# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.41
country_id: 798544
description:
Dec 15 02:06:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=91.236.172.41, lip=66.85.158.91, TLS, session=<xC3Wcu9FTbFb7Kwp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.13.251
country_id: 3469034
description:
Dec 15 02:06:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.39.13.251, lip=66.85.158.91, TLS, session=<ZU+zce9FjYOxJw37>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-15 02:06:52 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:52808: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.153
country_id: 3469034
description:
Dec 15 02:06:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.44.96.153, lip=66.85.158.91, TLS, session=<NU+zce9FwdmxLGCZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Dec 15 02:07:07 host2 sshd[3332296]: Disconnected from invalid user james 154.198.215.66 port 43768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-15 02:07:38 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:55940: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.82.103
country_id: 3469034
description:
Dec 15 02:07:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=200.237.82.103, lip=66.85.158.91, TLS, session=<eHcwde9FMpXI7VJn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-15 02:08:06 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:47363: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.61
country_id: 6252001
description:
2025-12-15 02:07:19 dovecot_login authenticator failed for ([98.185.120.61]) [98.185.120.61]:49167: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.239.103.125
country_id: 3277605
description:
Dec 15 02:07:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=104.239.103.125, lip=66.85.158.91, TLS, session=<8oFddu9Fsoto72d9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 02:08:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<rcS7e+9FJos+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 15 02:09:03 host2 sshd[3335133]: Disconnected from invalid user master 103.179.27.94 port 44348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 15 02:08:43 host2 sshd[3334686]: Disconnected from invalid user guest 20.102.116.25 port 60626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 15 02:08:51 host2 sshd[3334834]: Disconnected from invalid user steam1 154.198.215.66 port 52472 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 15 02:09:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<DgVDf+9Fstw+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 15 02:09:59 host2 sshd[3336325]: Disconnected from invalid user sshuser 20.102.116.25 port 60594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 02:09:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<cYrbfO9Fxrg+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 15 02:09:25 host2 sshd[3335609]: Disconnected from invalid user ppr 36.66.16.233 port 37250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 15 02:09:44 host2 sshd[3336009]: Disconnected from invalid user seafile 103.179.27.94 port 39686 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 15 02:10:27 host2 sshd[3337099]: Disconnected from invalid user guest 103.179.27.94 port 33618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 15 02:11:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<ZmzRhO9FMp4+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 15 02:11:49 host2 sshd[3338955]: Disconnected from invalid user worker 103.179.27.94 port 51104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 15 02:13:49 host2 sshd[3341687]: Disconnected from invalid user sshuser 36.66.16.233 port 35692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-12-15 02:13:53 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:54049: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 02:14:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=</Nj7je9F0sQ+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.163.134
country_id: 1327865
description:
Dec 15 02:14:10 host2 sshd[3342280]: Disconnected from invalid user jenkins 103.59.163.134 port 49874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.183.28
country_id: 357994
description:
2025-12-15 02:14:13 dovecot_plain authenticator failed for (grabler) [41.33.183.28]:43670: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 15 02:15:22 host2 sshd[3344046]: Disconnected from invalid user admin 36.66.16.233 port 35550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.163.134
country_id: 1327865
description:
Dec 15 02:14:49 host2 sshd[3343265]: Disconnected from invalid user james 103.59.163.134 port 55352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 02:15:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<jQN1lO9FpMMIiWqS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.163.134
country_id: 1327865
description:
Dec 15 02:16:07 host2 sshd[3345276]: Disconnected from invalid user admin 103.59.163.134 port 36208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 02:16:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<t/Ejlu9FSrA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 15 02:17:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<BIQvme9FnpQzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-15 02:17:18 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:40838: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 02:18:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<efG2ne9FUMA+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 02:18:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<rR9Sn+9FwVovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 15 02:19:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<UrZ5oO9F+IRm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.163.135
country_id: 1327865
description:
Dec 15 02:18:50 host2 sshd[3349451]: Disconnected from invalid user vncuser 103.59.163.135 port 45814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.29
country_id: 1821275
description:
2025-12-15 02:20:16 dovecot_login authenticator failed for (ADMIN) [84.252.92.29]:6832: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-15 02:20:33 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (haysis) [217.215.74.195]:42765: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-15 02:21:00 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:57062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-15 02:21:38 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:50148: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 02:24:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<bahUsu9FnQQvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-15 02:25:39 dovecot_login authenticator failed for (cm-178.232.194.231.get.no) [178.232.194.231]:43360: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-15 02:24:58 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57055: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-12-15 02:26:03 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:56316: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.89
country_id: 6252001
description:
Dec 15 02:26:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.89, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ztr3ue9FEtLG6xhZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2025-12-15 02:26:28 dovecot_login authenticator failed for (nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:41156: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-15 02:26:39 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:55879: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-15 02:27:22 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:39469: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 02:27:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<V3JUvu9F9ukro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-15 02:27:01 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:44068: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 02:27:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<vLT+vu9Fhtwv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 02:30:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<8+Eyye9FmJ4vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 02:30:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<iAzjye9FMM2PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 02:31:05 host2 sshd[3367021]: Disconnected from invalid user user 62.60.131.157 port 33162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-15 02:31:36 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:59574: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 15 02:31:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<26iwzO9FRK4+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.97
country_id: 6252001
description:
2025-12-15 02:32:38 dovecot_login authenticator failed for ([98.185.120.97]) [98.185.120.97]:59708: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-15 02:31:49 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:35500: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 02:32:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<3wcS0O9FMoov7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-15 02:32:54 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:50686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 02:33:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<mxgw0+9FWNVnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 02:33:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<JSNW1O9FEL2YNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-15 02:34:45 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (bradisman) [67.172.54.29]:40482: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 02:35:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<qN002u9F6qA+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 02:35:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<kEB42+9FOKo+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 02:37:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<root@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<MmIU4e9FPpEuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-15 02:37:48 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (trefy) [174.169.224.27]:60446: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 02:39:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<jut75+9FS5IvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 02:39:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<RByO6O9F1OKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.27.237
country_id: 3469034
description:
Dec 15 02:40:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=177.152.27.237, lip=66.85.158.91, TLS, session=<uZPl6e9FPraxmBvt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.19.215
country_id: 1269750
description:
Dec 15 02:40:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.164.19.215, lip=66.85.158.91, TLS, session=<FsIv6+9FCeBnpBPX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 02:40:48 host2 sshd[3381233]: Disconnected from invalid user user 62.60.131.157 port 20774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 02:41:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<u47H7u9F2uo+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 15 02:41:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<Zwas8O9FaMQ+PIdb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 15 02:43:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<Roe19e9FYMk+PIdd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-15 02:43:07 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:52344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-15 02:43:41 dovecot_plain authenticator failed for (entnest) [24.187.213.29]:38082: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-15 02:43:48 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:38922: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-15 02:46:26 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:35946: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.217
country_id: 1733045
description:
2025-12-15 02:46:39 dovecot_login authenticator failed for ([49.124.149.217]) [49.124.149.217]:46266: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 02:47:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<nf7LBvBFVLCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 15 02:48:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<CrDQCvBFDoQ+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 02:49:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<P/8XDPBFPIA+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 02:50:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<u74GEPBF7pShI2jD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 02:51:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Pf9rEvBF6viuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 02:51:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<fO3VEvBF1Mo+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 02:51:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<IY0PE/BFbqg+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 02:52:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<jZTNFvBF9OWWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-15 02:52:25 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (eprabilack) [78.66.119.139]:38878: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.74
country_id: 1269750
description:
Dec 15 02:52:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.30.83.74, lip=66.85.158.91, TLS, session=<e2j4FvBFDrFnHlNK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-15 02:51:52 dovecot_plain authenticator failed for (dense) [65.20.205.197]:51267: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 02:51:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<0yYlFfBFUMCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.52
country_id: 3469034
description:
Dec 15 02:52:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=138.186.197.52, lip=66.85.158.91, TLS, session=<gTU4GPBFqsaKusU0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 15 02:53:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<CgCVG/BFSLI+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.89
country_id: 6252001
description:
Dec 15 02:53:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.89, lip=66.85.158.91, TLS, session=<UG4wHPBFNP/N0h9Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 02:54:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<qE7jH/BFIMc+PIM0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 02:56:40 host2 sshd[3404816]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 02:56:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<+p87JPBF3Mk+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 02:58:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<tIlyLfBFtJOLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 02:59:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<GLH6LvBF2seB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 03:00:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<igIDM/BF5ug+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 03:01:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<hwysN/BFrO0+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 03:02:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Gie7O/BFxKwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 03:04:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<3cbZQPBFQt0+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 03:04:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<gj7MQvBF7rWnrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.223
country_id: 6252001
description:
Dec 15 03:04:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.223, lip=66.85.158.92, session=<KBXbQ/BFAuTG6xjf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 03:05:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<516jRvBFusYIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 03:05:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<pr21RvBF+p5nJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 15 03:06:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<zxcsS/BFsqJnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 03:07:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<+XRuTPBFRoCnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-15 03:08:45 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (metlogo) [73.137.7.97]:42066: 535 Incorrect authentication data (set_id=dev@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 03:08:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<+go6UvBFus5nhdZ/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-15 03:09:06 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:37255: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 03:10:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<a6qXV/BF8pukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 03:10:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<y6zyV/BFqo+l6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-12-15 03:10:38 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:38510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 15 03:10:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<oBK/VvBFJJ4+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2025-12-15 03:11:32 dovecot_login authenticator failed for ([188.59.19.112]) [188.59.19.112]:60484: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-12-15 03:10:50 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:49344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-15 03:10:57 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:52598: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 03:11:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<bfP9XPBFfLs+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.7
country_id: 798549
description:
Dec 15 03:12:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.7, lip=66.85.158.92, session=<zvN2XfBFU9pV2YwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.4
country_id: 798549
description:
Dec 15 03:12:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.4, lip=66.85.158.92, TLS: Connection closed, session=<mTP9X/BF2MhV2YwE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 03:13:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<cZ5JZPBF1r2G0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 03:13:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0G1bY/BFeIA+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-15 03:15:36 dovecot_plain authenticator failed for (whughts) [65.20.205.197]:57025: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 03:15:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<evooavBFuum8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-15 03:17:37 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (matic) [71.224.169.28]:56448: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-12-15 03:17:42 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:42060: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 03:17:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<vSkBcvBFzsgu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-15 03:17:54 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:20763: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 15 03:17:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<SU1QcvBFbqo+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 03:18:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<edK6cvBFpJQ+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 03:18:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<aO3Wc/BFkKg+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 03:19:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<06pxdvBFQkRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 03:19:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PHS0d/BFHBgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 15 03:20:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<wvXTefBFRLo+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 03:20:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<4s/ZefBFvLSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 03:20:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<IlsSfPBFZo6Pbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 03:22:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Lno+hPBFgoY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 03:23:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<2WrdhPBFEjxniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 03:23:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<root@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<Z2wrhfBFWp1S38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-12-15 03:24:31 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:36750: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.29
country_id: 6252001
description:
2025-12-15 03:24:07 dovecot_login authenticator failed for ([98.181.46.29]) [98.181.46.29]:44012: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 03:24:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<AvGtiPBFdus+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-15 03:25:16 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:60460: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.239
country_id: 6252001
description:
2025-12-15 03:25:50 dovecot_login authenticator failed for wsip-184-191-242-239.fv.ks.cox.net [184.191.242.239]:37560: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 15 03:25:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<3TLHjvBFJM3CBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Dec 15 03:26:35 host2 sshd[3448399]: Disconnected from invalid user said 132.145.213.106 port 47476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 15 03:26:47 host2 sshd[3448603]: Disconnected from invalid user test01 38.137.11.10 port 49185 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-15 03:27:45 dovecot_plain authenticator failed for (chalis) [154.144.243.93]:37164: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-15 03:28:14 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (obbills) [185.62.224.44]:48200: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 15 03:28:18 host2 sshd[3450947]: Disconnected from invalid user hossein 152.32.239.90 port 34090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 15 03:28:37 host2 sshd[3451309]: Disconnected from invalid user lenovo 181.188.172.6 port 37196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 15 03:28:54 host2 sshd[3451657]: Disconnected from invalid user yam 38.137.11.10 port 28090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 15 03:29:24 host2 sshd[3452350]: Disconnected from invalid user wj 181.188.172.6 port 51502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 15 03:29:26 host2 sshd[3452398]: Disconnected from invalid user dzq 152.32.239.90 port 59324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Dec 15 03:30:24 host2 sshd[3453920]: Disconnected from invalid user user 186.96.151.198 port 40136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 15 03:30:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ceRgn/BFGMVm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 03:30:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<hGbMn/BFp68vWbHj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 15 03:30:57 host2 sshd[3454674]: Disconnected from invalid user ubuntu 181.188.172.6 port 50532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Dec 15 03:31:15 host2 sshd[3455167]: Disconnected from invalid user jackson 132.145.213.106 port 52466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-12-15 03:31:50 dovecot_login authenticator failed for ([49.124.151.56]) [49.124.151.56]:38318: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 03:32:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<H0+spvBFfuMIiWqS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Dec 15 03:32:39 host2 sshd[3457110]: Disconnected from invalid user ubuntu 132.145.213.106 port 56120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Dec 15 03:32:40 host2 sshd[3457133]: Disconnected from invalid user www 186.96.151.198 port 47192 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-15 03:32:04 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:59860: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 15 03:32:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<1noYpfBFQIE+PIcr>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.39
country_id: 2635167
description:
Dec 15 03:32:12 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.39, lip=66.85.158.91, TLS, session=<f0ySpfBFU+W594kn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.250
country_id: 2635167
description:
Dec 15 03:32:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.250, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Omm8pfBFu65X7LD6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 15 03:32:26 host2 sshd[3456813]: Disconnected from invalid user test01 152.32.239.90 port 12414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.233
country_id: 2635167
description:
Dec 15 03:33:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.233, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<1BizqfBFm9y594np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.237
country_id: 2635167
description:
Dec 15 03:32:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.237, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Ypq3p/BFS5VX7LDt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Dec 15 03:32:55 host2 sshd[3457432]: Disconnected from invalid user user 103.182.132.154 port 37452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Dec 15 03:33:12 host2 sshd[3457875]: Disconnected from invalid user user 132.145.213.106 port 32820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Dec 15 03:33:13 host2 sshd[3457898]: Disconnected from invalid user vnc 186.96.151.198 port 40356 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.230
country_id: 2635167
description:
Dec 15 03:33:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.230, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<Slyuq/BFg6lX7LDm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.218
country_id: 2635167
description:
Dec 15 03:34:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.218, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<g+WprfBFuc5X7LDa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.234
country_id: 2635167
description:
Dec 15 03:35:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.234, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eFSjr/BF7aO594nq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.62.216.38
country_id: 3865483
description:
Dec 15 03:35:06 host2 sshd[3460633]: Disconnected from invalid user jupyterhub 179.62.216.38 port 45736 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.225
country_id: 2635167
description:
Dec 15 03:35:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.225, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<sqGgsfBFbdi594nh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 03:36:01 host2 sshd[3462112]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.49.89.39
country_id: 1694008
description:
Dec 15 03:36:35 host2 sshd[3462880]: Disconnected from invalid user elsearch 161.49.89.39 port 42674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 03:36:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<qFbusvBFc1kvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.249
country_id: 2635167
description:
Dec 15 03:36:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.249, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Qu6bs/BFMaO594n5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 03:36:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<HDJ5tPBFjNM+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.218
country_id: 2635167
description:
Dec 15 03:36:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.218, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<91iVtfBFfbBX7LDa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.62.216.38
country_id: 3865483
description:
Dec 15 03:37:42 host2 sshd[3464529]: Disconnected from invalid user kuba 179.62.216.38 port 59838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.218
country_id: 2635167
description:
Dec 15 03:37:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.218, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<vM2Qt/BF6cO594na>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 15 03:37:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<jczrufBFUoA+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 15 03:38:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<umRluvBF6JnCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.62.216.38
country_id: 3865483
description:
Dec 15 03:38:30 host2 sshd[3465614]: Disconnected from invalid user steam 179.62.216.38 port 45726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.49.89.39
country_id: 1694008
description:
Dec 15 03:38:56 host2 sshd[3466157]: Disconnected from invalid user clamav 161.49.89.39 port 35726 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.62.216.38
country_id: 3865483
description:
Dec 15 03:39:21 host2 sshd[3466865]: Disconnected from invalid user yam 179.62.216.38 port 59828 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 03:40:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<kT0xw/BFeLIv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 03:41:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<8XMPxvBFgL4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 03:40:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<HSX1w/BF1Lgro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 03:42:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<lJ8Qy/BFEsMvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 03:43:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<cg5XzPBFMqqPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-15 03:43:13 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:53444: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.93.36.83
country_id: 1821275
description:
2025-12-15 03:43:47 dovecot_login authenticator failed for ([182.93.36.83]) [182.93.36.83]:47382: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 03:46:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1eCo2PBF+MyYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 03:47:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ATdH2/BF9o0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 03:47:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<PAFx3fBFUpNnsX0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-15 03:48:06 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (unbled) [76.145.10.140]:48174: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 03:48:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<ceylondigestcom@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<j7QO4fBFWN8uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 03:50:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<7oiU5/BF8+kvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 15 03:49:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<jtEe5PBFMKzBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 03:51:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<HjLd6vBFCJKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.228
country_id: 3469034
description:
Dec 15 03:53:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.189.201.228, lip=66.85.158.91, TLS, session=<CJE28PBFyquzvcnk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.145.106
country_id: 99237
description:
Dec 15 03:53:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.145.106, lip=66.85.158.91, TLS, session=<wXp+8fBFh7hBFJFq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 15 03:53:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<5z5l8/BFDPdChJmK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-15 03:56:25 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (inessid) [73.168.136.150]:53104: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 03:59:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<rpRoBvFF4Js+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 04:00:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<PbJ0CvFFMoGnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 15 04:00:31 host2 sshd[3498991]: Disconnected from invalid user user 2.57.121.25 port 34164 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 04:03:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<6ypiFfFFbo6hI2jD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 04:03:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<DPjcFfFFCo2uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 04:07:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XI/mIfFFfH2nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 04:07:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<qx84JPFFOoOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 04:08:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<AIcrJ/FFAus+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-12-15 04:10:02 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:54092: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-15 04:09:46 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:35296: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 15 04:11:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<mbuCMPFFAJk+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 15 04:12:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<QE4ENfFFcKGB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.21
country_id: 1733045
description:
2025-12-15 04:12:12 dovecot_login authenticator failed for ([49.124.153.21]) [49.124.153.21]:44412: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.111.127
country_id: 294640
description:
2025-12-15 04:12:58 dovecot_login authenticator failed for ([212.90.111.127]) [212.90.111.127]:37579: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 04:13:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<wd4nOPFFUMKLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-15 04:14:04 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (tritonene) [73.0.235.30]:54416: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 04:14:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<D9BsPPFFdoCB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 04:13:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<PfvtOfFFIMUv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.211.233
country_id: 6252001
description:
2025-12-15 04:16:03 dovecot_plain authenticator failed for cm-72-241-211-233.buckeyecom.net (proida) [72.241.211.233]:58771: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 04:17:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<hnFmRvFFeuunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-12-15 04:16:44 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:42094: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.45.122
country_id: 2921044
description:
Dec 15 04:16:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.45.122, lip=66.85.158.92, session=<m8kyRfFFW7to+C16>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.216.245
country_id: 2921044
description:
Dec 15 04:16:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=161.35.216.245, lip=66.85.158.92, session=<STFIRfFF0CShI9j1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-15 04:17:09 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:46428: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-12-15 04:19:12 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:41032: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-15 04:19:24 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:44100: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-15 04:19:50 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:33774: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-15 04:20:30 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (unpred) [67.172.54.29]:35566: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 04:20:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<dXrGUvFFmNBnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 15 04:20:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@melanifinefood.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<HCO8U/FFkIVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 04:22:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<wKPoV/FF/ooIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 04:22:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<yI1aWfFFpuikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 04:22:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<UP94WvFFHpBnhdZ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 04:23:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<xIg0XfFFptOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 04:24:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<uMZSX/FF+t+nR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-15 04:28:11 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (vakers) [68.40.189.43]:53078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-15 04:28:23 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (nomopers) [68.60.77.128]:45198: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-15 04:29:11 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:34884: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-12-15 04:29:37 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:54881: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.86
country_id: 6252001
description:
2025-12-15 04:29:57 dovecot_login authenticator failed for ([63.65.203.86]) [63.65.203.86]:38324: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-15 04:30:14 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:57792: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 04:30:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<EMqTdvFFpuiG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 04:29:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<YYeSc/FFUMc+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 04:29:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<shqDc/FFssM+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 04:31:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<root@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<dsWnePFFsogu4ntB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 04:30:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<Axr+dvFF+qO8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 04:33:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=</4TofvFFIqZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 04:33:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<RxewgPFFFqlS38qm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.179
country_id: 6252001
description:
Dec 15 04:34:09 host2 sshd[3553230]: Disconnected from invalid user PRUEBA 165.154.235.179 port 34110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 04:35:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<wfUfiPFFoMGPbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 04:34:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<CLlDhfFFdNuLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 04:34:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<gq+VhfFFrP8vTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.235.179
country_id: 6252001
description:
Dec 15 04:35:15 host2 sshd[3555074]: Disconnected from invalid user liu 165.154.235.179 port 57746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 15 04:35:47 host2 sshd[3555891]: Disconnected from invalid user sambauser 45.78.224.109 port 58746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.179
country_id: 6252001
description:
Dec 15 04:37:08 host2 sshd[3558035]: Disconnected from invalid user enter 165.154.235.179 port 52818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-15 04:37:24 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:40436: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
country_id: 1269750
description:
2025-12-15 04:37:40 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:51255: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 15 04:38:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<Pib6kPFFZKU+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 04:38:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<+ikalPFF4QRniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.179
country_id: 6252001
description:
Dec 15 04:39:09 host2 sshd[3561194]: Disconnected from invalid user factorio 165.154.235.179 port 48826 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 15 04:39:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<hPINlvFF8rPCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 15 04:39:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<8IUGlvFFuok+PIdh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 04:41:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<xcfim/FFOOE+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-15 04:41:32 dovecot_plain authenticator failed for (soplabled) [192.81.229.179]:37516: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 04:42:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<PAA1n/FFfO0+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 04:42:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<+mnkoPFFlg4vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 04:46:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<qgimrvFFLqk+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.255.65.147
country_id: 458258
description:
Dec 15 04:47:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=85.255.65.147, lip=66.85.158.91, TLS, session=<ngsIsvFFfg9V/0GT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.223.2
country_id: 798544
description:
Dec 15 04:47:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=109.125.223.2, lip=66.85.158.91, TLS, session=<ETnZsPFFq+1tfd8C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.219
country_id: 2802361
description:
2025-12-15 04:47:35 dovecot_login authenticator failed for (ADMIN) [149.22.90.219]:50566: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 04:47:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<hSMvtPFF5bIvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 04:48:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<CXjLt/FFEpUIiWqS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 04:50:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6bQevPFFDM8+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 04:51:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<BL8SwPFFBMw+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 15 04:50:58 host2 sshd[3578870]: Disconnected from invalid user x 45.78.224.109 port 46678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 04:54:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<jArRy/FF/rQro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 15 04:54:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<LLJDzPFFopo+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 04:53:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<9+5EyfFFHpcv+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.173.27
country_id: 2635167
description:
2025-12-15 04:54:52 dovecot_login authenticator failed for (ADMIN) [45.133.173.27]:10020: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 04:55:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<cr6azfFFSuAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 04:55:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<AXuMz/FFNIqPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-12-15 04:55:54 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:33212: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-15 04:55:54 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (plike) [71.224.169.28]:57850: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-15 04:56:03 dovecot_login authenticator failed for ([182.78.107.6]) [182.78.107.6]:44492: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.109
country_id: 6252001
description:
2025-12-15 04:56:05 dovecot_login authenticator failed for ([98.185.120.109]) [98.185.120.109]:47604: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 15 04:58:30 host2 sshd[3591837]: Disconnected from invalid user test2 45.78.224.109 port 33672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 04:59:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<x+G83PFFosKYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 15 05:00:23 host2 sshd[3594758]: Disconnected from invalid user sentry 103.191.14.210 port 59424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 05:00:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<u2uA4fFFVLcuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.251
country_id: 1819730
description:
2025-12-15 05:02:07 dovecot_login authenticator failed for (ADMIN) [86.107.104.251]:13760: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 05:02:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<cwC76PFFzr5nsX0d>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 15 05:02:48 host2 sshd[3600373]: Disconnected from invalid user amit 103.191.14.210 port 58550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 05:03:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<WQbD6/FFPpQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.228
country_id: 2395170
description:
Dec 15 05:03:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=154.127.36.228, lip=66.85.158.91, TLS, session=<xS8L6/FFRZWafyTk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 05:02:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<8mNQ6fFFmEkvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.224
country_id: 3469034
description:
Dec 15 05:04:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<accounts>, method=PLAIN, rip=186.209.247.224, lip=66.85.158.91, TLS, session=<9dN37PFFXqG60ffg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 05:04:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Sexy7vFFKKKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 15 05:05:24 host2 sshd[3603072]: Disconnected from invalid user systems 45.78.224.109 port 36158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 15 05:05:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<qsZ+8/FFtMuB4gum>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 15 05:05:48 host2 sshd[3605162]: Disconnected from invalid user abdo 45.78.224.109 port 33826 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.34.34.253
country_id: 2510769
description:
Dec 15 05:14:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=46.34.34.253, lip=66.85.158.91, TLS, session=<2HVfEfJFJOguIiL9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.54
country_id: 3865483
description:
Dec 15 05:14:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.252.54, lip=66.85.158.91, TLS, session=<5DCBEvJFkeizAPw2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-15 05:15:23 dovecot_plain authenticator failed for (unceric) [149.62.239.4]:33914: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.152.186
country_id: 99237
description:
Dec 15 05:16:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=65.20.152.186, lip=66.85.158.91, TLS, session=<4uOVGfJFc4hBFJi6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 05:16:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<fphXG/JFVuyuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.78
country_id: 2510769
description:
Dec 15 05:16:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=185.214.138.78, lip=66.85.158.91, TLS, session=<Kwe4GvJFiee51opO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.31
country_id: 597427
description:
2025-12-15 05:17:16 dovecot_login authenticator failed for (ADMIN) [194.32.122.31]:20680: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 05:17:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<XTFHHfJFXoo+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 05:18:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<hi2AIPJFFNShI2jD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.128
country_id: 6252001
description:
2025-12-15 05:18:46 dovecot_login authenticator failed for wsip-184-191-250-128.fv.ks.cox.net [184.191.250.128]:41726: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-15 05:19:09 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:35992: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.59.196
country_id: 6252001
description:
2025-12-15 05:20:53 dovecot_login authenticator failed for (ADMIN) [212.102.59.196]:26251: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 05:21:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<xrsYK/JFuqo+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 05:21:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<UlzVLPJFct+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 05:23:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<tV4HMvJFzoyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 05:23:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<aHU1NfJF9Jk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 05:25:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iVfiOPJFlpQv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.196
country_id: 6252001
description:
Dec 15 05:28:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.196, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<a/8dRfJFSMPG6xjE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 05:28:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<wT4/RfJFFr2LO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 05:30:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<GzhJS/JFgpaB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 05:30:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=</884S/JFCt6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 05:33:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<dw1GV/JF6J0+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 05:35:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<rehanseoonline@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<V2WiXvJFnqikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 05:36:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<hmS1YPJF5IlnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 05:36:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<eiE3Y/JFYMJnhdZ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 15 05:37:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<K4Z6ZvJF4upnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 05:37:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<3J2uZvJF4Iyl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.139
country_id: 2077456
description:
2025-12-15 05:37:51 dovecot_login authenticator failed for (ADMIN) [179.61.228.139]:53231: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 05:38:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<MPhqafJFCLY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.58
country_id: 798549
description:
2025-12-15 05:38:44 dovecot_login authenticator failed for (ADMIN) [143.244.52.58]:14942: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 05:38:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<UrD9afJFnLsIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-15 05:38:13 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (dacose) [24.98.45.238]:56044: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.109
country_id: 6252001
description:
Dec 15 05:38:32 host2 pure-ftpd[3642168]: (?@66.240.236.109) [INFO] New connection from 66.240.236.109


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.242
country_id: 6252001
description:
Dec 15 05:41:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.242, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<w76ac/JFTsLG6xjy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.109
country_id: 6252001
description:
Dec 15 05:41:41 host2 pure-ftpd[3646048]: (?@66.240.236.109) [INFO] New connection from 66.240.236.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-15 05:42:18 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (scent) [73.196.144.25]:59516: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 05:43:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<BnmMe/JFENg+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.133.54
country_id: 6252001
description:
Dec 15 05:43:49 host2 sshd[3648032]: Disconnected from invalid user scan 192.227.133.54 port 55292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 05:43:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<byRme/JFLK+8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 05:44:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<XEsSfvJF2LVS38qm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.245.76.95
country_id: 2750405
description:
Dec 15 05:44:47 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=157.245.76.95, lip=66.85.158.92, TLS, session=<Lxm3f/JFRpGd9Uxf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 05:45:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<sLySgfJFwLIu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2025-12-15 05:46:12 dovecot_login authenticator failed for ([45.130.148.217]) [45.130.148.217]:50976: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-15 05:46:41 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:4025: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.227.133.54
country_id: 6252001
description:
Dec 15 05:47:53 host2 sshd[3652875]: Disconnected from invalid user ajay 192.227.133.54 port 45692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.133.54
country_id: 6252001
description:
Dec 15 05:47:24 host2 sshd[3652332]: Disconnected from invalid user mt 192.227.133.54 port 37224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 05:47:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<Rt9nifJFqpM+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 05:48:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<q5E8jPJF/JGG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 05:48:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<vq+djPJFZP5o7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.133.54
country_id: 6252001
description:
Dec 15 05:49:30 host2 sshd[3654891]: Disconnected from invalid user testftp 192.227.133.54 port 52112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 05:50:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Nxxrk/JFioiLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 05:50:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MFAJlfJFOgkvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-15 05:51:36 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (tewormory) [76.106.163.189]:55584: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 05:51:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<gJmilvJFppE+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 15 05:52:11 host2 sshd[3658222]: Disconnected from invalid user kiran 124.18.141.70 port 39834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 05:52:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<AOzkm/JF6ouPbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 05:55:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<QqlMpPJFFsc+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 05:57:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<LaAarvJFdJg+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.69
country_id: 2802361
description:
2025-12-15 05:58:38 dovecot_login authenticator failed for (ADMIN) [181.214.218.69]:46682: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 06:00:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<h2PrtvJF/BMvWbHj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 15 05:59:57 host2 sshd[3666170]: Disconnected from invalid user david 124.18.141.70 port 53442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.14
country_id: 6252001
description:
2025-12-15 06:01:18 dovecot_login authenticator failed for (ADMIN) [191.96.67.14]:50824: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 15 06:02:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<GCgbvvJF/s2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-15 06:03:32 dovecot_plain authenticator failed for (semed) [176.113.155.132]:56943: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 06:06:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<k2/KzfJFArUIiWqS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 06:07:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<apaA0fJF5o0vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 06:08:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<nsteelengcom@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<Yu/p0vJFKosv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 06:08:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<tl901fJF0KIro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 06:08:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<w1UI1vJFFu6PbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-15 06:10:16 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:38482: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.54.242.253
country_id: 2186224
description:
2025-12-15 06:10:35 dovecot_login authenticator failed for 210-54-242-253.adsl.xtra.co.nz [210.54.242.253]:43320: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-15 06:10:45 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (hamphic) [71.224.169.28]:39604: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-15 06:10:50 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:60745: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 15 06:11:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<pYxi3fJFEJE+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-15 06:11:05 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:36524: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2025-12-15 06:11:12 dovecot_login authenticator failed for ([182.79.86.54]) [182.79.86.54]:60832: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.216.146
country_id: 357994
description:
2025-12-15 06:11:16 dovecot_plain authenticator failed for (widily) [196.219.216.146]:36964: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-15 06:11:24 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:55603: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 06:11:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<G1dU4PJF6KM+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 06:12:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<IgyW4fJFaryYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 06:12:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<0LZh4vJF4uUuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-15 06:12:27 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62651: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 06:15:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<wwJk7PJFJKUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 06:17:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<4qNY9fJFMuePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 06:17:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<zrZ09PJFfrVnsX0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.34
country_id: 3865483
description:
2025-12-15 06:18:08 dovecot_login authenticator failed for (ADMIN) [146.70.38.34]:18859: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 06:20:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<bETf/fJF5JU+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:20:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<JJdF//JFcrIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 06:20:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<64Xa//JFOp8v7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:22:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<SeH7BPNFsuEDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 06:22:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<5xUrB/NF0KU+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 06:23:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<zudhCvNFHLY+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.21
country_id: 3057568
description:
2025-12-15 06:24:10 dovecot_login authenticator failed for (ADMIN) [149.102.232.21]:58617: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:24:13 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<E5S8DPNFnK8DhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.88.126.9
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 187.88.126.9 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:24:54 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Sgg3D/NF1OQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 06:26:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Sx1OE/NFdJqnrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:26:31 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<1WL6FPNFIqkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:27:12 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<CyBrF/NFLNMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-15 06:27:17 dovecot_login authenticator failed for ([125.17.216.185]) [128.185.246.106]:59738: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-15 06:27:33 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:57273: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:28:49 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<B84sHfNFsLwDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.250
country_id: 6252001
description:
2025-12-15 06:28:57 dovecot_login authenticator failed for wsip-184-191-242-250.fv.ks.cox.net [184.191.242.250]:57058: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-12-15 06:29:16 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:60351: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:29:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<W3sdIPNFMMIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 06:29:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<k/+KIPNF3qg+PIce>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:30:06 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<h5HHIfNFeIIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 06:30:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<X7/5IvNF7mmuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 06:31:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<E8JRJ/NFGsKhI2jD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:31:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<MChoJvNFQMQDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:31:50 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<iGUBKPNF2tIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 06:31:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<XjL/J/NFKpo+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.53.38.51
country_id: 6251999
description:
2025-12-15 06:33:05 dovecot_plain authenticator failed for (ovantarlan) [24.53.38.51]:46088: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-15 06:33:09 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (sonaristal) [24.1.200.187]:60288: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 06:33:17 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<SRQxLfNFoK8DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.23
country_id: 3624060
description:
2025-12-15 06:35:37 dovecot_login authenticator failed for ([186.177.88.23]) [186.177.88.23]:51582: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-15 06:35:50 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:42093: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2025-12-15 06:36:17 dovecot_login authenticator failed for (Copy-of-VM-2022) [45.94.31.41]:42854: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 06:36:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<A6spOPNFlNEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 06:36:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<V/qXOPNF3qM+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 06:37:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<RK4ZO/NF1NM+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 06:37:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<j5CGPPNFeIY+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.50
country_id: 1814991
description:
2025-12-15 06:38:14 dovecot_login authenticator failed for (ADMIN) [188.241.80.50]:62459: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 06:38:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<V0IeQPNF5OqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 06:38:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<sLK/QPNFiK0+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 06:37:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<MvssPfNFmFKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 06:38:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<VsUsQfNF2Jg+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 06:39:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<uVoKRfNFXsA+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 06:40:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<KV9NSPNFHuU+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 06:43:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<2CiMUPNF1uunrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 06:43:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<G1GwUPNFMq0+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-12-15 06:43:42 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:42618: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 06:44:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<hGkNVvNF2uOLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-15 06:43:57 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:51291: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 06:46:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<ZmN6XPNFosuB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-15 06:46:40 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:38957: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2025-12-15 06:46:52 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:33085: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.30
country_id: 690791
description:
Dec 15 06:49:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=176.103.25.30, lip=66.85.158.91, TLS, session=<JP2DZfNFdeSwZxke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.112.223
country_id: 2510769
description:
Dec 15 06:49:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.156.112.223, lip=66.85.158.91, TLS, session=<inScZvNF3ryynHDf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.20
country_id: 1269750
description:
2025-12-15 06:49:40 dovecot_login authenticator failed for (ADMIN) [103.108.174.20]:30484: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 06:50:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<OuZrafNFZMCkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.177.94.124
country_id: 3017382
description:
Dec 15 06:50:19 host2 sshd[3702848]: Invalid user cloudtourssrilan_travel from 195.177.94.124 port 56884


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-15 06:50:34 dovecot_plain authenticator failed for (auturead) [176.113.155.132]:39726: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-15 06:51:29 dovecot_login authenticator failed for ([84.211.6.119]) [84.211.6.119]:34926: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 06:51:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<wQ7IbvNFQMtnhdZ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 06:52:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<0LnQcvNFLLE+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-15 06:51:57 dovecot_login authenticator failed for (cm-84.211.11.216.get.no) [84.211.11.216]:39050: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 06:51:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<FCLsb/NFQMpnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-15 06:52:48 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:38588: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 06:53:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<YniZc/NFjqGl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-12-15 06:53:12 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:43860: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 06:55:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<wLZ8fPNFzMNS38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 06:56:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<I4hwfvNFeIAIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-15 06:56:38 dovecot_plain authenticator failed for (swought) [192.81.229.181]:34330: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 06:57:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<2JPUgvNFgI68pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 15 06:57:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<EiaFhPNFQKpnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.93
country_id: 3865483
description:
2025-12-15 06:57:52 dovecot_login authenticator failed for (ADMIN) [146.70.38.93]:24790: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 15 06:58:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<MkewhfNFPIY+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 06:58:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<IhQ1iPNFLso+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 06:58:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<HthLiPNFZpanR+bm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 07:00:26 host2 sshd[3711546]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 07:00:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<bostonlankacom@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<xF++jPNFMI0u4ntB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 15 07:01:48 host2 sshd[3712284]: Disconnected from invalid user soporte 177.85.247.230 port 21348 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 07:03:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<yj5+mPNFqqA+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-15 07:03:42 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:39388: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-15 07:03:57 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:49100: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 07:04:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ZFHMm/NFTDVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.21
country_id: 3175395
description:
Dec 15 07:05:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=217.26.179.21, lip=66.85.158.91, TLS, session=<VWMBn/NFZ63ZGrMV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.151.151
country_id: 99237
description:
Dec 15 07:05:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=65.20.151.151, lip=66.85.158.91, TLS, session=<buAWoPNFFopBFJeX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 07:06:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Wxp8pPNFasyLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 07:06:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<+U/PovNFJrSG0Wp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 15 07:06:29 host2 sshd[3717797]: Disconnected from invalid user den 210.79.142.221 port 42152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 07:07:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<kuAyqPNF3scvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.31.38.186
country_id: 6252001
description:
Dec 15 07:07:16 host2 sshd[3718625]: Disconnected from invalid user soporte 64.31.38.186 port 13686 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.177.94.124
country_id: 3017382
description:
[2025-12-15 07:07:34 +0530] info [cpaneld] 195.177.94.124 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.177.94.124
country_id: 3017382
description:
Dec 15 07:07:33 host2 sshd[3718841]: Invalid user cloudtourssrilan_travel from 195.177.94.124 port 57991


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 07:08:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<b1RKqfNFrJkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 07:08:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ZqcMrPNFIKg+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 15 07:08:55 host2 sshd[3719835]: Disconnected from invalid user khan 210.79.142.221 port 44250 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.26
country_id: 2562770
description:
2025-12-15 07:09:19 dovecot_login authenticator failed for (ADMIN) [176.125.230.26]:57261: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 07:09:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<zjkar/NF+IaPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 15 07:10:03 host2 sshd[3721002]: Disconnected from invalid user ram 210.79.142.221 port 43002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 07:11:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<wLP1tfNFKwhniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 15 07:11:21 host2 sshd[3723011]: Disconnected from invalid user tp 177.85.247.230 port 22332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 07:11:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<30JotfNFEN4+PIdj>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 165.235.184.6
country_id: 6252001
description:
Dec 15 07:11:56 host2 sshd[3723453]: Received disconnect from 165.235.184.6 port 42970:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.235.184.6
country_id: 6252001
description:
Dec 15 07:11:56 host2 sshd[3723453]: Disconnected from invalid user temp 165.235.184.6 port 42970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.31.38.186
country_id: 6252001
description:
Dec 15 07:11:03 host2 sshd[3722399]: Disconnected from invalid user ram 64.31.38.186 port 35228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 07:11:09 host2 sshd[3722522]: Disconnected from invalid user default 62.60.131.157 port 58011 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 07:11:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<FCh6t/NFNp0+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.235.184.6
country_id: 6252001
description:
Dec 15 07:12:53 host2 sshd[3724269]: Disconnected from invalid user soporte 165.235.184.6 port 50250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.31.38.186
country_id: 6252001
description:
Dec 15 07:12:04 host2 sshd[3723578]: Disconnected from invalid user khan 64.31.38.186 port 59652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.235.184.6
country_id: 6252001
description:
Dec 15 07:13:21 host2 sshd[3724727]: Disconnected from invalid user tp 165.235.184.6 port 13569 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 07:13:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<+lSiu/NFmnIvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 15 07:14:29 host2 sshd[3725571]: Disconnected from invalid user ram 177.85.247.230 port 19380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 15 07:15:49 host2 sshd[3726890]: Disconnected from invalid user indico 177.85.247.230 port 14052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.51
country_id: 3469034
description:
Dec 15 07:16:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.248.51, lip=66.85.158.91, TLS, session=<aAsNxfNFKo660fgz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.61.214
country_id: 6252001
description:
2025-12-15 07:16:18 dovecot_login authenticator failed for (ADMIN) [191.101.61.214]:7224: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.123.33
country_id: 690791
description:
Dec 15 07:16:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.228.123.33, lip=66.85.158.91, TLS, session=<ays2xvNFkapb5Hsh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 07:18:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<h8dFzfNFQOs+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.204
country_id: 1269750
description:
Dec 15 07:18:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=103.18.166.204, lip=66.85.158.91, TLS, session=<BsgnzfNFJqZnEqbM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.92
country_id: 3175395
description:
Dec 15 07:18:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.92, lip=66.85.158.91, TLS, session=<qfppzvNFuue5D6tc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 07:21:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<Kfrs1/NFipsvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-15 07:22:12 dovecot_login authenticator failed for ([182.95.58.130]) [182.95.58.130]:59376: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 07:22:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<XWG43vNFRIsv+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-15 07:23:06 dovecot_login authenticator failed for ([89.218.247.234]) [89.218.247.234]:36638: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 07:23:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<1zFb4PNFWsAro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 07:23:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<O9qJ4PNFKNmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 07:25:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<nUxF5vNFjuYuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 07:25:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<3oLj5vNFANUIiWqS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-15 07:26:51 dovecot_login authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:38224: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec 15 07:26:59 host2 sshd[3737376]: Disconnected from invalid user admin 38.248.12.102 port 37706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 07:26:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<LNEX6vNFIOWYNcU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.64.114.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 192.64.114.133 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-15 07:27:10 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:60320: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-15 07:27:20 dovecot_plain authenticator failed for (hellity) [154.144.243.93]:39742: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 07:28:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<a9Vk8fNF9QovWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Dec 15 07:28:35 host2 sshd[3738799]: Disconnected from invalid user user 27.254.152.90 port 59112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec 15 07:28:43 host2 sshd[3738940]: Disconnected from invalid user vision 38.248.12.102 port 57000 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.152.90
country_id: 1605651
description:
Dec 15 07:29:15 host2 sshd[3739429]: Disconnected from invalid user anton 27.254.152.90 port 43248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.141
country_id: 6252001
description:
2025-12-15 07:29:25 dovecot_login authenticator failed for (ADMIN) [158.173.153.141]:62791: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 15 07:30:24 host2 sshd[3740704]: Disconnected from invalid user ftpadmin 185.216.119.134 port 56734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Dec 15 07:30:40 host2 sshd[3740887]: Disconnected from invalid user root1 40.115.18.231 port 55718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Dec 15 07:30:57 host2 sshd[3741135]: Disconnected from invalid user ubuntu 143.110.186.36 port 49254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.22
country_id: 2635167
description:
2025-12-15 07:31:46 dovecot_login authenticator failed for (ADMIN) [45.133.172.22]:47698: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-15 07:31:48 dovecot_plain authenticator failed for (unned) [62.73.121.209]:40314: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Dec 15 07:31:58 host2 sshd[3742100]: Disconnected from invalid user ubuntu 143.110.186.36 port 37184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec 15 07:31:21 host2 sshd[3741607]: Disconnected from invalid user mc 38.248.12.102 port 52516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Dec 15 07:31:40 host2 sshd[3741816]: Disconnected from invalid user user 27.254.152.90 port 36326 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.115.18.231
country_id: 2750405
description:
Dec 15 07:31:16 host2 sshd[3741529]: Disconnected from invalid user admin 40.115.18.231 port 41766 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 07:32:10 host2 sshd[3742377]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 07:32:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nYxSAPRFWLmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 07:32:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=</oIzAvRFSotnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 07:32:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<aPfI//NFCrI+PIcs>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 143.110.213.247
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[143.110.213.247] [Remote Port]=[47448] [Authentication Database]=[mail] [Username]=[hr@seyawin.com] (10/10 failures) (blocked until [Tue Dec 16 02:02:20 2025 UTC/Tue Dec 16 07:32:20 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-15 07:33:03 dovecot_plain authenticator failed for (unphine) [65.20.148.194]:40168: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-15 07:33:05 dovecot_plain authenticator failed for (poscher) [178.250.191.189]:38644: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 15 07:33:17 host2 sshd[3743571]: Disconnected from invalid user anton 185.216.119.134 port 57210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.186.36
country_id: 1269750
description:
Dec 15 07:33:30 host2 sshd[3743748]: Disconnected from invalid user logger 143.110.186.36 port 50650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-15 07:33:35 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:33382: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-15 07:33:53 dovecot_plain authenticator failed for (innint) [5.31.23.133]:54665: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Dec 15 07:34:09 host2 sshd[3744378]: Disconnected from invalid user postgres 143.110.186.36 port 33262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-15 07:34:22 dovecot_login authenticator failed for ([84.213.189.183]) [84.213.189.183]:51071: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Dec 15 07:36:53 host2 sshd[3747387]: Disconnected from invalid user user 179.33.210.213 port 34840 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.107
country_id: 6252001
description:
Dec 15 07:37:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.188.107, lip=66.85.158.91, session=<oW9dEfRFAuIs3Lxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 07:37:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<dwaNEfRFXKgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-15 07:37:26 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:58620: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 07:39:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<jSVKGvRFMJWnrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Dec 15 07:40:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.123, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Q51GH/RFn96TuYR7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 07:42:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<PivVIvRF7qc+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 07:45:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<XXXGLvRFziquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 07:45:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<WhJUMPRFVN2hI2jD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.117
country_id: 6252001
description:
2025-12-15 07:47:46 dovecot_login authenticator failed for (ADMIN) [191.96.67.117]:34484: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 07:48:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<T7O4O/RFnqkv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.156
country_id: 6252001
description:
Dec 15 07:48:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.156, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VmaIOvRFAKMs3Lmc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.97.26
country_id: 2921044
description:
2025-12-15 07:48:43 dovecot_login authenticator failed for (ADMIN) [45.88.97.26]:43108: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 07:50:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<oIqOQPRFwuI+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 07:53:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ht/ES/RF3Ic+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.67
country_id: 6252001
description:
Dec 15 07:54:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.67, lip=66.85.158.91, session=<kPFJTvRFBPmTuYRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 07:54:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<dCVpUPRF3jynYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 07:54:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<melanifinefoodcom@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<RyicUPRF4uWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 07:56:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<kSlOVvRFoKU+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 07:56:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<dUWEV/RFMtSnrKy4>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 167.172.172.184
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[167.172.172.184] [Remote Port]=[54322] [Authentication Database]=[mail] [Username]=[info@lankaherbalsolutions.com] (10/10 failures) (blocked until [Tue Dec 16 02:26:42 2025 UTC/Tue Dec 16 07:56:42 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 07:59:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<V/5YYPRFmrk+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 15 07:59:14 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, session=<jC+KYPRFdKRChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.123
country_id: 3996063
description:
2025-12-15 08:01:37 dovecot_login authenticator failed for (ADMIN) [77.81.142.123]:13962: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 139.59.74.148
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[139.59.74.148] [Remote Port]=[49516] [Authentication Database]=[mail] [Username]=[info@lankaherbalsolutions.com] (10/10 failures) (blocked until [Tue Dec 16 02:31:40 2025 UTC/Tue Dec 16 08:01:40 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 08:01:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<l4o+afRFbMGLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Dec 15 08:02:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<5JqZavRFpoFChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-15 08:02:33 dovecot_login authenticator failed for ([84.211.19.12]) [84.211.19.12]:52753: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-15 08:02:56 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (sumsal) [174.161.27.82]:55014: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-15 08:03:59 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:59398: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.87
country_id: 6252001
description:
Dec 15 08:03:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.87, lip=66.85.158.92, TLS, session=<eL47bvRF7vXN0h9X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-15 08:03:08 dovecot_login authenticator failed for ([84.211.13.217]) [84.211.13.217]:57176: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 15 08:03:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<9mRYb/RFpN8+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.151
country_id: 1733045
description:
2025-12-15 08:03:41 dovecot_login authenticator failed for ([49.124.152.151]) [49.124.152.151]:51960: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 08:04:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<i1JKcvRFEtaB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 08:04:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<nnXjc/RFLqQ+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 08:04:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<1z2jdPRFGrekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 08:05:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<O1RJePRFjOg+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 08:06:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<LbkDevRFNs9S38qm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.111.53.48
country_id: 6252001
description:
Dec 15 08:06:38 host2 sshd[3773840]: Disconnected from invalid user gitlab 174.111.53.48 port 60806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 08:07:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<UWW0fPRFRuI+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 08:08:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<J2SlgPRFss1nhdZ/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.36
country_id: 2542007
description:
Dec 15 08:08:16 host2 sshd[3774894]: Disconnected from invalid user astra 81.192.46.36 port 60460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 08:09:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<q+dOhPRFANKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 08:09:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<P9lvhPRFArlnJFMP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.94
country_id: 6252001
description:
Dec 15 08:10:07 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.185.94, lip=66.85.158.91, session=<Pe9zh/RFqM4s3Lle>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.36
country_id: 2542007
description:
Dec 15 08:10:22 host2 sshd[3776545]: Disconnected from invalid user bartek 81.192.46.36 port 54188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.94.109
country_id: 3865483
description:
Dec 15 08:10:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=190.181.94.109, lip=66.85.158.91, TLS, session=<b3FmiPRFvoa+tV5t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.60
country_id: 798544
description:
Dec 15 08:10:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.236.172.60, lip=66.85.158.91, TLS, session=<ec6HifRFerVb7Kw8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.36
country_id: 2542007
description:
Dec 15 08:11:25 host2 sshd[3777140]: Disconnected from invalid user saeed 81.192.46.36 port 51052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec 15 08:11:37 host2 sshd[3777252]: Disconnected from invalid user test 103.59.94.155 port 38176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 08:12:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<oBsCkfRF+r68pkxr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.111.53.48
country_id: 6252001
description:
Dec 15 08:13:16 host2 sshd[3778042]: Disconnected from invalid user omer 174.111.53.48 port 55746 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 08:13:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<TNk3k/RF4toIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2025-12-15 08:14:20 dovecot_plain authenticator failed for (landstaity) [185.120.142.233]:42727: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 08:14:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<1F+6l/RFbtU+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.242.217
country_id: 1269750
description:
Dec 15 08:14:56 host2 sshd[3778904]: Disconnected from invalid user ubuntu 143.110.242.217 port 60946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec 15 08:15:11 host2 sshd[3779181]: Disconnected from invalid user reza 103.59.94.155 port 51030 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 08:15:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<fIfOmvRF6rI+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 15 08:15:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<JnHfmvRFGIZnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.207.116.157
country_id: 2635167
description:
2025-12-15 08:16:42 dovecot_plain authenticator failed for gamma.climatec-windows.co.uk (plopplased) [92.207.116.157]:44691: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 08:16:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<qX9NnvRF0qgu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.106.38
country_id: 2623032
description:
2025-12-15 08:17:05 dovecot_login authenticator failed for (ADMIN) [46.246.106.38]:47248: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 08:17:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@venee.lk>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<9GcOovRFaM2nR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 08:18:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<iOUnpfRF2Ns+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.200
country_id: 2658434
description:
2025-12-15 08:19:31 dovecot_login authenticator failed for (ADMIN) [158.173.152.200]:19235: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 15 08:20:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=</fOVrPRF6saB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 08:20:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<DjU+rvRFZixo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 08:21:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<L9c/sfRFvygvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-15 08:22:45 dovecot_login authenticator failed for ([182.78.10.145]) [122.185.101.50]:37100: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-12-15 08:23:28 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:13896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2025-12-15 08:23:47 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:39127: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 08:23:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<elE9uPRFhJmLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-15 08:24:16 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:55952: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 08:25:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<KLyTvfRFGIKG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 08:26:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<RzFVwPRFNGQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 08:27:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Bj3txfRFZMovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 08:28:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<37+3x/RFOJOPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-15 08:28:33 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:43600: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 08:29:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<MNA3zPRFAhNniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-12-15 08:29:06 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:51874: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 15 08:30:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<2qZFz/RFUr0+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 08:30:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<znpG0fRFMLA+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 15 08:30:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<DrAt0fRF0qs+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.150
country_id: 6252001
description:
2025-12-15 08:33:21 dovecot_login authenticator failed for (ADMIN) [102.129.153.150]:40818: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-15 08:33:53 dovecot_plain authenticator failed for (aheasic) [65.20.160.107]:40945: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.82
country_id: 6252001
description:
Dec 15 08:34:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.82, lip=66.85.158.91, TLS, session=<q4NO3fRFcuzN0h9S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 08:35:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<SKDG4PRFMKYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 08:35:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<scYl4fRFBpw+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.19.166
country_id: 290557
description:
2025-12-15 08:36:17 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:60383: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-12-15 08:36:33 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:48034: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 08:37:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<n7Ax6fRFlNs+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 08:37:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<uqsM6fRF9tIv+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-15 08:38:37 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (eateurtar) [81.225.30.107]:46515: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 08:38:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<xyia7fRF7KePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 08:38:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<dTrb7fRFjNUro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 08:38:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<I1NS6/RFlL8uZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-15 08:39:55 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:46739: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-12-15 08:40:43 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:57097: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-15 08:40:21 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:55950: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.177
country_id: 1733045
description:
2025-12-15 08:40:33 dovecot_login authenticator failed for ([49.124.155.177]) [49.124.155.177]:54128: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-15 08:41:53 dovecot_login authenticator failed for ([84.211.14.36]) [84.211.14.36]:54440: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.125.130
country_id: 6252001
description:
2025-12-15 08:41:09 dovecot_login authenticator failed for (ADMIN) [151.241.125.130]:43371: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.26
country_id: 2635167
description:
Dec 15 08:41:11 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.26, lip=66.85.158.92, TLS, session=<Xf2T9vRF69i594ka>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.40
country_id: 2635167
description:
Dec 15 08:41:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.40, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<3uPU9vRF27i594ko>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 08:41:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<YS+G9/RFQpOYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-15 08:41:40 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:54804: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-15 08:41:44 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:59490: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.43
country_id: 2635167
description:
Dec 15 08:41:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.43, lip=66.85.158.92, TLS handshaking: Connection closed, session=<L6fR+PRFAe1X7LAr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-15 08:42:15 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:34593: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.227.5
country_id: 1643084
description:
Dec 15 08:42:23 host2 sshd[3802211]: Invalid user cloudtourssrilan_travel from 182.8.227.5 port 58597


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.70
country_id: 2635167
description:
Dec 15 08:42:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.70, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<9tvN+vRFp8FX7LBG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.227.5
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 182.8.227.5 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.65
country_id: 2635167
description:
Dec 15 08:42:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.65, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<EH3K/PRF1edX7LBB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.60.88
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 143.244.60.88 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.56
country_id: 2635167
description:
Dec 15 08:43:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.56, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<51XH/vRFZ8dX7LA4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 08:43:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<XNQs/fRFEWIvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.72
country_id: 2635167
description:
Dec 15 08:44:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.72, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<WE7BAPVF2bhX7LBI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 15 08:44:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<QD3RAfVF2rpChJlx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.51
country_id: 2635167
description:
Dec 15 08:44:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.51, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5J6/AvVFAetX7LAz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec 15 08:44:40 host2 sshd[3804039]: Disconnected from invalid user farhan 102.220.23.233 port 50962 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.41
country_id: 2635167
description:
Dec 15 08:45:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.41, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<c3q8BPVFT85X7LAp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.43
country_id: 2635167
description:
Dec 15 08:45:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.43, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<PY+1BvVFlelX7LAr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 08:46:31 host2 sshd[3807467]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Dec 15 08:46:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<10myCPVFZ5q594k8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-15 08:46:20 dovecot_plain authenticator failed for (colize) [102.53.15.17]:48570: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 08:46:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<rKYDCfVFwIYIiWqS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec 15 08:47:36 host2 sshd[3808280]: Disconnected from invalid user vinay 102.220.23.233 port 43070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 08:47:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<WOu8DfVFVoGPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 15 08:48:36 host2 sshd[3809744]: Disconnected from invalid user openkm 36.89.28.139 port 38900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.225.252.169
country_id: 1269750
description:
Dec 15 08:48:10 host2 sshd[3809319]: Disconnected from invalid user vpnuser 74.225.252.169 port 54058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.233
country_id: 192950
description:
Dec 15 08:48:16 host2 sshd[3809429]: Disconnected from invalid user magento 102.220.23.233 port 57060 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-15 08:49:56 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:59880: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 15 08:49:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<3mPnEvVFgNk+PIdb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.174
country_id: 6252001
description:
Dec 15 08:49:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.174, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mbPzE/VFsM+TuYSu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.51
country_id: 6252001
description:
Dec 15 08:49:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.51, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8gCbFfVFNNjN0h8z>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 15 08:50:25 host2 sshd[3811389]: Disconnected from invalid user admin 36.89.28.139 port 52854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 08:50:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<95SeF/VFzN5nsX0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-12-15 08:50:12 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:54866: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec 15 08:50:21 host2 sshd[3811321]: Disconnected from invalid user webmaster 102.220.23.233 port 42578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 15 08:51:52 host2 sshd[3812829]: Disconnected from invalid user ftpuser 36.89.28.139 port 60192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Dec 15 08:51:59 host2 sshd[3812900]: Disconnected from invalid user sam 93.113.63.124 port 40446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Dec 15 08:52:36 host2 sshd[3813526]: Disconnected from invalid user eric 93.113.63.124 port 39460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.225.252.169
country_id: 1269750
description:
Dec 15 08:53:03 host2 sshd[3813986]: Disconnected from invalid user weblogic 74.225.252.169 port 59512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Dec 15 08:53:12 host2 sshd[3814096]: Disconnected from invalid user ftpuser 93.113.63.124 port 33030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 08:53:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<8/2nI/VF0p2nrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 15 08:53:56 host2 sshd[3814629]: Disconnected from invalid user sonar 36.89.28.139 port 60444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 08:54:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<yJobJvVFRLIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 08:55:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<1WRfKPVFQKY+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.249.214.109
country_id: 6251999
description:
2025-12-15 08:55:19 dovecot_login authenticator failed for (ADMIN) [178.249.214.109]:14830: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Dec 15 08:56:17 host2 sshd[3817141]: Disconnected from invalid user sonar 93.113.63.124 port 39134 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.225.252.169
country_id: 1269750
description:
Dec 15 08:56:43 host2 sshd[3817471]: Disconnected from invalid user edubook 74.225.252.169 port 40246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 09:00:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Al/8PPVFrjyuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 15 09:02:12 host2 sshd[3822393]: Disconnected from invalid user zookeeper 197.153.57.103 port 52856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 09:02:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<CfhjQvVFEOwv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.104
country_id: 1831722
description:
2025-12-15 09:02:03 dovecot_login authenticator failed for (ADMIN) [188.215.235.104]:18970: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 09:02:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<HtIiQfVFSNShI2jD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-15 09:03:21 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (perelatei) [76.97.155.25]:37294: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-15 09:03:55 dovecot_plain authenticator failed for (nomytores) [24.104.225.201]:50893: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 15 09:04:46 host2 sshd[3824817]: Disconnected from invalid user guest 197.153.57.103 port 52606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 15 09:05:23 host2 sshd[3825489]: Disconnected from invalid user akshay 197.153.57.103 port 59603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 15 09:06:29 host2 sshd[3826440]: Disconnected from invalid user manu 197.153.57.103 port 45352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 15 09:08:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<T0JzVvVFYJw+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.146
country_id: 6252001
description:
2025-12-15 09:08:54 dovecot_login authenticator failed for (ADMIN) [91.124.17.146]:43823: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 09:11:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<SAZ4YfVFIsGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 09:11:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<IJudYvVF7KCWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 09:12:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<uGVTZfVFXiKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 09:13:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<1mObavVFvrY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 09:13:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<dhWWavVF9oc+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 09:16:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<kl9rdPVFDr4+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-15 09:16:59 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:53390: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-12-15 09:17:19 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:57022: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-15 09:17:45 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:35484: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 09:17:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<XJh+efVFWtxS38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-15 09:17:53 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:54546: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 09:18:20 host2 sshd[3837825]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 15 09:19:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<XhwHfvVFVKXBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 09:19:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<1hCufvVFROuLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 09:19:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<FabvfvVFMJ6kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2025-12-15 09:21:18 dovecot_plain authenticator failed for c-98-196-209-55.hsd1.tx.comcast.net (auttionic) [98.196.209.55]:33704: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 09:21:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<GEORh/VFaqyB4kCN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Dec 15 09:21:59 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.92, TLS, session=<FNN2iPVFUoJHBobp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.251
country_id: 3469034
description:
2025-12-15 09:22:56 dovecot_login authenticator failed for (ADMIN) [188.241.177.251]:3161: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 09:23:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<XG0tjvVFRrM+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 15 09:24:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<OeAEkfVFlJYjygmF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 09:24:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<TeoLkfVFkLhnhdZ/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.85
country_id: 2782113
description:
2025-12-15 09:24:43 dovecot_login authenticator failed for (ADMIN) [156.146.60.85]:18433: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 09:24:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<xyExkvVFmJil6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 09:25:12 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:51718: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 09:26:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<HKoYmfVFZK9nJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 09:26:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<hRkXmvVFCoO8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 09:27:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<9sICnfVFZMQ+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-15 09:28:35 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (dularderse) [196.47.172.253]:41635: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.92
country_id: 130758
description:
2025-12-15 09:30:13 dovecot_plain authenticator failed for (localhost) [62.60.135.92]:48514: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 15 09:32:15 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, session=<wzIzrfVFMA1ChJmN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 15 09:32:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<jvmgrfVFCoJnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 09:32:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<BICZrfVF2J8u4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2025-12-15 09:32:55 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:59291: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 09:33:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<wuFLs/VFMO0IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 09:34:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<aGyZs/VFQOc+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-15 09:33:11 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:36550: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 15 09:35:22 host2 sshd[3852930]: Disconnected from invalid user vncuser 181.212.81.228 port 43152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 09:36:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<BCKCuvVFoLM+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 09:36:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<gLzpvPVFv4kvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 15 09:36:45 host2 sshd[3854285]: Disconnected from invalid user rahul 181.212.81.228 port 39354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 15 09:36:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<SOLIvfVFYOunR+bm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 15 09:37:25 host2 sshd[3854932]: Disconnected from invalid user admin 181.212.81.228 port 51536 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 09:38:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<qEmiw/VFpPlo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-15 09:39:01 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:4026: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.90.185
country_id: 6252001
description:
Dec 15 09:39:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=64.227.90.185, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<beSwxvVFqNxA41q5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-15 09:39:24 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:43032: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Dec 15 09:39:57 host2 sshd[3856855]: Disconnected from invalid user vncuser 4.211.84.189 port 36122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-15 09:41:00 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:56115: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Dec 15 09:41:03 host2 sshd[3857988]: Disconnected from invalid user samuel 4.211.84.189 port 40448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-15 09:40:20 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (tiondonch) [68.52.119.193]:41242: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.142.55.40
country_id: 1861060
description:
2025-12-15 09:40:22 dovecot_login authenticator failed for 40.55.142.133.rev.iijmobile.jp [133.142.55.40]:9220: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.131.240.7
country_id: 798544
description:
Dec 15 09:41:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=185.131.240.7, lip=66.85.158.91, TLS, session=<M4d7zvVFEJS5g/AH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 09:41:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<lddqz/VFRpGLO0qU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.211.84.189
country_id: 3017382
description:
Dec 15 09:42:14 host2 sshd[3858866]: Disconnected from invalid user jenkins 4.211.84.189 port 54966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 09:42:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<root@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<QjDY0PVFJTUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.27
country_id: 2510769
description:
Dec 15 09:42:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=185.214.138.27, lip=66.85.158.91, TLS, session=</WQG0PVF7ca51oob>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Dec 15 09:43:55 host2 sshd[3860079]: Disconnected from invalid user php 4.211.84.189 port 43692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 09:44:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<TSYV2PVFyHAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.8
country_id: 614540
description:
2025-12-15 09:44:43 dovecot_login authenticator failed for (ADMIN) [95.181.236.8]:3887: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 09:44:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<lQAk2vVFfJqG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 155.133.114.67
country_id: 798544
description:
Dec 15 09:45:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=155.133.114.67, lip=66.85.158.91, TLS, session=<pgGX2/VFJqubhXJD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 09:45:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<NuVW3fVFZuKPbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.5.21.52
country_id: 3865483
description:
Dec 15 09:45:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.5.21.52, lip=66.85.158.91, TLS, session=<oJG83PVFApa+BRU0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.56
country_id: 798549
description:
2025-12-15 09:45:56 dovecot_login authenticator failed for (ADMIN) [143.244.52.56]:50586: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-15 09:45:59 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (nachelly) [73.145.107.251]:51542: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 09:46:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XU6t4PVF8AVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.18
country_id: 3865483
description:
Dec 15 09:46:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.252.18, lip=66.85.158.91, TLS, session=<u/FN4PVFH9azAPwS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.154.21
country_id: 99237
description:
Dec 15 09:47:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=65.20.154.21, lip=66.85.158.91, TLS, session=<9USX4fVFlphBFJoV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 09:49:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<O4qs6/VFXJIvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 09:51:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<EubU8vVFoIguZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 09:52:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<H2FU9fVFsK0v+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-15 09:52:47 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (oushiecce) [76.157.219.158]:45598: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 09:53:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<zTGs+vVFWKGYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 09:54:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<85bA/PVF7rEro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 09:55:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<JaqF/vVFQqyPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Dec 15 09:57:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wH0DCPZFetqi2JUH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 09:57:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<V+rWB/ZFl8gvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-15 09:57:53 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49564: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Dec 15 09:59:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<UK7ZDPZFEP6i2JUH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Dec 15 09:59:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<8WKyDfZFjOWi2JUH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 15 10:00:22 host2 sshd[3873635]: Disconnected from invalid user user 2.57.121.25 port 16468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.189
country_id: 3144096
description:
2025-12-15 10:02:34 dovecot_login authenticator failed for (ADMIN) [46.246.122.189]:45045: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-15 10:05:00 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:41692: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 10:04:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Feg7H/ZFXOGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 10:04:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<mkARIPZFvJc+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 15 10:05:52 host2 sshd[3878382]: Disconnected from invalid user user 198.12.75.220 port 48296 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Dec 15 10:06:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS, session=<zgVdJvZFiOyi2JUH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 10:06:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<7Z1HKfZFbsBnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 15 10:06:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<imx5JvZFFNqB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-15 10:06:52 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:58209: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 10:06:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<yL8lKfZFkr4+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.72
country_id: 1643084
description:
Dec 15 10:07:17 host2 sshd[3879498]: Disconnected from invalid user admin 103.31.39.72 port 38064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-15 10:07:29 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:42562: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.44.203
country_id: 1819730
description:
Dec 15 10:07:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=118.193.44.203, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XJLxK/ZFMlJ2wSzL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 10:09:07 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:48870: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 15 10:08:41 host2 sshd[3880343]: Disconnected from invalid user admin 41.58.186.130 port 60322 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.38
country_id: 1819730
description:
Dec 15 10:08:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.38, lip=66.85.158.92, TLS, session=<rMM6MPZFtpotjpom>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 10:09:15 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:49466: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 10:09:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<uClwMvZFupinrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 15 10:09:59 host2 sshd[3881183]: Disconnected from invalid user info 198.12.75.220 port 43596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 10:10:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<c22GNPZF4qYIiWqS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.255.142.254
country_id: 3686110
description:
Dec 15 10:10:58 host2 sshd[3882127]: Disconnected from invalid user viper 190.255.142.254 port 44906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.255.142.254
country_id: 3686110
description:
Dec 15 10:11:39 host2 sshd[3882694]: Disconnected from invalid user centos 190.255.142.254 port 59210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.5
country_id: 2963597
description:
2025-12-15 10:11:45 dovecot_login authenticator failed for (ADMIN) [155.2.194.5]:49735: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 15 10:12:05 host2 sshd[3883112]: Disconnected from invalid user sonar 107.172.146.104 port 38262 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 15 10:11:14 host2 sshd[3882390]: Disconnected from invalid user sambauser 198.12.75.220 port 57704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 10:12:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<4IrNO/ZFaL0v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.255.142.254
country_id: 3686110
description:
Dec 15 10:12:18 host2 sshd[3883398]: Disconnected from invalid user ftpadmin1 190.255.142.254 port 45276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 10:12:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<O32DPPZFkM4+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 15 10:12:47 host2 sshd[3883689]: Disconnected from invalid user git 41.58.186.130 port 53584 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.255.142.254
country_id: 3686110
description:
Dec 15 10:13:00 host2 sshd[3883798]: Disconnected from invalid user ivan 190.255.142.254 port 59568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 15 10:13:31 host2 sshd[3884193]: Disconnected from invalid user localuser 41.58.186.130 port 49186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 15 10:13:43 host2 sshd[3884339]: Disconnected from invalid user user2 198.12.75.220 port 57022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec 15 10:13:50 host2 sshd[3884435]: Disconnected from invalid user xjy 52.169.142.214 port 55356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.105.176.66
country_id: 1269750
description:
Dec 15 10:14:07 host2 sshd[3884635]: Disconnected from invalid user hamza 103.105.176.66 port 48914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 15 10:14:49 host2 sshd[3885173]: Disconnected from invalid user yogesh 41.58.186.130 port 47620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.72
country_id: 1643084
description:
Dec 15 10:14:59 host2 sshd[3885277]: Disconnected from invalid user connor 103.31.39.72 port 32790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 15 10:14:13 host2 sshd[3884715]: Disconnected from invalid user thor 41.58.186.130 port 50716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-15 10:14:51 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (seagy) [24.1.200.187]:34088: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 15 10:14:58 host2 sshd[3885272]: Disconnected from invalid user azure 43.154.195.142 port 59960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 15 10:14:16 host2 sshd[3884775]: Disconnected from invalid user test1 107.172.146.104 port 39888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 15 10:15:17 host2 sshd[3885686]: Disconnected from invalid user cognos 107.172.146.104 port 43270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec 15 10:15:34 host2 sshd[3885882]: Disconnected from invalid user xue 52.169.142.214 port 53736 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 10:15:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<anJASPZFys4+PIdl>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 15 10:15:46 host2 sshd[3886017]: Received disconnect from 107.172.146.104 port 35432:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec 15 10:16:10 host2 sshd[3886257]: Disconnected from invalid user laura 52.169.142.214 port 50350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.223
country_id: 3996063
description:
2025-12-15 10:16:35 dovecot_login authenticator failed for (201.173.56.223-clientes-izzi.mx) [201.173.56.223]:41896: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.197.57
country_id: 6251999
description:
2025-12-15 10:16:34 dovecot_login authenticator failed for (ADMIN) [179.61.197.57]:22155: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.150
country_id: 6252001
description:
2025-12-15 10:16:19 dovecot_login authenticator failed for ([70.174.167.150]) [70.174.167.150]:53632: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 15 10:16:44 host2 sshd[3886751]: Disconnected from invalid user newuser 107.172.146.104 port 46786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 10:16:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kEtwTPZFIOgv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 10:16:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<LroVTfZFmIOuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 10:17:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<md42TvZFJtyhI2jD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 15 10:17:30 host2 sshd[3887415]: Disconnected from invalid user cognos 163.181.207.222 port 33642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-15 10:17:34 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (loment) [24.127.53.61]:34042: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-15 10:18:45 dovecot_login authenticator failed for (cm-84.211.12.107.get.no) [84.211.12.107]:45474: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.72
country_id: 1643084
description:
Dec 15 10:18:16 host2 sshd[3887906]: Disconnected from invalid user kafka 103.31.39.72 port 51790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 15 10:18:22 host2 sshd[3887976]: Disconnected from invalid user admin 163.181.207.222 port 55630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-15 10:18:31 dovecot_login authenticator failed for ([125.19.174.244]) [128.185.201.138]:36364: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 10:19:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<pls/VfZF6K4+PIcs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.68.98.152
country_id: 1168579
description:
Dec 15 10:19:42 host2 sshd[3888852]: Disconnected from invalid user ivan 111.68.98.152 port 51436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.61.112.234
country_id: 3175395
description:
Dec 15 10:21:04 host2 sshd[3890240]: Disconnected from invalid user esuser 79.61.112.234 port 36160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 15 10:20:34 host2 sshd[3889725]: Disconnected from invalid user dockeradmin 43.154.195.142 port 35064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.40.73.192
country_id: 2077456
description:
Dec 15 10:21:12 host2 sshd[3890421]: Disconnected from invalid user fabio 20.40.73.192 port 54560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.41
country_id: 130758
description:
2025-12-15 10:22:01 dovecot_plain authenticator failed for (localhost) [62.60.131.41]:44648: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 10:22:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WDcFYfZFrtsDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 10:23:03 host2 sshd[3891957]: Disconnected from invalid user ftpuser 62.60.131.157 port 16966 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.40.73.192
country_id: 2077456
description:
Dec 15 10:23:18 host2 sshd[3892143]: Disconnected from invalid user oracle 20.40.73.192 port 52878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 15 10:23:32 host2 sshd[3892261]: Disconnected from invalid user surya 103.91.246.101 port 44306 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 15 10:23:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, session=<0kKgZfZFU//CpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 10:24:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6L3hZ/ZFeJkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.40.73.192
country_id: 2077456
description:
Dec 15 10:24:44 host2 sshd[3893042]: Disconnected from invalid user mehedi 20.40.73.192 port 51392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-15 10:24:56 dovecot_login authenticator failed for ([84.210.151.158]) [84.210.151.158]:35369: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-12-15 10:25:15 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:21185: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-15 10:25:35 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:50098: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.44
country_id: 130758
description:
2025-12-15 10:25:50 dovecot_plain authenticator failed for (localhost) [62.60.135.44]:42808: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 15 10:26:56 host2 sshd[3894594]: Disconnected from invalid user fabio 103.91.246.101 port 43464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 10:27:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<0oAVcfZF0oKnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 10:28:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<kvqydPZFlMaWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 10:27:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<FP7oc/ZFVswDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 10:28:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<6eszdfZFToQ+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 10:29:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<t7cyePZFTLgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 10:29:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<MT+lePZFxlqnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 10:29:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<UhT5efZFbOlS38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-15 10:30:05 dovecot_login authenticator failed for ([84.213.191.55]) [84.213.191.55]:54221: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 10:30:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<4ABrfPZFHs4DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-15 10:30:25 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:55024: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec 15 10:31:31 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<dHkigfZF2tS58uIR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 10:32:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<HGFzg/ZF4uoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-15 10:32:35 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (canuty) [89.67.37.2]:53731: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.36.110
country_id: 6251999
description:
2025-12-15 10:32:40 dovecot_login authenticator failed for (ADMIN) [191.96.36.110]:14380: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.161.80
country_id: 614540
description:
Dec 15 10:33:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=5.133.161.80, lip=66.85.158.91, TLS, session=<gj+hhfZFKbcFhaFQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 10:33:59 host2 sshd[3899475]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.10.70.123
country_id: 298795
description:
Dec 15 10:33:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=38.10.70.123, lip=66.85.158.91, TLS, session=<ZuHChvZFOaYmCkZ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 10:33:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZsD/h/ZFxo4DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-15 10:33:40 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:42060: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-15 10:34:49 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:32972: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-15 10:35:11 dovecot_login authenticator failed for ([182.79.31.107]) [152.52.199.126]:53452: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 10:35:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uvmSjvZFiIukXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 10:35:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<8qfkjvZF6oUDhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.95.30
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.203.95.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.70.45.104
country_id: 285570
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.70.45.104 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.173.246
country_id: 6252001
description:
2025-12-15 10:37:02 dovecot_login authenticator failed for ([70.174.173.246]) [70.174.173.246]:44039: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.183.122.132
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.183.122.132 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.196.245.9
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.196.245.9 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 59.178.220.227
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 59.178.220.227 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.102.30.174
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.102.30.174 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.251.234.179
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 171.251.234.179 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 10:37:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<iPxWlfZFaJk+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-12-15 10:37:14 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:65269: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.197
country_id: 798544
description:
2025-12-15 10:37:15 dovecot_login authenticator failed for (ADMIN) [138.199.59.197]:23688: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 10:37:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<FmRNl/ZFStiLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Dec 15 10:37:52 host2 sshd[3902751]: Disconnected from invalid user jenkins 40.117.97.0 port 57678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 10:39:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=</szSnvZFquuB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Dec 15 10:41:23 host2 sshd[3905819]: Disconnected from invalid user mailuser 89.47.53.19 port 55566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 10:41:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<0fjIpPZFdKKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 10:41:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<kPi7pfZFPuRnhdZ/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Dec 15 10:43:05 host2 sshd[3907163]: Disconnected from invalid user jenkins 103.231.14.54 port 48518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Dec 15 10:42:36 host2 sshd[3906829]: Disconnected from invalid user test 40.117.97.0 port 41996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-15 10:42:49 dovecot_login authenticator failed for ([62.97.163.187]) [62.97.163.187]:38376: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.47.53.19
country_id: 798549
description:
Dec 15 10:43:02 host2 sshd[3907088]: Disconnected from invalid user user5 89.47.53.19 port 35658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.153.100
country_id: 3508796
description:
Dec 15 10:43:47 host2 sshd[3907778]: Disconnected from invalid user sfserver 45.172.153.100 port 53242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 10:44:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<zpv2rfZFet+8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 15 10:43:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<yh8pq/ZFOrLCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Dec 15 10:44:11 host2 sshd[3908056]: Disconnected from invalid user ai 103.189.89.76 port 59884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.153.100
country_id: 3508796
description:
Dec 15 10:44:25 host2 sshd[3908264]: Disconnected from invalid user git 45.172.153.100 port 34426 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 10:44:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<Xrzbr/ZFkp1nJFMP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Dec 15 10:44:44 host2 sshd[3908480]: Disconnected from invalid user jenkins 89.47.53.19 port 43994 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.153.100
country_id: 3508796
description:
Dec 15 10:45:03 host2 sshd[3908886]: Disconnected from invalid user anand 45.172.153.100 port 49382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Dec 15 10:45:18 host2 sshd[3909164]: Disconnected from invalid user tunnel 89.47.53.19 port 56182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Dec 15 10:45:41 host2 sshd[3909553]: Disconnected from invalid user test 103.231.14.54 port 51328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Dec 15 10:46:22 host2 sshd[3910370]: Disconnected from invalid user hik 103.231.14.54 port 59606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.231.14.54
country_id: 1819730
description:
Dec 15 10:47:39 host2 sshd[3911180]: Disconnected from invalid user ai 103.231.14.54 port 57904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.80.134
country_id: 1210997
description:
Dec 15 10:47:42 host2 sshd[3911208]: Disconnected from invalid user hik 182.48.80.134 port 36230 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 10:47:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<1J1bu/ZFeNc+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-15 10:48:06 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:50094: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.94
country_id: 130758
description:
2025-12-15 10:47:46 dovecot_plain authenticator failed for (localhost) [62.60.135.94]:37224: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.48.80.134
country_id: 1210997
description:
Dec 15 10:49:04 host2 sshd[3912292]: Disconnected from invalid user anand 182.48.80.134 port 49092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-15 10:48:13 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:54432: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Dec 15 10:48:19 host2 sshd[3911662]: Disconnected from invalid user jenkins 103.189.89.76 port 51280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.117
country_id: 6251999
description:
2025-12-15 10:48:23 dovecot_login authenticator failed for (ADMIN) [66.56.81.117]:45760: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 10:49:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<ggapv/ZFWsIu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-15 10:48:22 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:59965: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.81
country_id: 1733045
description:
2025-12-15 10:48:42 dovecot_login authenticator failed for ([49.124.151.81]) [49.124.151.81]:49048: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.192
country_id: 6252001
description:
Dec 15 10:50:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.192, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<l8I1xPZFAsuTuYXA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-15 10:50:49 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (forsang) [24.61.199.212]:46870: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-15 10:50:59 dovecot_login authenticator failed for (54-170-97-62.cust.smartcall.no) [62.97.170.54]:44249: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.192
country_id: 6252001
description:
Dec 15 10:51:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.192, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wLx4x/ZFvvqTuYXA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 10:51:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<nX6Bx/ZF2/EvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-15 10:51:19 dovecot_login authenticator failed for ([84.211.13.178]) [84.211.13.178]:56754: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 10:52:24 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (masinith) [87.103.126.54]:3139: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.251.211.49
country_id: 6252001
description:
Dec 15 10:52:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.251.211.49, lip=66.85.158.91, TLS: Connection closed, session=<mDOGzfZFfKgs+9Mx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 10:53:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<LqkK0fZFxII+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 10:55:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 11 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<Y2CX1fZFark+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 10:55:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<XvUQ2PZFbG1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 10:56:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<ce1F2/ZFpZwvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.192
country_id: 6252001
description:
Dec 15 10:58:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.192, lip=66.85.158.91, TLS, session=<ReoH4PZF5v6TuYXA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 10:59:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<F3764/ZFKMUIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 15 10:59:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<jdPC5fZFtq4+PIdc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.202.161.108
country_id: 6252001
description:
Dec 15 11:00:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.202.161.108, lip=66.85.158.91, TLS: Connection closed, session=<UwMH5/ZFAKU2yqFs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 11:00:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<H6JU6vZFwquLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-15 11:01:03 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:56541: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-15 11:00:14 dovecot_plain authenticator failed for (ablatta) [154.146.240.123]:58534: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-15 11:00:49 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:34238: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-15 11:00:50 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:59833: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-15 11:01:44 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:38491: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 15 11:02:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<+HBu7vZFruw+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 11:01:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<uMLt6/ZFfo4+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-15 11:02:19 dovecot_plain authenticator failed for (latmers) [38.248.111.238]:57117: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 15 11:02:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<L6M57/ZF8oOB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 11:02:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<48x28PZFNPMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 11:04:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<b01J9fZFnrKG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.189
country_id: 1694008
description:
2025-12-15 11:03:14 dovecot_login authenticator failed for (ADMIN) [188.214.125.189]:16326: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 11:03:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<SDaH8vZFesmYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 11:03:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<yRjo8vZFlOg+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 11:03:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<bJ/N8vZFRrSPbvgo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 11:03:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ohGw8/ZFJMY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 11:03:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<4+hn9PZFXK4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 11:04:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<u4g89/ZFAtkvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 11:04:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<D6CL+PZFySJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 11:05:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<+/Y2+fZFpKkuZXpm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 11:06:02 host2 sshd[3926720]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.76
country_id: 660013
description:
2025-12-15 11:06:31 dovecot_login authenticator failed for (ADMIN) [188.126.89.76]:57407: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-15 11:06:42 dovecot_plain authenticator failed for (boatae) [94.201.22.158]:45525: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 11:07:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<ZnI0AvdFWKkv+44t>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.241
country_id: 6252001
description:
Dec 15 11:10:17 host2 pure-ftpd[3930285]: (?@205.210.31.241) [INFO] New connection from 205.210.31.241


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 11:10:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<AZjeC/dFbt8ro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-12-15 11:11:25 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:51616: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 11:11:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nhRUEPdFZoqPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-15 11:11:42 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:55370: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 11:11:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<9QiiEfdF9jUvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.153.41.210
country_id: 6252001
description:
Dec 15 11:14:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.153.41.210, lip=66.85.158.92, TLS: Connection closed, session=<QYR4G/dFRN82mSnS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 11:15:59 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:35082: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 11:16:06 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:53536: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-15 11:18:55 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (sphalds) [73.137.7.97]:51378: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 11:20:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<NzXuMPdFOoaPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.92
country_id: 130758
description:
2025-12-15 11:22:14 dovecot_plain authenticator failed for (localhost) [62.60.135.92]:34036: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.203
country_id: 3077311
description:
2025-12-15 11:22:22 dovecot_login authenticator failed for (ADMIN) [212.102.39.203]:5463: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 15 11:23:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<spkpPPdFxJM+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-15 11:24:00 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (mantitrius) [73.196.144.25]:34708: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-15 11:23:16 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:57348: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-15 11:23:29 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:38192: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 11:24:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<3evlPfdFPNBnsX0d>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.166.19
country_id: 2921044
description:
[2025-12-15 11:24:25 +0530] info [webmaild] 217.154.166.19 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 11:25:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<F21vQfdFoqqnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.50
country_id: 660013
description:
2025-12-15 11:27:55 dovecot_login authenticator failed for (ADMIN) [188.126.89.50]:54917: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 11:27:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<o/W9SPdFQsg+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 15 11:27:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<q70MSvdFrsA+PIdd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 11:29:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<dataesitelk@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<p/epUPdFCMgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-15 11:29:59 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:33513: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-15 11:30:34 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:53437: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 11:31:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<FYzaVvdFoOcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 11:31:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<NRxUWPdFrI0+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 11:31:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<2qiZWPdFKrmhI2jD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 15 11:32:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<N0OcWvdFvII+PIdb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 11:32:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<4ga8W/dFnjSuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-15 11:33:59 dovecot_plain authenticator failed for (tacaling) [102.53.15.18]:58725: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 11:34:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<qyjHYfdFCOs+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 11:34:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<tdHmYPdFEscIiWqS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-15 11:36:36 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (lookayte) [98.204.134.124]:40754: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 11:38:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<L7ntbvdFaOY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 15 11:38:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<X5hQcPdFONg+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 11:39:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<0rkVdfdF/qU+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 11:41:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<ILF1evdF5L5S38qm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 11:43:40 host2 sshd[3958695]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 15 11:43:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<kLi2gfdFsLI+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-15 11:43:33 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (amnotes) [73.197.194.98]:39454: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 11:43:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<+dERgfdFvounrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 11:43:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<laZBgfdFquqWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-15 11:45:06 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (undledrosm) [37.150.8.174]:45698: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-15 11:44:14 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:54287: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Dec 15 11:44:29 host2 sshd[3959417]: Disconnected from invalid user user 69.74.29.21 port 62101 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-15 11:44:43 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:54341: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 11:44:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<lnTEh/dF5uY+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 15 11:45:29 host2 sshd[3960580]: Disconnected from invalid user email 199.195.248.191 port 48602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 15 11:45:55 host2 sshd[3960851]: Disconnected from invalid user weblogic 202.157.177.33 port 49036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 11:45:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (praggly) [87.103.126.54]:41773: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 11:46:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<qSQRjvdFOtk+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 11:46:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<nx2XjvdFuuunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 11:46:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<9OwIjPdFUIU+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.66
country_id: 2077456
description:
2025-12-15 11:46:17 dovecot_login authenticator failed for (ADMIN) [154.16.81.66]:24280: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.22
country_id: 2562770
description:
2025-12-15 11:46:23 dovecot_login authenticator failed for (ADMIN) [176.125.230.22]:32916: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.74.29.21
country_id: 6252001
description:
Dec 15 11:47:07 host2 sshd[3961970]: Disconnected from invalid user auditor 69.74.29.21 port 34972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 15 11:47:22 host2 sshd[3962162]: Disconnected from invalid user download 199.195.248.191 port 58306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 15 11:48:05 host2 sshd[3962761]: Disconnected from invalid user wanda 177.44.220.67 port 55642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 15 11:48:34 host2 sshd[3963537]: Disconnected from invalid user git2 199.195.248.191 port 55002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 11:48:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<zkETlfdFppo+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 15 11:48:49 host2 sshd[3963756]: Disconnected from invalid user user1 93.71.118.99 port 39314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 15 11:48:54 host2 sshd[3963806]: Disconnected from invalid user student2 68.183.236.1 port 47480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 11:49:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<E2lxlvdFqMA+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Dec 15 11:48:32 host2 sshd[3963486]: Disconnected from invalid user rob 69.74.29.21 port 54048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 15 11:49:08 host2 sshd[3963986]: Disconnected from invalid user mike 199.195.248.191 port 39234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Dec 15 11:49:14 host2 sshd[3964083]: Disconnected from invalid user player 69.74.29.21 port 48636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 15 11:49:53 host2 sshd[3964590]: Disconnected from invalid user admin 68.183.236.1 port 57908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 15 11:49:58 host2 sshd[3964640]: Disconnected from invalid user vpnuser 202.157.177.33 port 33558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 11:50:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<bMEZnPdFCpikXF7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 15 11:50:40 host2 sshd[3965407]: Disconnected from invalid user worker 68.183.236.1 port 38366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 15 11:50:16 host2 sshd[3965081]: Disconnected from invalid user royal 177.44.220.67 port 32830 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 11:50:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<6q42m/dFRL8+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 15 11:51:50 host2 sshd[3966582]: Disconnected from invalid user worker 181.188.176.247 port 52464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Dec 15 11:52:43 host2 sshd[3967367]: Disconnected from invalid user jenkins 101.36.126.138 port 46224 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.212
country_id: 6252001
description:
Dec 15 11:52:19 host2 pure-ftpd[3967031]: (?@198.235.24.212) [INFO] New connection from 198.235.24.212


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 15 11:53:09 host2 sshd[3967823]: Disconnected from invalid user git2 177.44.220.67 port 57778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Dec 15 11:53:21 host2 sshd[3968101]: Disconnected from invalid user weblogic 101.36.126.138 port 42170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 15 11:53:38 host2 sshd[3968494]: Disconnected from invalid user laravel 93.71.118.99 port 44952 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 15 11:53:52 host2 sshd[3968677]: Disconnected from invalid user edubook 181.188.176.247 port 44732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 15 11:54:32 host2 sshd[3969563]: Disconnected from invalid user admin 181.188.176.247 port 53814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Dec 15 11:54:40 host2 sshd[3969720]: Disconnected from invalid user test 101.36.126.138 port 33842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-15 11:54:44 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:47676: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 15 11:55:21 host2 sshd[3970579]: Disconnected from invalid user guest 177.44.220.67 port 57154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Dec 15 11:55:53 host2 sshd[3970996]: Disconnected from invalid user zhangc 101.36.126.138 port 51304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 15 11:55:56 host2 sshd[3971046]: Disconnected from invalid user tom 181.188.176.247 port 54338 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 11:56:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<oGFfsvdFDraLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Dec 15 11:56:19 host2 sshd[3971583]: Disconnected from invalid user ftpuser 98.159.109.235 port 47022 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-12-15 11:56:25 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:47173: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-15 11:56:43 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:33222: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 15 11:57:17 host2 sshd[3972336]: Disconnected from invalid user login 93.71.118.99 port 38668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Dec 15 11:57:29 host2 sshd[3972481]: Disconnected from invalid user zhangm 98.159.109.235 port 34246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 11:57:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<Rm0ptvdFGMO8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 11:57:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<gtpHtvdFuq+B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 11:58:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<niOHuPdFVN6l6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.159.109.235
country_id: 6252001
description:
Dec 15 11:58:41 host2 sshd[3973412]: Disconnected from invalid user user4 98.159.109.235 port 38360 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 15 11:59:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<l9S/uvdFtuc+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 11:59:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<U+ixu/dFIthnhdZ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 11:59:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<dRo7vPdFqqc+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-15 11:59:48 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:55206: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-15 12:00:13 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:35747: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 12:00:19 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:42890: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.21
country_id: 6252001
description:
2025-12-15 12:01:28 dovecot_login authenticator failed for (ADMIN) [95.181.238.21]:56796: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 15 12:01:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<lteHw/dFAOg+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 12:02:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=</2QiyPdF5rpnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 12:05:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sobaherbalcom@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<QDrWz/dFvmAvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 12:05:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<enyr0PdFZusu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-15 12:06:50 dovecot_plain authenticator failed for (biumismena) [187.161.198.68]:57480: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.154.227.99
country_id: 3469034
description:
Dec 15 12:07:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=177.154.227.99, lip=66.85.158.91, TLS, session=<XMzc1fdFz+SxmuNj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.13
country_id: 3469034
description:
Dec 15 12:07:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.71.13, lip=66.85.158.91, TLS, session=<upIO1/dFMrWxLEcN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 15 12:07:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<qdVm2fdF6K8+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 12:09:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Iosl4fdFQp4+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 12:10:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<EKXn4fdF4IA+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 12:10:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<essenceceylonteacom@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<e+By4/dF1AsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 12:10:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<QR8N5PdFVOM+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 12:10:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=</5N/5PdF2KM+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 12:11:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<YAvl5PdFTuc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-15 12:11:07 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (roffert) [73.168.136.150]:48568: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.44
country_id: 130758
description:
2025-12-15 12:12:42 dovecot_plain authenticator failed for (localhost) [62.60.135.44]:38684: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.41
country_id: 130758
description:
2025-12-15 12:12:46 dovecot_plain authenticator failed for (localhost) [62.60.131.41]:58304: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.67.42.25
country_id: 6252001
description:
Dec 15 12:12:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=54.67.42.25, lip=66.85.158.92, TLS: Connection closed, session=<AXgk6/dF0p02QyoZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 12:12:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<g3pd6vdFXBto7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-15 12:14:22 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:52150: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-12-15 12:14:53 dovecot_login authenticator failed for ([149.54.33.130]) [149.54.33.130]:53007: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.179
country_id: 2186224
description:
2025-12-15 12:14:18 dovecot_login authenticator failed for (ADMIN) [179.61.240.179]:63707: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-15 12:15:42 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (nonatheds) [98.203.34.136]:39494: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.3.25
country_id: 2750405
description:
2025-12-15 12:17:19 dovecot_login authenticator failed for (ADMIN) [158.173.3.25]:52267: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.247.54
country_id: 1605651
description:
Dec 15 12:17:49 host2 pure-ftpd[3993936]: (?@152.32.247.54) [INFO] New connection from 152.32.247.54


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 12:17:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=</6aI/fdFKtYuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-15 12:18:00 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:41708: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-15 12:18:20 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:46112: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 12:18:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<ZhjlAPhFeI6YNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-15 12:19:04 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:52965: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 12:19:47 host2 sshd[3995760]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 12:19:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<uoXoAvhFlMQvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 12:19:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<UtqLAvhFaJaLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.39.87.7
country_id: 6251999
description:
2025-12-15 12:19:24 dovecot_login authenticator failed for d72-39-87-7.home1.cgocable.net [72.39.87.7]:48040: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 12:20:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<w3szCPhFCjwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 12:20:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<tYDjBvhFBtCPbvgo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.8
country_id: 798549
description:
Dec 15 12:20:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.8, lip=66.85.158.92, session=<ccJ8B/hFsdFV2YwI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 12:21:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<1qULCfhFAJwIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-15 12:21:14 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:50048: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.121
country_id: 3865483
description:
Dec 15 12:21:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.251.121, lip=66.85.158.91, TLS, session=<A3QkCfhFY+uzAPt5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.79.19.9
country_id: 953987
description:
Dec 15 12:21:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=41.79.19.9, lip=66.85.158.91, TLS, session=<jAZxCvhFLY4pTxMJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 12:22:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<ErUCD/hFJqyG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 12:23:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<bAXKD/hF7s0v+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 12:23:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<uDXFEPhFlzdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 15 12:23:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<PHisEfhFVoU+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 12:25:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<Q9w+GfhFZoIro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 12:25:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<kiriaswanucom@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<aujHGfhFqp4vWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-15 12:26:09 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:37038: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.29
country_id: 6252001
description:
2025-12-15 12:26:19 dovecot_login authenticator failed for ([98.181.46.29]) [98.181.46.29]:51391: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.248.167.131
country_id: 2750405
description:
Dec 15 12:28:25 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=89.248.167.131, lip=66.85.158.91, session=<m/A3I/hFcuZZ+KeD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 12:29:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<H8q+JvhFMuKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 15 12:29:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<aOR5KPhFmJQ+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 12:31:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<h+67LfhFuLQ+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.22
country_id: 2562770
description:
2025-12-15 12:31:17 dovecot_login authenticator failed for (ADMIN) [176.125.230.22]:60563: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.41
country_id: 2264397
description:
2025-12-15 12:34:10 dovecot_login authenticator failed for (ADMIN) [146.70.59.41]:37417: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 12:34:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<UmyzOPhFcr8+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.125.13.12
country_id: 6252001
description:
2025-12-15 12:37:27 dovecot_login authenticator failed for (172-125-13-12.lightspeed.rcsntx.sbcglobal.net) [172.125.13.12]:44837: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-12-15 12:37:37 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:50093: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 12:38:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<PuJpR/hFMKiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 12:40:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<STe5TvhFFOFnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 12:41:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EbAHUvhFgo2nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-15 12:42:36 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (obbla) [78.68.37.25]:56767: 535 Incorrect authentication data (set_id=hr@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-15 12:42:46 dovecot_plain authenticator failed for (karampor) [12.150.243.22]:13766: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-15 12:45:25 dovecot_plain authenticator failed for (pingorks) [91.73.188.251]:51088: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 12:45:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Qav5X/hFasAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 12:45:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<IjdXYPhFoImhI2jD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-12-15 12:45:41 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:37215: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-15 12:46:08 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:41456: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.5
country_id: 1227603
description:
2025-12-15 12:47:22 dovecot_login authenticator failed for (ADMIN) [95.181.239.5]:37469: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 12:47:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<hNT6ZvhFwNIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 12:48:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<wfkHavhFrrGuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-15 12:48:28 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:50233: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-15 12:48:45 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:36286: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-15 12:49:35 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (hisors) [24.23.125.83]:34534: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-15 12:49:37 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (hoctrate) [98.193.112.85]:42768: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.85.209.7
country_id: 798544
description:
Dec 15 12:50:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.85.209.7, lip=66.85.158.91, TLS, session=<Li6icvhFssQtVdEH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 12:50:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<izvBcfhFFLU+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.32.111.202
country_id: 3865483
description:
Dec 15 12:51:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=200.32.111.202, lip=66.85.158.91, TLS, session=<qkrJc/hFpLnIIG/K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.211.219.73
country_id: 3175395
description:
2025-12-15 12:51:19 dovecot_login authenticator failed for host-62-211-219-73.pool62211.interbusiness.it ([185.196.221.176]) [62.211.219.73]:58024: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-15 12:52:01 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:48088: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 12:53:03 host2 sshd[4023593]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.168
country_id: 2635167
description:
Dec 15 12:52:12 host2 pure-ftpd[4022920]: (?@87.236.176.168) [INFO] New connection from 87.236.176.168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-15 12:52:17 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:40334: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.0
country_id: 798549
description:
Dec 15 12:53:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.0, lip=66.85.158.91, session=<g5U9e/hFh8ZV2YwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-15 12:53:11 dovecot_login authenticator failed for ([186.238.157.140]) [187.9.247.58]:54742: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-15 12:53:24 dovecot_login authenticator failed for ([84.211.24.143]) [84.211.24.143]:38785: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 12:53:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<jiomffhFJtVS38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.181
country_id: 2960313
description:
2025-12-15 12:54:09 dovecot_login authenticator failed for (ADMIN) [37.46.113.181]:31009: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-15 12:55:29 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:35954: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-15 12:56:13 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:56368: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 12:56:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<HRVBiPhFoOWWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.54
country_id: 1269750
description:
Dec 15 12:57:13 host2 sshd[4028144]: Disconnected from invalid user james 45.118.106.54 port 57972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-15 12:58:33 dovecot_plain authenticator failed for (elving) [90.160.139.163]:59862: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 12:58:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<fW+zj/hFWOcIiWqS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.54
country_id: 1269750
description:
Dec 15 12:58:50 host2 sshd[4029572]: Disconnected from invalid user farhan 45.118.106.54 port 41223 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.118.106.54
country_id: 1269750
description:
Dec 15 12:59:38 host2 sshd[4030417]: Disconnected from invalid user zk 45.118.106.54 port 48414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 12:59:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<5NKLk/hFmO0+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 12:59:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<rsGgkfhFsMGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.133
country_id: 3865483
description:
Dec 15 13:00:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=45.238.106.133, lip=66.85.158.91, TLS, session=<3kU0lfhFi6ct7mqF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.4.79
country_id: 2300660
description:
Dec 15 13:00:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.139.4.79, lip=66.85.158.91, TLS, session=</rS+k/hF/MgpiwRP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.196.34
country_id: 3865483
description:
Dec 15 13:00:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=186.96.196.34, lip=66.85.158.91, TLS, session=<+LDBk/hFmoC6YMQi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.80.113
country_id: 2328926
description:
Dec 15 13:00:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.76.80.113, lip=66.85.158.91, TLS, session=<r3m4k/hF3aopTFBx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.50
country_id: 226074
description:
Dec 15 13:00:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=196.0.87.50, lip=66.85.158.91, TLS, session=<TnDBk/hFrYvEAFcy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.38
country_id: 3865483
description:
Dec 15 13:00:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=179.0.249.38, lip=66.85.158.91, TLS, session=<N6zvlPhFUbCzAPkm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.219.31
country_id: 3865483
description:
Dec 15 13:00:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=186.1.219.31, lip=66.85.158.91, TLS, session=<gRQOlfhFe9O6Adsf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.100
country_id: 3865483
description:
Dec 15 13:00:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers>, method=PLAIN, rip=190.181.90.100, lip=66.85.158.91, TLS, session=<th0QlfhF18u+tVpk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:01:45 host2 sshd[4032530]: Disconnected from invalid user no-reply 152.32.171.99 port 37328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.54
country_id: 1269750
description:
Dec 15 13:01:08 host2 sshd[4031983]: Disconnected from invalid user web1 45.118.106.54 port 34566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.30
country_id: 130758
description:
2025-12-15 13:01:12 dovecot_plain authenticator failed for (localhost) [62.60.135.30]:37710: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 15 13:03:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<qF56ofhFgLQ+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 13:03:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<bDjhofhFMkynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.95
country_id: 130758
description:
2025-12-15 13:04:39 dovecot_plain authenticator failed for (localhost) [62.60.135.95]:35788: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.108
country_id: 130758
description:
2025-12-15 13:05:01 dovecot_plain authenticator failed for (localhost) [62.60.135.108]:45652: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 13:05:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Ne/xpfhFDI+kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:04:10 host2 sshd[4035290]: Disconnected from invalid user sherry 152.32.171.99 port 37452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.108
country_id: 130758
description:
2025-12-15 13:05:08 dovecot_plain authenticator failed for (localhost) [62.60.135.108]:54748: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 13:06:56 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:59674: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.22
country_id: 6290252
description:
2025-12-15 13:07:00 dovecot_login authenticator failed for (ADMIN) [37.46.115.22]:41814: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-15 13:07:07 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (forrily) [68.40.189.43]:38992: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:07:59 host2 sshd[4039461]: Disconnected from invalid user rundeck 152.32.171.99 port 38346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:09:13 host2 sshd[4040596]: Disconnected from invalid user zl 152.32.171.99 port 47516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:10:30 host2 sshd[4041890]: Disconnected from invalid user ubuntu 152.32.171.99 port 47248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 13:12:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<KN1Lv/hFrtC8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-15 13:11:24 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:55616: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 13:13:26 host2 sshd[4044993]: Disconnected from invalid user username 62.60.131.157 port 9236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 13:14:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<cAUbyPhFIq6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 13:15:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<+om3yvhFLJ6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 13:15:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ZnFly/hFypeLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 13:15:49 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:49736: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.131
country_id: 3041565
description:
2025-12-15 13:16:33 dovecot_login authenticator failed for (ADMIN) [173.239.217.131]:60278: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 13:16:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<cRNez/hF4OhnhdZ/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-15 13:18:07 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:35347: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-15 13:18:07 dovecot_login authenticator failed for ([93.121.175.220]) [93.121.175.220]:41282: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 13:18:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<N6+y1/hFxNQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 13:18:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Kjr+1PhF+Lc+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-15 13:18:17 dovecot_login authenticator failed for ([172.82.64.201]) [172.82.64.201]:33214: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-15 13:18:20 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:50024: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 13:21:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<kTSK4fhF5tI+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.22
country_id: 2589581
description:
2025-12-15 13:22:51 dovecot_login authenticator failed for (ADMIN) [176.125.228.22]:2320: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-15 13:23:27 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:61702: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-15 13:23:13 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1180: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-15 13:28:58 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (echemenuat) [217.215.74.195]:36607: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 15 13:30:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<8nDl//hFDK4+PIdh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-15 13:31:12 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:44660: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.9
country_id: 1861060
description:
2025-12-15 13:31:27 dovecot_login authenticator failed for p160010-obmd01.osaka.ocn.ne.jp [61.112.103.9]:41323: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.229
country_id: 1733045
description:
2025-12-15 13:33:47 dovecot_login authenticator failed for ([49.124.152.229]) [49.124.152.229]:36994: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 15 13:33:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<260HDflF8sM+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.19
country_id: 146669
description:
2025-12-15 13:34:02 dovecot_login authenticator failed for (ADMIN) [185.253.162.19]:5156: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-15 13:34:13 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:49052: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 13:34:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<VVkiEflFcug+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.106.153
country_id: 6252001
description:
2025-12-15 13:37:49 dovecot_login authenticator failed for (ADMIN) [191.96.106.153]:35362: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-15 13:40:43 dovecot_plain authenticator failed for (localhost) [46.101.122.102]:44498: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 13:42:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<0ALgKvlFEOw+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 13:42:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<yhBdLPlFEIE+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 13:46:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<OJqjOPlFgrM+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 13:47:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<hQFyPPlFOO4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 15 13:48:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<OwvXQvlFAok+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.190
country_id: 798544
description:
Dec 15 13:51:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=85.202.108.190, lip=66.85.158.91, TLS, session=<dNPSSflFENxVymy+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-15 13:51:20 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57155: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.136
country_id: 3469034
description:
Dec 15 13:51:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=187.120.72.136, lip=66.85.158.91, TLS, session=<TbvySvlFHpi7eEiI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-15 13:51:55 dovecot_plain authenticator failed for (apsyrles) [102.53.15.17]:40027: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.143.253.230
country_id: 6252001
description:
2025-12-15 13:52:18 dovecot_plain authenticator failed for c-76-143-253-230.hsd1.tx.comcast.net (gerosiess) [76.143.253.230]:54000: 535 Incorrect authentication data (set_id=hr@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-15 13:53:56 dovecot_plain authenticator failed for (caphides) [105.72.176.66]:59158: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 13:54:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (subescoces) [87.103.126.54]:33063: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.84
country_id: 6252001
description:
Dec 15 13:54:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.84, lip=66.85.158.92, TLS, session=<RHeaWPlFUuHN0h9U>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-15 13:56:02 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:36616: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.21
country_id: 2993457
description:
2025-12-15 13:55:23 dovecot_login authenticator failed for (ADMIN) [95.181.233.21]:45707: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-15 13:55:30 dovecot_plain authenticator failed for (localhost) [43.163.105.233]:59864: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.150
country_id: 1562822
description:
2025-12-15 13:55:53 dovecot_login authenticator failed for (ADMIN) [173.239.247.150]:33888: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.184.56
country_id: 2921044
description:
Dec 15 13:56:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.197.184.56, lip=66.85.158.91, session=<K8TGX/lFJw+Kxbg4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.115.97
country_id: 2921044
description:
Dec 15 13:56:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.115.97, lip=66.85.158.91, session=<a5vcX/lFZO8uZXNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-15 13:56:17 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:60572: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-15 13:58:06 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:36767: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.187.91
country_id: 1643084
description:
2025-12-15 13:58:27 dovecot_plain authenticator failed for mail.mahati.id (localhost) [103.182.187.91]:45224: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-12-15 13:58:34 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:39423: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 15 13:59:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<9oWJavlFHOHCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-15 14:01:17 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:34276: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-15 14:03:13 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:56391: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-15 14:03:35 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:63633: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 14:03:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Twmad/lFDLc+PIMp>


