJpzO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 18:40:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<D8vqhXBFuos+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-08 18:40:12 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:52066: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 18:40:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<XhkXhHBFAuI+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-08 18:41:26 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:49967: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-08 18:41:33 dovecot_plain authenticator failed for (krunte) [154.144.255.208]:52194: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 18:41:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<19ePiHBFvLk+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-08 18:41:38 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:39814: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 18:43:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<YOPejXBFOMo+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 18:43:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=</mIFkXBFnKIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 18:46:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<R5HEmXBFdLg+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 18:46:25 host2 sshd[3939988]: Disconnected from invalid user admin 2.57.121.112 port 38714 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 18:48:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<E3Tgn3BFWJgv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 18:48:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<fCvOn3BFYvCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 18:49:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=</O4vpHBFWNmuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 18:49:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<OaAppXBFAMA+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 18:55:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65157: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 18:56:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<C8m0vXBFTs4+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 18:57:30 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (ridflims) [68.60.77.128]:48568: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.9.78
country_id: 3017382
description:
Dec  8 18:57:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.134.9.78, lip=66.85.158.91, TLS: Connection closed, session=</WDFwnBFbt5bhglO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.9.78
country_id: 3017382
description:
Dec  8 18:57:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.134.9.78, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+lBnw3BFBpRbhglO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 18:58:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<NOKEw3BF6J5noNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 19:04:36 host2 sshd[3952960]: Disconnected from invalid user user 2.57.121.25 port 30037 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 19:04:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<rzXv2HBFxOPD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2025-12-08 19:04:10 dovecot_login authenticator failed for ([49.124.146.34]) [49.124.146.34]:51054: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-08 19:04:20 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:45805: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.186.46.96
country_id: 6252001
description:
Dec  8 19:04:23 host2 sshd[3952876]: Disconnected from invalid user tempusr 34.186.46.96 port 60626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.186.46.96
country_id: 6252001
description:
Dec  8 19:05:46 host2 sshd[3953656]: Disconnected from invalid user username 34.186.46.96 port 47724 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 19:06:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<YxF34XBFHq3DhTKl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.32.189.23
country_id: 6252001
description:
2025-12-08 19:06:41 dovecot_plain authenticator failed for ([89.116.164.85]) [76.32.189.23]:31115: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.71.88.125
country_id: 6290252
description:
2025-12-08 19:06:53 dovecot_plain authenticator failed for ([89.116.164.85]) [185.71.88.125]:46384: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.77.254.197
country_id: 6252001
description:
2025-12-08 19:07:08 dovecot_plain authenticator failed for c-73-77-254-197.hsd1.tx.comcast.net ([89.116.164.85]) [73.77.254.197]:51976: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 19:11:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<vJCl83BF9KuLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 19:11:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<v5HA83BFDM8+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 19:13:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=</H+A+XBFRqwrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-08 19:13:11 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:40110: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 19:13:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<tm15+nBF1ryl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 19:17:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Hq/ACnFFrL4v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 19:20:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<+NihE3FFQsM+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 19:21:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lnYPGHFF2r9nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-08 19:24:48 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:52914: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 19:25:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<lnGcJHFFXoA+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-08 19:24:55 dovecot_login authenticator failed for (cm-84.211.12.159.get.no) [84.211.12.159]:39360: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-08 19:28:51 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (vargione) [73.176.157.57]:51352: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 19:30:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<6YAQNnFFCMwP6yH0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 19:31:44 host2 sshd[3975226]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 19:31:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<VVIwOnFF9MTANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-08 19:32:46 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (unmetilic) [24.127.53.61]:39122: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 19:32:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<vc8EP3FFCJQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-08 19:33:11 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:41208: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 19:34:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<WiKRRnFFrs8z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-08 19:35:40 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:54242: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-08 19:35:58 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:33181: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 19:38:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4v3zUnFFRNsjy9Nr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 19:38:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<3r4IVnFFmOIjy9Nr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.107.206.116
country_id: 1733045
description:
Dec  8 19:39:39 host2 sshd[3981113]: Disconnected from invalid user dell 118.107.206.116 port 52186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 19:40:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<QCJBWnFFcNWPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 19:40:34 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.107.206.116
country_id: 1733045
description:
Dec  8 19:41:11 host2 sshd[3982537]: Disconnected from invalid user visitador 118.107.206.116 port 42368 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.107.206.116
country_id: 1733045
description:
Dec  8 19:42:38 host2 sshd[3983619]: Disconnected from invalid user username 118.107.206.116 port 53914 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 19:43:21 host2 sshd[3984396]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.107.206.116
country_id: 1733045
description:
Dec  8 19:44:00 host2 sshd[3984942]: Disconnected from invalid user moodle 118.107.206.116 port 53684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.35.17
country_id: 1819730
description:
Dec  8 19:46:08 host2 sshd[3987438]: Disconnected from invalid user ansible 118.193.35.17 port 59014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 19:46:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<vmFXcXFFRLWkXGTY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 19:45:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS, session=<Jb4nb3FFGuUjy9Nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-08 19:47:43 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:36918: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-08 19:46:52 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:57396: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.47.214
country_id: 1269750
description:
2025-12-08 19:47:21 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:41717: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-08 19:47:26 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:59669: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-08 19:48:43 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (tanely) [73.176.157.57]:50644: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


