# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-11 22:32:16 dovecot_login authenticator failed for (cm-178.232.237.107.get.no) [178.232.237.107]:40650: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 11 22:32:41 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<N/27HLBFgD9niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-11 22:32:56 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:51050: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-12-11 22:33:08 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:33522: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 11 22:34:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<eh9hJLBFuJFnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-11 22:35:11 dovecot_plain authenticator failed for (zooffs) [65.20.148.194]:48992: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.37.124.182
country_id: 3175395
description:
Dec 11 22:36:15 host2 sshd[3943196]: Disconnected from invalid user bob 151.37.124.182 port 8788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 11 22:37:57 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<8deTL7BFELGkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.41.134
country_id: 226074
description:
2025-12-11 22:38:32 dovecot_login authenticator failed for ([196.0.41.134]) [196.0.41.134]:46267: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.171
country_id: 3865483
description:
Dec 11 22:38:42 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.122.128.171, lip=66.85.158.91, TLS, session=<0gETMbBFKdO+eoCr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-11 22:38:45 dovecot_login authenticator failed for ([84.215.110.96]) [84.215.110.96]:44757: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.163
country_id: 3469034
description:
Dec 11 22:39:07 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts>, method=PLAIN, rip=186.209.251.163, lip=66.85.158.91, TLS, session=<0jWPMrBFQKS60fuj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.110.243
country_id: 3175395
description:
Dec 11 22:39:31 host2 sshd[3945764]: Disconnected from invalid user miguel 151.19.110.243 port 58839 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.110.243
country_id: 3175395
description:
Dec 11 22:40:21 host2 sshd[3946686]: Disconnected from invalid user tecmint 151.19.110.243 port 58055 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.19.110.243
country_id: 3175395
description:
Dec 11 22:41:55 host2 sshd[3947866]: Disconnected from invalid user acs 151.19.110.243 port 58339 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-11 22:42:35 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:44153: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-12-11 22:42:51 dovecot_login authenticator failed for ([125.23.202.194]) [125.23.202.194]:44016: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.249
country_id: 6252001
description:
Dec 11 22:42:59 host2 pure-ftpd[3948605]: (?@205.210.31.249) [INFO] New connection from 205.210.31.249


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 8.221.141.145
country_id: 1861060
description:
Dec 11 22:43:51 host2 pure-ftpd[3949385]: (?@8.221.141.145) [INFO] New connection from 8.221.141.145


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 11 22:45:31 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<wIehSrBFXIxnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.74.181.240
country_id: 130758
description:
Dec 11 22:46:35 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=94.74.181.240, lip=66.85.158.91, TLS, session=<5J18TbBFGtheSrXw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-11 22:46:52 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:6112: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.184.227.33
country_id: 3865483
description:
Dec 11 22:46:15 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.184.227.33, lip=66.85.158.91, TLS, session=<Y/IkTLBF36W+uOMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-11 22:46:23 dovecot_login authenticator failed for (201.172.89.74-clientes-izzi.mx) [201.172.89.74]:57428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.110.243
country_id: 3175395
description:
Dec 11 22:46:32 host2 sshd[3951823]: Disconnected from invalid user advance 151.19.110.243 port 58581 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 11 22:47:19 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ulEWUbBF+sLD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.110.243
country_id: 3175395
description:
Dec 11 22:47:29 host2 sshd[3952502]: Disconnected from invalid user minecraft 151.19.110.243 port 58879 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 11 22:48:10 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<eFIcVLBFSII+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-11 22:49:07 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:37000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 11 22:49:06 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<gmJ7V7BF8NEv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 11 22:49:23 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<SDGAWLBFxJw+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 11 22:49:26 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<tCSwWLBFesUzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.111.152.79
country_id: 798544
description:
2025-12-11 22:49:39 dovecot_login authenticator failed for ([176.111.152.79]) [176.111.152.79]:57748: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.213.8
country_id: 192950
description:
Dec 11 22:50:55 host2 sshd[3954605]: Disconnected from invalid user zxg 41.203.213.8 port 56612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Dec 11 22:52:06 host2 sshd[3955495]: Disconnected from invalid user teamtalk 51.222.206.109 port 56288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-11 22:52:10 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:63254: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-11 22:51:37 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:54984: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 11 22:51:43 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<f9rUYLBFOuYv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-11 22:51:57 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:52004: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-11 22:52:47 dovecot_login authenticator failed for h225.17.21.98.static.ip.windstream.net [98.21.17.225]:43452: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 11 22:52:23 host2 sshd[3955681]: Disconnected from invalid user zxg 190.244.23.211 port 60830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-11 22:52:28 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:47478: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-11 22:52:35 dovecot_login authenticator failed for (189.219.138.45-clientes-izzi.mx) [189.219.138.45]:54672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 22:53:28 host2 sshd[3956246]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.41.9.210
country_id: 6252001
description:
Dec 11 22:54:36 host2 sshd[3957662]: Disconnected from invalid user taibabi 63.41.9.210 port 53714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2025-12-11 22:57:27 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:58677: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 11 22:57:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<cpikdrBF3OBnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-11 22:57:51 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:35316: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-11 22:58:05 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (datho) [73.145.107.251]:46158: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Dec 11 22:58:13 host2 sshd[3960464]: Disconnected from invalid user zxg 51.222.206.109 port 42856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.212.36.230
country_id: 1605651
description:
Dec 11 22:57:39 host2 sshd[3960093]: Disconnected from invalid user ubuntu 103.212.36.230 port 51384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 63.41.9.210
country_id: 6252001
description:
Dec 11 22:57:50 host2 sshd[3960142]: Disconnected from invalid user ma 63.41.9.210 port 37389 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 11 22:58:08 host2 sshd[3960411]: Disconnected from invalid user manager 154.209.4.183 port 37052 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-11 22:59:10 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:44754: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 11 22:59:02 host2 sshd[3961126]: Disconnected from invalid user postgres 154.209.4.183 port 53724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 11 22:59:22 host2 sshd[3961327]: Disconnected from invalid user vhserver 172.245.208.136 port 52744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-11 22:59:39 dovecot_login authenticator failed for (D35ppifd) [69.5.189.21]:51264: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.206.109
country_id: 6251999
description:
Dec 11 22:59:45 host2 sshd[3961534]: Disconnected from invalid user ubuntu 51.222.206.109 port 43152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.212.36.230
country_id: 1605651
description:
Dec 11 22:59:48 host2 sshd[3961559]: Disconnected from invalid user zxg 103.212.36.230 port 59816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 11 22:59:53 host2 sshd[3961595]: Disconnected from invalid user user2 154.209.4.183 port 60288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.213.8
country_id: 192950
description:
Dec 11 23:00:14 host2 sshd[3962071]: Disconnected from invalid user milan 41.203.213.8 port 60680 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-11 23:00:26 dovecot_login authenticator failed for (a98fDRp) [69.5.189.21]:61803: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 11 23:00:41 host2 sshd[3962488]: Disconnected from invalid user adrian 154.209.4.183 port 38138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 23:00:57 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<+TvTgbBFBMAro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 11 23:01:13 host2 sshd[3963045]: Disconnected from invalid user exam 172.245.208.136 port 44580 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 23:01:34 host2 sshd[3963488]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-11 23:01:34 dovecot_login authenticator failed for (w9ASD1pV) [69.5.189.21]:60884: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.212.36.230
country_id: 1605651
description:
Dec 11 23:01:50 host2 sshd[3963706]: Disconnected from invalid user teamtalk 103.212.36.230 port 43228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 11 23:01:31 host2 sshd[3963284]: Disconnected from invalid user yoyo 154.209.4.183 port 56094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 11 23:02:51 host2 sshd[3964380]: Disconnected from invalid user ubuntu 190.244.23.211 port 32950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 11 23:04:39 host2 sshd[3966269]: Disconnected from invalid user pankaj 190.244.23.211 port 55716 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Dec 11 23:04:45 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.132, lip=66.85.158.91, TLS: Connection closed, session=<FaGYj7BFdBdAPpyE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 11 23:04:32 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<f7ykjrBFztc+PIcc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.140
country_id: 6252001
description:
Dec 11 23:04:33 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.140, lip=66.85.158.91, session=<eMXYjrBF9/5APpyM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 11 23:05:21 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<xeSRkbBFXNEv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-11 23:08:03 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:33789: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.84
country_id: 1733045
description:
2025-12-11 23:08:27 dovecot_login authenticator failed for ([49.125.201.84]) [49.125.201.84]:54124: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 11 23:09:08 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<n3odn7BFCpql6LP6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 23:09:55 host2 sshd[3970226]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-11 23:09:20 dovecot_plain authenticator failed for (subus) [65.20.149.93]:35604: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 11 23:09:47 host2 sshd[3970085]: Disconnected from invalid user nikhil 190.244.23.211 port 41830 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 11 23:10:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<sBwfpbBFLMeG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 11 23:11:31 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<+g+qp7BFaJcvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-11 23:17:47 dovecot_login authenticator failed for (128.102.88.80.sta.ac-net.se) [80.88.102.128]:43584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-11 23:17:30 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:35840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-11 23:17:42 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:59319: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-12-11 23:18:14 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:42106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.228.38
country_id: 6252001
description:
Dec 11 23:18:28 host2 pure-ftpd[3977857]: (?@172.236.228.38) [INFO] New connection from 172.236.228.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.71
country_id: 3996063
description:
2025-12-11 23:18:32 dovecot_login authenticator failed for (201.172.89.71-clientes-izzi.mx) [201.172.89.71]:58748: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec 11 23:18:42 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<pw1SwbBFgpwrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 11 23:19:42 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<61LwxLBFQNs+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-12-11 23:19:13 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:41265: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 11 23:22:35 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<DE4yz7BFtKm8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 11 23:23:36 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<zGrZ0rBFRsZnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 11 23:23:36 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<5Irf0rBFhLw+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-12-11 23:23:40 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:57916: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-11 23:24:24 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (pornic) [98.222.93.199]:59080: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.127.166
country_id: 1269750
description:
2025-12-11 23:24:09 dovecot_login authenticator failed for (abts-mp-static-166.127.168.122.airtelbroadband.in) [122.168.127.166]:48010: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-11 23:24:13 dovecot_login authenticator failed for (cm-178.232.153.184.get.no) [178.232.153.184]:47384: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-11 23:25:05 dovecot_login authenticator failed for ([84.210.151.158]) [84.210.151.158]:39893: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 23:25:34 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<MrTm2bBFKKw+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 11 23:26:41 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<CQrm3bBFMLw+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-11 23:28:41 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (cousel) [68.46.148.180]:46326: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 11 23:30:39 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<5oMO7LBFQt0vT+mI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-11 23:30:53 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:35862: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.208.55
country_id: 6252001
description:
2025-12-11 23:31:01 dovecot_login authenticator failed for ([216.21.208.55]) [216.21.208.55]:50429: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 11 23:31:35 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Yxxt77BFGuE+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 23:32:13 host2 sshd[3987410]: Disconnected from invalid user user 2.57.121.25 port 6045 [preauth]


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 11 23:33:51 host2 dovecot[3988689]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-12-11 23:33:36 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:45800: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-11 23:33:50 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:54775: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 23:34:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dKox+rBFOu0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 11 23:36:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<CzMpALFFMOtnsX0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-11 23:37:37 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (sunters) [73.13.220.220]:34330: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-11 23:37:39 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:46854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-11 23:37:23 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:43663: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-11 23:38:50 dovecot_plain authenticator failed for (dialtid) [5.76.44.40]:41184: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.16
country_id: 3996063
description:
2025-12-11 23:38:54 dovecot_login authenticator failed for (201.166.222.16-clientes-izzi.mx) [201.166.222.16]:41579: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.132.164.17
country_id: 2635167
description:
Dec 11 23:38:24 host2 sshd[3991922]: Disconnected from invalid user pi 23.132.164.17 port 46498 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 11 23:39:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<dTWTC7FF/sk+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 23:39:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<lJOFDLFFuOE+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2025-12-11 23:39:48 dovecot_login authenticator failed for ([125.19.164.187]) [125.19.162.102]:47484: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 11 23:40:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Ov6zD7FF8s1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 11 23:41:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<uyS/EbFFKrc+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Dec 11 23:41:36 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.91, session=<l7VVE7FFMD5BMRRD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-11 23:41:01 dovecot_plain authenticator failed for (enonicis) [41.248.243.181]:54220: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 11 23:41:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<h0xJFLFFxp4I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 23:41:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<aCGOFLFFDNUv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Dec 11 23:42:02 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.91, session=<K2PpFLFFhm5BMRRD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-11 23:42:21 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:47102: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-11 23:42:43 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:60827: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-11 23:43:39 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:35669: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-11 23:42:55 dovecot_login authenticator failed for ([125.20.154.97]) [182.95.178.206]:42656: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-12-11 23:43:09 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:57798: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.43.207
country_id: 3144096
description:
2025-12-11 23:43:27 dovecot_login authenticator failed for (cm-46.212.43.207.get.no) [46.212.43.207]:43423: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 11 23:44:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<azN4HrFFyImPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 11 23:45:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<UG8YIrFFdNI+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 23:45:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<J90pIrFFyt0ro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 11 23:46:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<z3DkJbFFwN0+PIcm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.105.61
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.105.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-12-11 23:48:25 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:52078: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 11 23:48:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<U74/LLFF4NVnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.55
country_id: 1733045
description:
2025-12-11 23:48:45 dovecot_login authenticator failed for ([49.124.153.55]) [49.124.153.55]:43142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.136.231.166
country_id: 1814991
description:
Dec 11 23:49:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=8.136.231.166, lip=66.85.158.91, session=<eoiEL7FFxskIiOem>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.232.145
country_id: 6252001
description:
Dec 11 23:51:50 host2 sshd[4002131]: Disconnected from invalid user kevin 143.198.232.145 port 36878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-11 23:52:23 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:48460: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec 11 23:52:25 host2 sshd[4002449]: Disconnected from invalid user admin 103.59.94.155 port 41298 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-11 23:52:43 dovecot_login authenticator failed for (nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:51216: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-11 23:53:09 dovecot_plain authenticator failed for (cochory) [75.97.190.237]:49812: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 23:53:23 host2 sshd[4003146]: Disconnected from invalid user admin 2.57.121.112 port 44907 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.155
country_id: 1643084
description:
Dec 11 23:53:48 host2 sshd[4003528]: Disconnected from invalid user user 103.59.94.155 port 38886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.240.57.60
country_id: 1819730
description:
Dec 11 23:54:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.240.57.60, lip=66.85.158.91, session=<zbEkQbFFYJQv8Dk8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec 11 23:54:29 host2 sshd[4004265]: Disconnected from invalid user user2 103.59.94.155 port 39396 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec 11 23:54:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<iGWGQrFFLtQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 23:53:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<NmM9P7FFEpQ+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.162.75
country_id: 241170
description:
Dec 11 23:53:59 host2 sshd[4003595]: Disconnected from invalid user ubuntu 154.198.162.75 port 42196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.232.145
country_id: 6252001
description:
Dec 11 23:54:54 host2 sshd[4004520]: Disconnected from invalid user postgres 143.198.232.145 port 44986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec 11 23:55:10 host2 sshd[4004818]: Disconnected from invalid user apple 103.59.94.155 port 45500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-11 23:56:20 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (diplorm) [73.224.171.101]:42392: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 11 23:57:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<ALt6TbFFUoI+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.162.75
country_id: 241170
description:
Dec 11 23:57:11 host2 sshd[4006241]: Disconnected from invalid user ld 154.198.162.75 port 53022 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 11 23:57:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.131.52, lip=66.85.158.91, session=<YhlgTLFFsN4+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 11 23:57:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<8J6XTLFFc0pniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.192.206.188
country_id: 798544
description:
Dec 11 23:57:43 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=91.192.206.188, lip=66.85.158.91, TLS, session=<3I75S7FF6Z5bwM68>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.252.246
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.252.246 - host2 "GET /login/?login_only=1&user=host2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.19.118.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.19.118.56 - host2phenomhostcom "GET /login/?login_only=1&user=host2phenomhostcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host2phenomhostcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.215.150.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.215.150.238 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.48.138.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 199.48.138.155 - hos "GET /login/?login_only=1&user=hos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.225.216.236
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.225.216.236 - host "GET /login/?login_only=1&user=host&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-12-11 23:58:41 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:23454: 535 Incorrect authentication data (set_id=service@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.243
country_id: 2300660
description:
Dec 11 23:58:08 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=41.139.11.243, lip=66.85.158.91, TLS, session=<kusfTbFFQOspiwvz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.14.59.85
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.14.59.85 - info "GET /login/?login_only=1&user=info&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.37.181.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.37.181.26 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.209.81.183
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.209.81.183 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-11 23:59:05 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:58530: 535 Incorrect authentication data (set_id=service)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 11 23:59:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<yWLxUbFFutY+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.162.75
country_id: 241170
description:
Dec 11 23:59:37 host2 sshd[4008755]: Disconnected from invalid user www-data 154.198.162.75 port 39960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.81.3
country_id: 1269750
description:
Dec 12 00:00:24 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=139.59.81.3, lip=66.85.158.92, TLS, session=<H9CPVrFFYqCLO1ED>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 00:00:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<fjjAVrFFzKGkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 12 00:00:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<7VrdVrFF2skvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 00:00:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<z1s1WLFFnuZnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2025-12-12 00:00:57 dovecot_login authenticator failed for ([177.236.144.20]) [177.236.144.20]:38709: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-12 00:01:07 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:38412: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Dec 12 00:01:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<3WqiWrFFGntChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-12 00:02:04 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:58434: 535 Incorrect authentication data (set_id=service@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-12-12 00:02:19 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:53040: 535 Incorrect authentication data (set_id=service)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 00:02:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<f/XeXbFFaug+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.196.209.57
country_id: 298795
description:
2025-12-12 00:05:48 dovecot_plain authenticator failed for ([89.116.164.85]) [46.196.209.57]:19364: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 12 00:05:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<wWXtabFFAsdnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 00:06:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<4hpfa7FFMq2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.196.209.57
country_id: 298795
description:
2025-12-12 00:05:55 dovecot_login authenticator failed for ([89.116.164.85]) [46.196.209.57]:19364: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.7.222
country_id: 1522867
description:
2025-12-12 00:06:02 dovecot_plain authenticator failed for ([89.116.164.85]) [45.130.7.222]:24367: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 72.14.178.148
country_id: 6252001
description:
Dec 12 00:06:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=72.14.178.148, lip=66.85.158.91, session=<PQIxa7FFzYNIDrKU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.222.253.111
country_id: 6252001
description:
2025-12-12 00:06:14 dovecot_plain authenticator failed for ([89.116.164.85]) [129.222.253.111]:41919: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-12 00:07:14 dovecot_login authenticator failed for ([125.19.175.94]) [122.184.120.98]:58454: 535 Incorrect authentication data (set_id=service@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 12 00:07:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<cxfDb7FFyJAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-12-12 00:07:36 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:59172: 535 Incorrect authentication data (set_id=service@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 00:07:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<OwA9cLFFJNrD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-12 00:07:58 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:39440: 535 Incorrect authentication data (set_id=service@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-12 00:08:09 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:35967: 535 Incorrect authentication data (set_id=service)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 00:08:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<iQP3crFFJLQ+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Dec 12 00:08:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wXn3c7FFvs24aff+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-12 00:09:53 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:61683: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 12 00:08:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<698MdbFF3KE+PIdn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Dec 12 00:08:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cIMidbFFSp24aff+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-12 00:09:31 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:58499: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-12 00:09:37 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:50560: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-12-12 00:10:04 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:41118: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-12 00:10:04 dovecot_plain authenticator failed for (ocess) [38.148.95.217]:57883: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-12 00:10:42 dovecot_plain authenticator failed for (ovelenecon) [102.88.10.10]:33546: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.199.44.32
country_id: 3996063
description:
2025-12-12 00:11:33 dovecot_plain authenticator failed for ([89.116.164.85]) [187.199.44.32]:38336: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.3.114.239
country_id: 2635167
description:
2025-12-12 00:11:45 dovecot_plain authenticator failed for shet-05-b2-v4wan-164386-cust750.vm40.cable.virginm.net ([89.116.164.85]) [82.3.114.239]:50810: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.130
country_id: 1269750
description:
2025-12-12 00:11:06 dovecot_plain authenticator failed for (unnorian) [152.52.236.130]:36406: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.245.53
country_id: 3865483
description:
2025-12-12 00:11:21 dovecot_plain authenticator failed for ([89.116.164.85]) [200.24.245.53]:35455: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 00:11:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<xtwifrFFisg+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-12 00:12:29 dovecot_login authenticator failed for ([128.185.144.1]) [182.95.226.82]:39584: 535 Incorrect authentication data (set_id=service@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 12 00:13:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<UJWyg7FFRsEv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-12 00:13:10 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:53546: 535 Incorrect authentication data (set_id=service@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-12-12 00:13:18 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:57491: 535 Incorrect authentication data (set_id=service)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-12 00:13:27 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:34318: 535 Incorrect authentication data (set_id=service)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 00:13:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<eHEJhrFFeOEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.131
country_id: 3865483
description:
Dec 12 00:14:27 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=179.0.251.131, lip=66.85.158.91, TLS, session=<+rKqh7FF2aCzAPuD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.99
country_id: 3865483
description:
Dec 12 00:14:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=179.0.252.99, lip=66.85.158.91, TLS, session=<qCtBhrFFB9azAPxj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 00:14:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<o5uUirFFXN8+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 12 00:16:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<g3pAkbFF/KU+PIdo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.136.113.72
country_id: 2264397
description:
[2025-12-12 00:16:51 +0530] info [webmaild] 193.136.113.72 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-12 00:17:16 dovecot_plain authenticator failed for (latelly) [38.248.111.238]:32923: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-12 00:17:18 dovecot_plain authenticator failed for (aming) [176.113.155.132]:40953: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.163.206.5
country_id: 3469034
description:
2025-12-12 00:17:19 dovecot_plain authenticator failed for ([89.116.164.85]) [164.163.206.5]:23620: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.244.109
country_id: 1733045
description:
2025-12-12 00:16:56 dovecot_plain authenticator failed for ([89.116.164.85]) [180.75.244.109]:19510: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.54.36.144
country_id: 6252001
description:
2025-12-12 00:17:07 dovecot_plain authenticator failed for 104-54-36-144.lightspeed.irvnca.sbcglobal.net ([89.116.164.85]) [104.54.36.144]:54794: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-12 00:19:01 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (melly) [73.195.211.98]:37680: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.162
country_id: 6252001
description:
Dec 12 00:20:12 host2 pure-ftpd[4027754]: (?@147.185.132.162) [INFO] New connection from 147.185.132.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-12 00:20:25 dovecot_login authenticator failed for ([140.84.179.128]) [128.185.246.106]:33064: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.67.69.102
country_id: 6251999
description:
2025-12-12 00:22:27 dovecot_plain authenticator failed for s0106d4e2cb4ae6cb.va.shawcable.net ([89.116.164.85]) [50.67.69.102]:36278: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.155.14.114
country_id: 3686110
description:
2025-12-12 00:22:39 dovecot_plain authenticator failed for dynamic-186-155-14-114.dynamic.etb.net.co ([89.116.164.85]) [186.155.14.114]:63649: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.185.24
country_id: 3625428
description:
2025-12-12 00:22:50 dovecot_plain authenticator failed for ([89.116.164.85]) [38.248.185.24]:9540: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 00:22:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ANcDp7FFKqc+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.185.24
country_id: 3625428
description:
2025-12-12 00:22:56 dovecot_login authenticator failed for ([89.116.164.85]) [38.248.185.24]:9540: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-12 00:23:08 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:60547: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-12 00:24:29 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (uncisends) [68.193.149.88]:56697: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.6
country_id: 798549
description:
Dec 12 00:24:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.6, lip=66.85.158.92, session=<syHSrLFFRovUSZQG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.195
country_id: 2510769
description:
Dec 12 00:24:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=139.28.190.195, lip=66.85.158.91, TLS, session=<EACGrLFFiOeLHL7D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 00:24:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<unrMq7FF0tkro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 00:25:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<qYcqr7FFLsM+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.130
country_id: 3469034
description:
Dec 12 00:25:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.128.130, lip=66.85.158.91, TLS, session=<pravrbFF1eC/NYCC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.63.161.126
country_id: 2510769
description:
2025-12-12 00:26:13 dovecot_login authenticator failed for static-126-161-63-95.ipcom.comunitel.net [95.63.161.126]:42140: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-12 00:26:19 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:51724: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-12 00:26:27 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:49410: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.83
country_id: 3175395
description:
Dec 12 00:26:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.47.136.83, lip=66.85.158.91, TLS, session=<J8mgtLFFR9O5L4hT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-12-12 00:27:01 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:47465: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.131
country_id: 933860
description:
Dec 12 00:27:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=41.216.215.131, lip=66.85.158.91, TLS, session=<m0nKtbFFL7Ip2NeD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 00:27:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<16BCt7FFxNMv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.171.87
country_id: 2510769
description:
2025-12-12 00:28:28 dovecot_login authenticator failed for (TBIZf5zj) [98.98.171.87]:62367: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.171.87
country_id: 2510769
description:
2025-12-12 00:29:15 dovecot_login authenticator failed for (lSQpFpV4) [98.98.171.87]:64637: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.171.87
country_id: 2510769
description:
2025-12-12 00:30:03 dovecot_login authenticator failed for (FKcLH3F5) [98.98.171.87]:56797: 535 Incorrect authentication data (set_id=info)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 98.98.171.87
country_id: 2510769
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[98.98.171.87] [Authentication Database]=[mail] [Username]=[info] (5/5 failures) (blocked until [Thu Dec 11 19:15:01 2025 UTC/Fri Dec 12 00:45:01 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 12 00:30:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<7wlFw7FFCsI+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-12 00:31:19 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:37688: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-12 00:31:29 dovecot_login authenticator failed for (30-170-97-62.cust.smartcall.no) [62.97.170.30]:37399: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 12 00:31:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<B7A3xrFFTIyl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-12 00:31:41 dovecot_login authenticator failed for ([128.185.247.254]) [125.19.158.2]:48114: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-12 00:31:51 dovecot_login authenticator failed for (187.161.136.37-clientes-izzi.mx) [187.161.136.37]:35893: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-12 00:32:30 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:51884: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-12 00:32:44 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:51834: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-12 00:33:44 dovecot_login authenticator failed for ([182.95.228.194]) [182.95.228.194]:40856: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 12 00:32:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<yhrDyrFF2IkvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-12 00:33:58 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:53500: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-12 00:34:30 dovecot_plain authenticator failed for (auncythant) [94.201.22.158]:49225: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 00:34:33 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (comulavans) [87.103.126.54]:52608: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.94.22
country_id: 6252001
description:
Dec 12 00:34:41 host2 sshd[4039333]: Disconnected from invalid user vishnu 104.168.94.22 port 60052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 00:36:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<OHz52LFFKFMvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec 12 00:36:45 host2 sshd[4041100]: Disconnected from invalid user db2fenc1 172.191.157.64 port 46022 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 00:36:52 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cicha) [87.103.126.54]:6766: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 12 00:36:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<QaND2bFFBtTIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-12 00:37:00 dovecot_login authenticator failed for ([178.239.238.23]) [178.239.238.23]:59582: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.162
country_id: 6252001
description:
2025-12-12 00:37:13 dovecot_login authenticator failed for ([72.214.132.162]) [72.214.132.162]:48017: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-12 00:37:51 dovecot_login authenticator failed for ([128.185.235.110]) [128.185.235.110]:54482: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 12 00:38:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<7UXl3rFF1Lc+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2025-12-12 00:38:14 dovecot_login authenticator failed for ([188.59.19.112]) [188.59.19.112]:55589: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.94.22
country_id: 6252001
description:
Dec 12 00:39:35 host2 sshd[4043070]: Disconnected from invalid user ossadm 104.168.94.22 port 56800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 00:39:45 host2 sshd[4043209]: Disconnected from invalid user  62.60.131.157 port 44085 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.94.22
country_id: 6252001
description:
Dec 12 00:40:11 host2 sshd[4043804]: Disconnected from invalid user switch 104.168.94.22 port 41296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec 12 00:40:21 host2 sshd[4044098]: Disconnected from invalid user rahul 67.207.83.103 port 41618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 12 00:40:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<fGlA5rFFSMdnJFMP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec 12 00:41:37 host2 sshd[4044935]: Disconnected from invalid user wcs 172.191.157.64 port 39884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.209.43.26
country_id: 6252001
description:
2025-12-12 00:41:38 dovecot_plain authenticator failed for ([209.209.43.26]) [209.209.43.26]:50462: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-12 00:41:12 dovecot_plain authenticator failed for (siled) [5.32.99.14]:40572: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.207.83.103
country_id: 6252001
description:
Dec 12 00:42:23 host2 sshd[4045429]: Disconnected from invalid user sun 67.207.83.103 port 35246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 00:42:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Cnin7bFFuufO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.94.22
country_id: 6252001
description:
Dec 12 00:41:53 host2 sshd[4045083]: Disconnected from invalid user kafka 104.168.94.22 port 51290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-12 00:41:57 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (comoot) [73.197.236.163]:49414: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec 12 00:42:12 host2 sshd[4045331]: Disconnected from invalid user user 172.191.157.64 port 59580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec 12 00:42:54 host2 sshd[4045774]: Disconnected from invalid user vncuser 67.207.83.103 port 40714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec 12 00:43:26 host2 sshd[4046188]: Disconnected from invalid user wpp 172.191.157.64 port 38206 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 00:43:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<hADX8bFFbOKG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 12 00:43:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<J3fY8bFFzp0+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 00:44:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Jgty8rFFrJw+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec 12 00:44:04 host2 sshd[4046557]: Disconnected from invalid user matt 172.191.157.64 port 36354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Dec 12 00:44:16 host2 sshd[4046723]: Disconnected from invalid user vpn 179.216.23.19 port 45440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Dec 12 00:44:45 host2 sshd[4047019]: Disconnected from invalid user kk 189.30.117.80 port 27968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Dec 12 00:46:46 host2 sshd[4048940]: Disconnected from invalid user cloud 189.30.117.80 port 59336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec 12 00:46:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<kRY8+rFFSqMrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-12-12 00:47:04 dovecot_login authenticator failed for ([149.54.51.162]) [149.54.51.162]:32785: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-12 00:47:18 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:47272: 535 Incorrect authentication data (set_id=newsletter)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 12 00:49:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<rG8pBbJF6JFnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 12 00:50:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Joc1CrJFCLA+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-12-12 00:50:53 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:53656: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 12 00:50:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<s8gLC7JFIpc+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 12 00:50:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<CvEDCrJFjsQ+PIce>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.216.23.19
country_id: 3469034
description:
Dec 12 00:51:06 host2 sshd[4052166]: Disconnected from invalid user admin 179.216.23.19 port 1823 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-12 00:51:28 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:37170: 535 Incorrect authentication data (set_id=newsletter)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 00:51:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<BRZGDrJFcoK8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Dec 12 00:52:59 host2 sshd[4053706]: Disconnected from invalid user devops 179.216.23.19 port 1855 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 12 00:54:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<SjYDF7JFJrM+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-12 00:55:35 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:40691: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.189
country_id: 1733045
description:
2025-12-12 00:55:40 dovecot_login authenticator failed for ([49.124.159.189]) [49.124.159.189]:35422: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 12 00:56:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7tVPHrJF3L8v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-12 00:56:44 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:45350: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-12 00:56:02 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:41184: 535 Incorrect authentication data (set_id=newsletter)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-12 00:56:03 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:57358: 535 Incorrect authentication data (set_id=newsletter)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Dec 12 00:56:06 host2 sshd[4056529]: Disconnected from invalid user ftpuser 189.30.117.80 port 47652 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 00:57:15 host2 sshd[4057252]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 12 00:57:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<+8qqI7JFeuw+PIdb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.30.117.80
country_id: 3469034
description:
Dec 12 00:56:58 host2 sshd[4057042]: Disconnected from invalid user oracle 189.30.117.80 port 56364 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.157
country_id: 6252001
description:
Dec 12 00:57:13 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.157, lip=66.85.158.91, session=<VGnBIbJF9PdC5DWd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.56
country_id: 6252001
description:
Dec 12 00:58:03 host2 pure-ftpd[4057680]: (?@205.210.31.56) [INFO] New connection from 205.210.31.56


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Dec 12 01:00:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z6yaLbJF5kxBMQFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 12 01:00:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<yx3SLrJF4LkvT+mI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Dec 12 01:01:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS: Connection closed, session=<eIXiL7JFmGlBMQFC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-12 01:01:28 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (derdae) [81.225.30.107]:50358: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-12 01:01:40 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:53754: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 12 01:01:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<2QxyMrJFwqpnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 12 01:02:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<lEpfM7JFKJ8+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2025-12-12 01:02:23 dovecot_login authenticator failed for (static.ftth.hpr.117.220.10.60.bsnl.in) [117.220.10.60]:60831: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-12 01:02:31 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:51772: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-12 01:03:00 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:47070: 535 Incorrect authentication data (set_id=newsletter)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 12 01:03:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3HiPOLJFqrwv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-12 01:04:07 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (nosocor) [76.97.155.25]:58050: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-12 01:04:01 dovecot_plain authenticator failed for (jocatously) [92.62.243.174]:53456: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 01:05:31 host2 sshd[4062248]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.142.154.43
country_id: 1819730
description:
Dec 12 01:05:23 host2 pure-ftpd[4062160]: (?@45.142.154.43) [INFO] New connection from 45.142.154.43


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.142.154.111
country_id: 1819730
description:
Dec 12 01:05:22 host2 pure-ftpd[4062149]: (?@45.142.154.111) [INFO] New connection from 45.142.154.111


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.187.25.120
country_id: 3625428
description:
Dec 12 01:06:21 host2 sshd[4062895]: Disconnected from invalid user splunk 150.187.25.120 port 54009 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 01:06:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<0WYqRLJFFIY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 12 01:08:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<fchaSLJFPLSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 01:08:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<6h7TSLJFgpY+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-12 01:09:15 dovecot_plain authenticator failed for (chile) [65.20.143.159]:59287: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 12 01:09:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<6/HXTLJFoOFnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-12 01:11:09 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:39979: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 01:11:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<eqqVVLJFHOUro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-12 01:11:30 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:35944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.184
country_id: 6252001
description:
Dec 12 01:18:55 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.184, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sGNob7JF/tzN0h+4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-12 01:20:07 dovecot_login authenticator failed for ([89.218.247.234]) [89.218.247.234]:43164: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.236
country_id: 3865483
description:
Dec 12 01:20:12 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=181.191.223.236, lip=66.85.158.91, TLS, session=<pgTgcrJFBcW1v9/s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.179
country_id: 1733045
description:
2025-12-12 01:20:15 dovecot_login authenticator failed for ([49.124.155.179]) [49.124.155.179]:43616: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.240.57.60
country_id: 1819730
description:
Dec 12 01:20:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.240.57.60, lip=66.85.158.91, session=<TscIdLJFvJsv8Dk8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.208
country_id: 798544
description:
Dec 12 01:19:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=178.216.27.208, lip=66.85.158.91, TLS, session=<9Qq0cbJFC+uy2BvQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.7
country_id: 1733045
description:
2025-12-12 01:20:30 dovecot_login authenticator failed for ([49.124.153.7]) [49.124.153.7]:50176: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 01:21:07 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:53960: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.228.11
country_id: 3865483
description:
2025-12-12 01:21:20 dovecot_login authenticator failed for ([190.185.228.11]) [190.185.228.11]:57821: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-12 01:21:43 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:60916: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 12 01:21:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<8r7kebJFxzVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 01:23:11 host2 sshd[4077362]: Disconnected from invalid user  62.60.131.157 port 15243 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 01:23:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<IoNBgbJFhMmkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-12 01:26:01 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:52626: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-12 01:26:21 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:45978: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 12 01:27:08 host2 sshd[4080046]: Disconnected from invalid user git 89.218.69.66 port 7399 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.189
country_id: 1733045
description:
2025-12-12 01:27:25 dovecot_login authenticator failed for ([49.124.148.189]) [49.124.148.189]:40654: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 01:27:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<yWFRjrJFNu7D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-12-12 01:27:44 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:59892: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 01:28:08 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:43744: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2025-12-12 01:27:25 dovecot_login authenticator failed for ([113.203.205.37]) [113.203.205.37]:49294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.222
country_id: 3996063
description:
2025-12-12 01:28:02 dovecot_login authenticator failed for (201.172.88.222-clientes-izzi.mx) [201.172.88.222]:40763: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 12 01:28:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<PB+lkLJF5N8zTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-12-12 01:29:00 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:49978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-12 01:29:02 dovecot_plain authenticator failed for (trocelet) [65.20.143.159]:38300: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 12 01:28:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<EP8sk7JFOMtnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 12 01:29:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<f1DNlLJFVI0vT+mI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 12 01:29:48 host2 sshd[4081529]: Disconnected from invalid user ftpuser 89.218.69.66 port 16399 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 01:30:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<aiX/lrJF6o9npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 12 01:30:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<Ymj5lrJFyJo+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.199.224.52
country_id: 357994
description:
Dec 12 01:30:38 host2 sshd[4082177]: Disconnected from invalid user web 197.199.224.52 port 40202 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 01:30:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<iEZymrJFKsA+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 12 01:31:09 host2 sshd[4082566]: Disconnected from invalid user lighthouse 89.218.69.66 port 2053 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Dec 12 01:32:02 host2 sshd[4083295]: Disconnected from invalid user ttx 197.199.224.52 port 54424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 12 01:33:04 host2 sshd[4084011]: Disconnected from invalid user ubuntu 89.218.69.66 port 19924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 12 01:32:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<P9qLn7JFnJNnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
country_id: 3175395
description:
2025-12-12 01:32:36 dovecot_plain authenticator failed for (maters) [151.3.178.94]:58454: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 01:35:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<if+nq7JFIryWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 01:35:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<TL8qrLJF7Ocv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-12 01:36:09 dovecot_login authenticator failed for ([103.186.193.149]) [103.186.193.149]:54024: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.186.16
country_id: 3996063
description:
2025-12-12 01:36:42 dovecot_login authenticator failed for (187.161.186.16-clientes-izzi.mx) [187.161.186.16]:59489: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 12 01:37:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<mcKNsbJFRrQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.73
country_id: 3469034
description:
Dec 12 01:40:03 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=191.53.40.73, lip=66.85.158.91, TLS, session=<fCHAubJFTYy/NShJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-12 01:40:10 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:50603: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-12 01:39:58 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:49262: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.85.208
country_id: 3469034
description:
Dec 12 01:40:23 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=201.159.85.208, lip=66.85.158.91, TLS, session=<tZATu7JFP4LJn1XQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-12 01:40:45 dovecot_plain authenticator failed for (zully) [75.97.190.237]:58782: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 01:43:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (penced) [87.103.126.54]:13569: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-12 01:45:06 dovecot_login authenticator failed for ([182.95.7.193]) [182.95.59.154]:47328: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 12 01:45:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<no8szbJFuIg+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 01:45:21 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:48744: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-12 01:46:04 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:58038: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-12-12 01:46:18 dovecot_login authenticator failed for ([27.123.114.130]) [27.123.114.130]:45010: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.149.196
country_id: 1733045
description:
2025-12-12 01:45:49 dovecot_login authenticator failed for ([183.171.149.196]) [183.171.149.196]:33278: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-12 01:46:02 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:47016: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-12 01:46:03 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:35680: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 01:49:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<E+jY3LJFcNEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 01:49:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<m1Kl3bJFnscro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-12 01:50:11 dovecot_plain authenticator failed for (batilixed) [65.20.143.159]:52483: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-12 01:50:53 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:42358: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-12 01:51:25 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:51170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-12 01:51:28 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:60863: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-12 01:51:59 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:52902: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 12 01:53:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<OObq6rJFqOUvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 12 01:54:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<AysN7rJFrr8+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 01:54:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<JWZA7rJFLIw+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 12 01:55:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<9Wxy8bJF9qc+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 01:55:27 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (epang) [96.230.65.90]:40052: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 12 01:55:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<bRgS8rJFnoOl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 01:57:11 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (nostion) [24.15.216.41]:51116: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 01:57:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<xKpd+LJFXo0+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-12-12 01:59:02 dovecot_login authenticator failed for (201.173.250.31-clientes-izzi.mx) [201.173.250.31]:32813: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.181
country_id: 3144096
description:
2025-12-12 01:59:14 dovecot_login authenticator failed for (181-162-97-62.cust.smartcall.no) [62.97.162.181]:53736: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 01:58:44 host2 sshd[4103938]: Disconnected from invalid user user 2.57.121.25 port 33696 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.156
country_id: 2635167
description:
Dec 12 02:00:12 host2 dovecot[3988696]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.156, lip=66.85.158.91, TLS, session=<3iQOA7NFQZBX7LCc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.196
country_id: 2635167
description:
Dec 12 02:00:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.196, lip=66.85.158.91, TLS handshaking: Connection closed, session=<f0AfA7NFjea594nE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-12 02:00:16 dovecot_plain authenticator failed for (labrandate) [81.0.54.119]:42527: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-12 02:00:40 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:37128: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.201
country_id: 2635167
description:
Dec 12 02:00:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.201, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<TakaBbNFcddX7LDJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2025-12-12 02:00:57 dovecot_login authenticator failed for ([197.219.208.38]) [197.219.208.38]:34746: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.244
country_id: 3865483
description:
Dec 12 02:00:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=181.191.223.244, lip=66.85.158.91, TLS, session=<fXasBLNF7dm1v9/0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.213
country_id: 2635167
description:
Dec 12 02:01:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.213, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+x0WB7NFcd1X7LDV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.80.94
country_id: 1269750
description:
Dec 12 02:01:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=103.30.80.94, lip=66.85.158.91, TLS, session=<+7XzBbNFLp1nHlBe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-12 02:01:34 dovecot_login authenticator failed for ([125.20.245.194]) [125.20.245.194]:33724: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-12 02:01:47 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (gotturoid) [73.129.57.71]:56772: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-12 02:01:51 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (doakinis) [68.46.148.180]:33216: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 12 02:01:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<YhW5CLNF/pvIaZyl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.192
country_id: 2635167
description:
Dec 12 02:01:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.192, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<d1URCbNFraVX7LDA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-12 02:01:56 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:58357: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 02:01:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<8cAkCbNFYI4vTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.210
country_id: 2635167
description:
Dec 12 02:02:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.210, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Y6IMC7NFk4JX7LDS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.187
country_id: 2635167
description:
Dec 12 02:03:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.187, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c/UFDbNFs6C594m7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.167
country_id: 3996063
description:
2025-12-12 02:03:01 dovecot_login authenticator failed for ([177.236.146.167]) [177.236.146.167]:54940: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-12 02:03:20 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:39402: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.194
country_id: 2635167
description:
Dec 12 02:03:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.194, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5tgED7NF6eO594nC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.216
country_id: 2635167
description:
Dec 12 02:04:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.216, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<OdL+ELNFteK594nY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-12 02:04:32 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:32840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.215
country_id: 2635167
description:
Dec 12 02:04:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.215, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<MVz4ErNF64q594nX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-12 02:04:55 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:34072: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 02:05:10 host2 sshd[4109235]: Disconnected from invalid user  62.60.131.157 port 54075 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.216
country_id: 2635167
description:
Dec 12 02:05:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.216, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<iaPzFLNFlb1X7LDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 02:05:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<eesfFbNF2OI+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 02:04:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<Zp8BErNFsOE+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-12 02:06:38 dovecot_login authenticator failed for ([149.232.203.22]) [149.232.203.22]:56739: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 02:06:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56826: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 12 02:07:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<M8ZCHbNF2Lw+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 12 02:08:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<PFSKILNF2sM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 02:08:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<9inIILNFJIfO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.167
country_id: 2186224
description:
2025-12-12 02:09:41 dovecot_login authenticator failed for ([121.73.169.167]) [121.73.169.167]:52050: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-12 02:09:47 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:54972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2025-12-12 02:09:55 dovecot_login authenticator failed for ([125.21.200.57]) [128.185.219.54]:60850: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-12-12 02:10:05 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:51204: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 12 02:10:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<w6M7J7NFJoo+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-12 02:11:30 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:60934: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-12 02:11:43 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:33274: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.244
country_id: 6252001
description:
Dec 12 02:12:06 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.244, lip=66.85.158.92, session=<7LaOLbNFZOLN0h/0>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 12 02:12:51 host2 sshd[4114951]: Received disconnect from 192.3.105.24 port 53974:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec 12 02:12:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<dsJaMLNFDokrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 12 02:13:53 host2 sshd[4115633]: Disconnected from invalid user manoj 192.3.105.24 port 54134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 02:14:21 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (untroa) [96.230.65.90]:54088: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 12 02:14:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<vPFfNbNF+NxnsX0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 12 02:14:59 host2 sshd[4116453]: Disconnected from invalid user flw 192.3.105.24 port 54296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 02:15:04 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:50530: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 12 02:16:06 host2 sshd[4117366]: Disconnected from invalid user hossein 192.3.105.24 port 54448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-12-12 02:15:31 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:41321: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2025-12-12 02:15:30 dovecot_login authenticator failed for ([202.22.204.23]) [202.22.204.23]:51912: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.244.92.197
country_id: 6251999
description:
2025-12-12 02:15:42 dovecot_login authenticator failed for dhcp-4-bc-9f-5c-cd-c1.cpe.i-zoom.net [24.244.92.197]:44770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 02:17:09 host2 sshd[4118034]: Disconnected from invalid user admin 2.57.121.112 port 58261 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 02:17:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (inicoples) [87.103.126.54]:45520: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-12 02:17:20 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (nosynize) [24.23.125.83]:52012: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2025-12-12 02:16:27 dovecot_login authenticator failed for (41.215.125.250.accesskenya.com) [41.215.125.250]:33650: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-12 02:16:47 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:48471: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 02:16:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<wavmPrNFvOSG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 12 02:17:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<DqUmQrNFBM4v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 02:18:18 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (anized) [24.15.216.41]:39548: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-12 02:17:23 dovecot_plain authenticator failed for (pratcals) [102.53.15.56]:48383: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.140.186
country_id: 3469034
description:
2025-12-12 02:18:39 dovecot_plain authenticator failed for ([89.116.164.85]) [179.214.140.186]:50335: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.74.71.103
country_id: 1733045
description:
2025-12-12 02:18:40 dovecot_plain authenticator failed for ([89.116.164.85]) [180.74.71.103]:23198: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.171
country_id: 3658394
description:
2025-12-12 02:18:53 dovecot_plain authenticator failed for ([89.116.164.85]) [181.199.46.171]:33821: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.78.196.121
country_id: 3469034
description:
2025-12-12 02:18:52 dovecot_plain authenticator failed for ([89.116.164.85]) [170.78.196.121]:51913: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 02:18:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<zH/ARLNF3Lg+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.3.51.0
country_id: 298795
description:
2025-12-12 02:18:35 dovecot_plain authenticator failed for ([89.116.164.85]) [188.3.51.0]:16494: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.237.4.171
country_id: 3469034
description:
2025-12-12 02:18:37 dovecot_plain authenticator failed for 152-237-4-171.user.veloxzone.com.br ([89.116.164.85]) [152.237.4.171]:28942: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.98.36.147
country_id: 3382998
description:
2025-12-12 02:18:47 dovecot_plain authenticator failed for ([89.116.164.85]) [190.98.36.147]:10367: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.151.162.5
country_id: 1694008
description:
2025-12-12 02:18:54 dovecot_plain authenticator failed for ([89.116.164.85]) [49.151.162.5]:48067: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 12 02:19:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<PB2LRrNFsOE+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.223.71.199
country_id: 298795
description:
2025-12-12 02:18:25 dovecot_plain authenticator failed for ([89.116.164.85]) [31.223.71.199]:35532: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.89.57
country_id: 99237
description:
2025-12-12 02:18:25 dovecot_plain authenticator failed for ([89.116.164.85]) [130.255.89.57]:33976: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.198.248
country_id: 6252001
description:
2025-12-12 02:18:23 dovecot_plain authenticator failed for 107-135-198-248.lightspeed.tukrga.sbcglobal.net ([89.116.164.85]) [107.135.198.248]:32790: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-12 02:19:40 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (subilice) [174.166.153.20]:44270: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 12 02:19:44 host2 sshd[4119467]: Disconnected from invalid user hossein 187.210.77.100 port 46466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-12 02:21:30 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (reuribolid) [37.150.8.174]:37854: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 02:21:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Ob0AULNFwOu8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 02:23:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<akeWVbNF5I4+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.113.218
country_id: 953987
description:
2025-12-12 02:24:47 dovecot_login authenticator failed for ([196.25.113.220]) [196.25.113.218]:35329: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.159.235
country_id: 6252001
description:
Dec 12 02:24:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.172.159.235, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0MctW7NF8tmnrJ/r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 12 02:24:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<kU9XW7NFiqdnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.100
country_id: 6252001
description:
2025-12-12 02:25:04 dovecot_login authenticator failed for ([70.174.168.100]) [70.174.168.100]:33118: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 12 02:25:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<YXtuXLNFOIov/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 12 02:25:26 host2 sshd[4123585]: Disconnected from invalid user bitrix 187.210.77.100 port 58182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-12 02:25:41 dovecot_login authenticator failed for ([182.95.58.114]) [182.95.58.114]:40530: 535 Incorrect authentication data (set_id=stuff@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-12 02:26:14 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:52719: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 02:26:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Sj6eYLNFELY+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 12 02:27:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<Z7ceZrNFdJpnsX0d>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.177.125.29
country_id: 1210997
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.177.125.29] [Remote Port]=[39540] [Authentication Database]=[mail] [Username]=[info@essenceceylontea.com] (10/10 failures) (blocked until [Fri Dec 12 20:57:55 2025 UTC/Sat Dec 13 02:27:55 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.153.123.18
country_id: 3625428
description:
2025-12-12 02:29:36 dovecot_login authenticator failed for ([190.153.123.18]) [190.153.123.18]:52738: 535 Incorrect authentication data (set_id=stuff@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 12 02:29:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<u61jbLNFqKovT+mI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-12 02:30:20 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (inviochon) [68.82.141.145]:51738: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 12 02:31:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<XAGlcbNFeoOPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 02:32:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<MsBgd7NFDqQ+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 12 02:33:53 host2 sshd[4130435]: Disconnected from invalid user ospite 187.210.77.100 port 40612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-12-12 02:34:11 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:49486: 535 Incorrect authentication data (set_id=stuff@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-12 02:34:38 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:55274: 535 Incorrect authentication data (set_id=stuff@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 02:34:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<QhZRfrNFHIgro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-12 02:34:45 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (spize) [24.91.103.202]:54162: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-12 02:35:16 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:57832: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.70.79.37
country_id: 6252001
description:
2025-12-12 02:34:31 dovecot_login authenticator failed for wsip-174-70-79-37.ph.ph.cox.net [174.70.79.37]:44783: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-12 02:35:27 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:51144: 535 Incorrect authentication data (set_id=stuff@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-12 02:35:42 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:46432: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 12 02:36:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<dtYtg7NFoIpnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 12 02:36:40 host2 sshd[4133235]: Disconnected from invalid user manoj 187.210.77.100 port 52480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.28
country_id: 6252001
description:
Dec 12 02:37:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.28, lip=66.85.158.91, TLS handshaking: Connection closed, session=<u+exibNFj+DDuEwc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.30
country_id: 6252001
description:
Dec 12 02:38:32 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 41 secs): user=<>, rip=195.184.76.30, lip=66.85.158.91, TLS: Connection closed, session=<INgejLNF1ZPDuEwe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 12 02:39:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<PVNjjrNF3uI+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 02:39:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<zRrqkLNFjLI+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-12-12 02:40:00 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:36874: 535 Incorrect authentication data (set_id=stuff@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-12 02:40:12 dovecot_login authenticator failed for a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:42872: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec 12 02:39:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<0wEpj7NFzsk+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-12 02:40:59 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:60759: 535 Incorrect authentication data (set_id=stuff@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 02:41:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<7AXElrNFjKo+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-12 02:42:21 dovecot_login authenticator failed for survey.hagbergconsulting.com ([174.77.111.220]) [207.200.180.174]:59300: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-12 02:41:25 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:60250: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.136.231.166
country_id: 1814991
description:
Dec 12 02:42:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=8.136.231.166, lip=66.85.158.91, session=<2gNJm7NFaMwIiOem>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-12 02:42:47 dovecot_login authenticator failed for ([49.125.201.83]) [46.212.119.125]:44911: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.240.57.60
country_id: 1819730
description:
Dec 12 02:45:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.240.57.60, lip=66.85.158.91, session=<hELvo7NF/qQv8Dk8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 02:45:43 host2 sshd[4141493]: Disconnected from invalid user admin 62.60.131.157 port 45670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 02:45:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<crTupLNF8ugI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 02:47:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<RO3rqrNFwp6kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 02:47:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<sXAQrLNFDKDD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 12 02:47:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<vMMnrLNFStQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 12 02:49:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YhWzsbNFCkhniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.16
country_id: 3996063
description:
2025-12-12 02:50:20 dovecot_login authenticator failed for (201.166.222.16-clientes-izzi.mx) [201.166.222.16]:57184: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-12 02:50:01 dovecot_login authenticator failed for (cm-84.211.6.119.get.no) [84.211.6.119]:40097: 535 Incorrect authentication data (set_id=tech@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 02:51:03 host2 sshd[4145824]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 12 02:52:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<lBI/vbNFwso+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 12 02:52:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<0vwpv7NFcLRnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 02:53:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<ui0WwrNFPN4+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 02:53:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<85kpw7NFDJM+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.248
country_id: 6252001
description:
2025-12-12 02:54:12 dovecot_login authenticator failed for wsip-184-191-242-248.fv.ks.cox.net [184.191.242.248]:42980: 535 Incorrect authentication data (set_id=tech@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-12-12 02:54:32 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:63215: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-12 02:55:40 dovecot_plain authenticator failed for (catextrap) [65.20.233.110]:55327: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 02:57:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<x4+Gz7NFzNyLOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.227.179.195
country_id: 6252001
description:
2025-12-12 02:57:53 dovecot_plain authenticator failed for (miter) [50.227.179.195]:58647: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 02:57:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Bj6K0bNFKtgv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 12 02:58:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<KKXM0rNFmt8vT+mI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 02:59:14 host2 sshd[4153591]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 02:59:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<vOpU1rNFNJA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2025-12-12 02:58:37 dovecot_login authenticator failed for ([125.19.175.93]) [182.95.176.122]:51434: 535 Incorrect authentication data (set_id=tech@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-12 02:58:48 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:54212: 535 Incorrect authentication data (set_id=tech@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.181
country_id: 3144096
description:
2025-12-12 02:58:57 dovecot_login authenticator failed for (181-162-97-62.cust.smartcall.no) [62.97.162.181]:59654: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-12 02:59:51 dovecot_login authenticator failed for (static.90.254.104.190.cps.com.ar) [190.104.254.91]:33408: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-12 02:59:51 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3754: 535 Incorrect authentication data (set_id=tech@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-12 03:00:07 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:55312: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 02:59:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<cpCa17NFbJpnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-12 03:00:22 dovecot_login authenticator failed for (aes-static-137.135.17.125.airtel.in) [182.95.228.10]:59094: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-12 03:00:51 dovecot_login authenticator failed for ([182.95.85.181]) [182.95.123.46]:45064: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 12 03:01:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<4cKY3rNFEqIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 03:01:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<g1oA37NFVLo+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 03:03:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<CmLh5rNFFIanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-12 03:04:37 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:52442: 535 Incorrect authentication data (set_id=tech@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-12 03:04:49 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:41290: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 03:04:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<9HoF6rNFvtc+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-12 03:05:25 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:52889: 535 Incorrect authentication data (set_id=tech@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 03:05:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<KUQ27LNFVr2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-12 03:05:38 dovecot_login authenticator failed for (cm-178.232.197.135.get.no) [178.232.197.135]:60838: 535 Incorrect authentication data (set_id=tech)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.26
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.26: 250 connections per 30 seconds to 8443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.26
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.26: 374 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 03:11:25 host2 sshd[4163488]: Disconnected from invalid user user 2.57.121.25 port 49924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 03:11:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<8DR0ArRFGMIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 12 03:13:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ZAuPCbRFpNIvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 03:14:22 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (indsm) [71.224.169.28]:34588: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-12 03:14:38 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (bolly) [24.1.200.187]:53734: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-12 03:14:49 dovecot_login authenticator failed for ([124.246.114.111]) [124.246.114.111]:49563: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-12 03:15:16 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (unstiontil) [67.172.54.29]:35322: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-12 03:15:20 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:53781: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.127
country_id: 3469034
description:
Dec 12 03:16:50 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.44.96.127, lip=66.85.158.91, TLS, session=<n73kE7RFbtmxLGB/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 03:17:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<xuHOGLRF4qM+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-12 03:18:03 dovecot_plain authenticator failed for (dolous) [94.201.22.158]:46962: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.148.92
country_id: 953987
description:
Dec 12 03:18:04 host2 sshd[4169100]: Disconnected from invalid user nexus 102.210.148.92 port 45278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-12 03:18:05 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (apigrachal) [81.225.30.107]:42410: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.160
country_id: 953987
description:
Dec 12 03:17:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=102.64.46.160, lip=66.85.158.91, TLS, session=<VLMpFbRFn4pmQC6g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.36
country_id: 1733045
description:
2025-12-12 03:18:54 dovecot_login authenticator failed for ([49.124.151.36]) [49.124.151.36]:42162: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-12 03:19:46 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:49512: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 03:20:05 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:34568: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 12 03:19:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<m2hlHbRF3INnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 03:19:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<rA8mHrRFNLw+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 03:20:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<fEXaIrRFEo0+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Dec 12 03:20:57 host2 sshd[4172136]: Disconnected from invalid user ardi 24.232.50.5 port 48972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 12 03:21:28 host2 sshd[4172444]: Disconnected from invalid user dmdba 141.95.162.162 port 38768 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 12 03:23:05 host2 sshd[4173545]: Disconnected from invalid user avinash 141.95.162.162 port 39174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 12 03:23:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<qsZjK7RFyKU+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 12 03:22:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<DxMRKLRFYKml6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 12 03:22:38 host2 sshd[4173200]: Disconnected from invalid user oo 163.44.99.31 port 39478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 12 03:23:38 host2 sshd[4174042]: Disconnected from invalid user ardi 141.95.162.162 port 45512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-12 03:23:58 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:49288: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 12 03:23:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<8rsbLLRFirXIaZyl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 12 03:23:20 host2 sshd[4173772]: Disconnected from invalid user test2 163.44.99.31 port 39914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 12 03:24:38 host2 sshd[4174985]: Disconnected from invalid user marco 163.44.99.31 port 50388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.33
country_id: 6252001
description:
2025-12-12 03:25:07 dovecot_login authenticator failed for ([98.181.46.33]) [98.181.46.33]:49829: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 12 03:24:08 host2 sshd[4174642]: Disconnected from invalid user a 141.95.162.162 port 57662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 03:24:10 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:37891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-12 03:24:15 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:45709: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.143
country_id: 3996063
description:
2025-12-12 03:24:32 dovecot_login authenticator failed for (201.173.216.143-clientes-izzi.mx) [201.173.216.143]:58095: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 12 03:25:16 host2 sshd[4175674]: Disconnected from invalid user nrk 163.44.99.31 port 37018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-12 03:25:18 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:43970: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Dec 12 03:26:03 host2 sshd[4176224]: Disconnected from invalid user test 24.232.50.5 port 36502 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 03:27:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<VvqnObRFztIvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.148.92
country_id: 953987
description:
Dec 12 03:26:36 host2 sshd[4176630]: Disconnected from invalid user a 102.210.148.92 port 33278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 12 03:26:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<W0mBOLRFjIg+PIdo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.148.92
country_id: 953987
description:
Dec 12 03:29:07 host2 sshd[4178203]: Disconnected from invalid user avinash 102.210.148.92 port 39152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 12 03:29:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<v0JCQ7RF3Js+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-12 03:29:54 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:55432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2025-12-12 03:29:56 dovecot_plain authenticator failed for (unely) [50.215.95.14]:32936: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.111
country_id: 3996063
description:
2025-12-12 03:30:11 dovecot_login authenticator failed for (201.173.97.111-clientes-izzi.mx) [201.173.97.111]:59311: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 12 03:30:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<jCSaRLRFINY+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-12 03:30:38 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:39503: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-12-12 03:31:35 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:55168: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 12 03:33:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<6i3qTrRF2NQ+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.187.173.173
country_id: 6252001
description:
2025-12-12 03:33:08 dovecot_login authenticator failed for (89.187.173.173) [89.187.173.173]:57830: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.195.77
country_id: 2658434
description:
Dec 12 03:33:15 host2 pure-ftpd[4181177]: (?@35.216.195.77) [INFO] New connection from 35.216.195.77


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.195.77
country_id: 2658434
description:
Dec 12 03:33:20 host2 pure-ftpd[4181244]: (?@35.216.195.77) [INFO] New connection from 35.216.195.77


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 12 03:33:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<fATaUbRFruI+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 12 03:33:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<2fnWUbRFRI4+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 03:34:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<1OnOUrRFtODO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-12 03:37:30 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:53530: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.27
country_id: 798549
description:
Dec 12 03:37:39 host2 pure-ftpd[4185101]: (?@85.217.149.27) [INFO] New connection from 85.217.149.27


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-12 03:37:44 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:59704: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.19
country_id: 798549
description:
Dec 12 03:38:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=212.73.148.19, lip=66.85.158.92, TLS: Connection closed, session=<oZAeYrRFyL/USZQT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 12 03:39:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<L5DcZrRFoL0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec 12 03:39:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<CJhkZbRFlMormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 12 03:42:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<jDCScbRFzuVnsX0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-12 03:43:49 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:41742: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-12 03:44:19 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:43664: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 12 03:44:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<gf44eLRFgII+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-12 03:44:42 dovecot_login authenticator failed for ([82.193.122.91]) [82.193.122.91]:44474: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 12 03:44:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<PK0TebRF8LE+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-12 03:45:19 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:59234: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 12 03:47:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kKR7gbRFcOEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 03:47:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<TOO0gbRFPKE+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 03:47:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<irE8grRF8pQ+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-12 03:48:47 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:49840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-12 03:49:02 dovecot_login authenticator failed for ([27.123.105.41]) [182.95.52.206]:54736: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.123
country_id: 298795
description:
2025-12-12 03:49:09 dovecot_plain authenticator failed for (sersuped) [5.11.143.123]:54168: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-12 03:49:20 dovecot_login authenticator failed for (nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:51628: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 03:49:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<JjqAibRFnqk+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-12 03:49:32 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:45036: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 03:50:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<n/k4jrRFSOeG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-12 03:50:09 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:38417: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 03:52:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<SD8tk7RF2p68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-12 03:52:36 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (recohely) [98.204.134.124]:43600: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-12-12 03:54:57 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:35010: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-12-12 03:55:21 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:60354: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 12 03:55:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<8fJzn7RFLsRnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 12 03:55:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<FT24n7RFAuePbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.93.17.58
country_id: 1821275
description:
2025-12-12 03:55:52 dovecot_login authenticator failed for (n18293z17l58.static.ctmip.net) [182.93.17.58]:35160: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-12-12 03:56:12 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:55186: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-12 03:56:26 dovecot_login authenticator failed for (nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:33486: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 03:58:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<cho9qLRFLL0ro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 12 03:58:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<ZeF6qbRF2qcvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.241
country_id: 298795
description:
Dec 12 03:59:07 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=95.0.32.241, lip=66.85.158.91, TLS, session=<yDJLq7RFBNxfACDx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.142
country_id: 3175395
description:
Dec 12 03:59:44 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 9 secs): user=<info>, method=PLAIN, rip=185.197.9.142, lip=66.85.158.91, TLS, session=<MJXyrbRFyOq5xQmO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 12 03:59:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<vaAEr7RF6ok+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.249.253
country_id: 3469034
description:
Dec 12 03:59:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 19 secs): user=<info>, method=LOGIN, rip=170.245.249.253, lip=66.85.158.91, session=<a5G4rLRFyaWq9fn9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 04:00:19 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (habeamia) [87.103.126.54]:37660: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.253
country_id: 3175395
description:
Dec 12 04:01:14 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.63.133.253, lip=66.85.158.91, TLS, session=<X/7fsrRFUqa5P4X9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 12 04:01:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<xRx+tLRF8rs+PIdb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.88
country_id: 3865483
description:
Dec 12 04:01:40 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.252.88, lip=66.85.158.91, TLS, session=<es4ttLRFbLGzAPxY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 04:02:01 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (subjures) [87.103.126.54]:56062: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 12 04:03:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<g8h8urRFyoZnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.14.195.218
country_id: 2510769
description:
2025-12-12 04:04:44 dovecot_login authenticator failed for 218.red-88-14-195.dynamicip.rima-tde.net [88.14.195.218]:55232: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 12 04:06:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Xm9Cx7RFcI8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.110
country_id: 3865483
description:
Dec 12 04:06:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=190.181.109.110, lip=66.85.158.91, TLS, session=<ZGj1xrRF2rO+tW1u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.185
country_id: 3469034
description:
Dec 12 04:07:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=191.53.130.185, lip=66.85.158.91, TLS, session=<aS5myLRFD4W/NYK5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 04:07:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<a88Qy7RFCJ7D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-12 04:08:08 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:60618: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-12 04:08:32 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:52560: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 04:08:35 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:38112: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.186.16
country_id: 3996063
description:
2025-12-12 04:08:43 dovecot_login authenticator failed for (187.161.186.16-clientes-izzi.mx) [187.161.186.16]:60483: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 12 04:09:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<KRO50rRFhME+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 04:10:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<SuFD1rRFmsmkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.136.231.166
country_id: 1814991
description:
Dec 12 04:10:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=8.136.231.166, lip=66.85.158.91, session=<YzNZ1rRFvM0IiOem>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.240.57.60
country_id: 1819730
description:
Dec 12 04:11:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.240.57.60, lip=66.85.158.91, session=<0tgw17RFNqwv8Dk8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 12 04:11:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<zVxm2LRF0tZnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 04:12:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<FYWP3bRF/JI+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-12 04:13:56 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:47150: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 12 04:13:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nXOs3rRFFw5niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-12 04:13:31 dovecot_login authenticator failed for (cm-178.232.237.107.get.no) [178.232.237.107]:48696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-12 04:13:40 dovecot_plain authenticator failed for (forad) [102.53.15.18]:55206: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.28
country_id: 3996063
description:
2025-12-12 04:13:43 dovecot_login authenticator failed for (189.219.138.28-clientes-izzi.mx) [189.219.138.28]:49778: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-12 04:13:46 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:59688: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-12 04:14:40 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:38488: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-12 04:14:40 dovecot_plain authenticator failed for (katic) [65.20.250.163]:42356: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-12 04:15:01 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:56088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 12 04:15:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<rfv45rRF9IuYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 12 04:16:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<lYR/6bRFkutnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 04:17:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<hMwY77RFnI+H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 04:18:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<+fV58LRFUrkI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.35
country_id: 953987
description:
Dec 12 04:18:13 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.129.61.35, lip=66.85.158.91, TLS, session=<mKdi77RFdKFmgT0j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.186
country_id: 3865483
description:
Dec 12 04:18:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<accounts>, method=PLAIN, rip=179.0.251.186, lip=66.85.158.91, TLS, session=<phnJ8LRFs8qzAPu6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-12 04:19:32 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:47283: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-12 04:19:55 dovecot_login authenticator failed for ([182.74.13.219]) [182.74.12.86]:36254: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-12-12 04:20:02 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:32981: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-12 04:19:17 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:41221: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.179.36
country_id: 2510769
description:
2025-12-12 04:19:29 dovecot_login authenticator failed for 36.red-80-29-179.dynamicip.rima-tde.net [80.29.179.36]:40603: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-12-12 04:20:13 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:43292: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-12 04:20:29 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:57750: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 04:20:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<sGan+LRFUuUv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-12 04:20:51 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:50320: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 160.251.204.85
country_id: 1861060
description:
Dec 12 04:21:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=160.251.204.85, lip=66.85.158.91, session=<h7RV/bRFWISg+8xV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.31
country_id: 3017382
description:
Dec 12 04:22:41 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.196.152.31, lip=66.85.158.91, TLS handshaking: Connection closed, session=<HP2bALVF94BbxJgf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.119
country_id: 3017382
description:
Dec 12 04:23:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=91.196.152.119, lip=66.85.158.91, TLS: Connection closed, session=<XPC7AbVFr59bxJh3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.226
country_id: 6252001
description:
Dec 12 04:24:47 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.226, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4nQSCLVF9djN0h/i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 12 04:24:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<9uq3CLVFvuc+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-12 04:26:24 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (korive) [24.1.200.187]:34030: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Dec 12 04:26:32 host2 sshd[33908]: Disconnected from invalid user tp 107.172.151.218 port 54222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 04:26:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<pLfpDrVFHpI+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 12 04:27:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<oApJELVFhtsvT+mI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.2.146.184
country_id: 3865483
description:
Dec 12 04:27:53 host2 sshd[35200]: Disconnected from invalid user myuser 181.2.146.184 port 57454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 04:27:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<OhZKELVFKq0+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Dec 12 04:27:11 host2 sshd[34554]: Disconnected from invalid user centos 107.172.151.218 port 33196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 12 04:27:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ktX7EbVF7r8v+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.151.218
country_id: 6252001
description:
Dec 12 04:28:58 host2 sshd[35704]: Disconnected from invalid user ghostuser 107.172.151.218 port 44806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.183.239
country_id: 6252001
description:
Dec 12 04:29:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@mathsmotorcysle.xyz>, method=PLAIN, rip=167.71.183.239, lip=66.85.158.91, session=<zfsHGbVFSo6nR7fv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-12 04:29:43 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:48414: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 04:30:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<AyPyGrVFuJOLOxGe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Dec 12 04:30:07 host2 sshd[36909]: Disconnected from invalid user ubuntu 107.172.151.218 port 50226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 04:30:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<YiKDG7VFrMRnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-12 04:30:21 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:34770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.18
country_id: 130758
description:
Dec 12 04:30:23 host2 sshd[38121]: Disconnected from invalid user liuyong 109.122.251.18 port 35750 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.122.251.18
country_id: 130758
description:
Dec 12 04:31:09 host2 sshd[39428]: Disconnected from invalid user minecraft 109.122.251.18 port 46988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 12 04:31:45 host2 sshd[39914]: Disconnected from invalid user centos 89.107.10.66 port 37898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 12 04:33:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<P9GXJrVF4L8vWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.2.146.184
country_id: 3865483
description:
Dec 12 04:33:45 host2 sshd[41156]: Disconnected from invalid user ftpuser 181.2.146.184 port 56268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 04:33:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<IvubKLVFko0+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 12 04:34:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<ZVQpKrVF2pc+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 04:34:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<K9BLKrVFAOEv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.39
country_id: 6252001
description:
Dec 12 04:36:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.97.5.39, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fISBMLVF0JMSYQUn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.2.146.184
country_id: 3865483
description:
Dec 12 04:35:11 host2 sshd[42231]: Disconnected from invalid user rootadmin 181.2.146.184 port 38140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 12 04:35:21 host2 sshd[42414]: Disconnected from invalid user ladyaspb 89.107.10.66 port 60192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Dec 12 04:35:31 host2 sshd[42518]: Disconnected from invalid user git 107.172.151.218 port 34626 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 04:35:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<tdJ1LrVFWtGnrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.39
country_id: 6252001
description:
Dec 12 04:36:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=18.97.5.39, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+bHOMLVFLqASYQUn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 04:36:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<6BXlMLVF+riWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 04:36:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<YqafMrVFLOIro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 12 04:38:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<uLGMN7VF9pw+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 12 04:37:50 host2 sshd[43760]: Disconnected from invalid user student3 89.107.10.66 port 50134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-12 04:38:23 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:39845: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2025-12-12 04:38:33 dovecot_login authenticator failed for ([2.196.202.17]) [2.196.202.17]:47450: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-12 04:38:45 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:60794: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.18
country_id: 130758
description:
Dec 12 04:38:47 host2 sshd[44256]: Disconnected from invalid user sara 109.122.251.18 port 35216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-12 04:38:50 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:40190: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-12 04:39:40 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:37530: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 12 04:39:39 host2 sshd[44760]: Disconnected from invalid user user1 89.107.10.66 port 36118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 04:40:02 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (amaks) [96.230.65.90]:34046: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-12 04:40:20 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:49282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.128
country_id: 6252001
description:
Dec 12 04:40:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.128, lip=66.85.158.91, TLS: Connection closed, session=<7xUYQbVFWqXHLZqA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-12-12 04:40:56 dovecot_plain authenticator failed for (unfrited) [85.29.149.211]:47600: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-12 04:42:58 dovecot_plain authenticator failed for (charies) [192.34.128.202]:53820: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 04:43:58 host2 sshd[47228]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-12 04:43:59 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:45014: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 12 04:44:00 host2 sshd[47246]: Disconnected from invalid user git 89.107.10.66 port 32804 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 04:44:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<4PGlTLVFUM8+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2025-12-12 04:45:06 dovecot_login authenticator failed for 176-170-1-244.abo.bbox.fr [176.170.1.244]:46046: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-12 04:44:41 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:52326: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 12 04:45:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<etUsUbVFYpLIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-12 04:45:26 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:41877: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.39.21.146
country_id: 357994
description:
2025-12-12 04:45:54 dovecot_plain authenticator failed for (I7QG1XB55L1Y) [197.39.21.146]:55333: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 12 04:46:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<WiigVLVFlrCl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.231
country_id: 6252001
description:
Dec 12 04:46:27 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.231, lip=66.85.158.91, TLS, session=<fROaVbVFGuPN0h/n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 04:47:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<4uHOV7VFzow+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 04:47:23 host2 sshd[49903]: Disconnected from invalid user admin 62.60.131.157 port 14713 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 12 04:47:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<Sch7WbVF6KE+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 04:47:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<+bLlWrVFbpg+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 04:48:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<tr2aXbVFEp5o1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 12 04:50:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<XpduYrVFMLNA44h6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 04:52:07 host2 sshd[53112]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-12 04:51:25 dovecot_plain authenticator failed for (droide) [94.206.93.90]:57310: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-12 04:52:27 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (poutched) [89.67.37.2]:49209: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 04:52:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<V6a2a7VFwDwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 04:53:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<zJhqcLVFptM+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 04:54:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<vBItc7VFkOu8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-12 04:54:49 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:52298: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-12 04:54:11 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:39446: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-12 04:57:53 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:35432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 04:58:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<gqH7f7VF8s0+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 12 04:58:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<34v9gLVFKMY+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-12-12 04:58:15 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:42578: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 12 05:00:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<e1M5iLVF0sg+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 05:00:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<rYEqibVF5pvO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec 12 05:01:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<6JfXirVFAOSB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-12 05:03:07 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:32778: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 12 05:02:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3AFJjrVFxLgv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 12 05:02:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<ltqpj7VFDNsvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-12 05:02:51 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:37874: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-12-12 05:03:23 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:30491: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-12 05:03:26 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:54424: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 12 05:03:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<L7PMkrVFB78z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Dec 12 05:03:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<Zeclk7VFLqFz8UML>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-12 05:03:57 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:48826: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 05:05:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<t50xmLVF2+l100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-12-12 05:04:26 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:65505: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 05:05:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<i2oumbVFTpc+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec 12 05:06:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<eqSmnLVFQLgrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 05:06:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<duKlnLVFJNA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 12 05:07:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<gKMEobVFTs+hI2jD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-12 05:08:08 dovecot_login authenticator failed for ([122.185.184.134]) [182.95.226.82]:42072: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-12 05:08:31 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:37282: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-12-12 05:09:01 dovecot_login authenticator failed for (static.ftth.btd.59.99.153.21.bsnl.in) [59.99.153.21]:29040: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 05:09:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<SrtYprVFeKMu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-12 05:09:54 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:36708: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 12 05:09:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<3LGjprVFHuNnsX0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2025-12-12 05:09:20 dovecot_login authenticator failed for adsl-89-217-204-91.adslplus.ch [89.217.204.91]:40890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-12-12 05:09:26 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:50930: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 12 05:09:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Es/dqLVFgNAv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.178.25
country_id: 6252001
description:
Dec 12 05:10:29 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.249.178.25, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<G9WHq7VF6OpK+bIZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 12 05:11:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@mathsmotorcysle.xyz>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<HnJ3rrVF/LWuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 05:12:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<eQ8Ds7VFxsA+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-12 05:17:38 dovecot_plain authenticator failed for (yeliviid) [176.113.155.132]:52367: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.41
country_id: 6252001
description:
2025-12-12 05:19:05 dovecot_login authenticator failed for ([98.185.120.41]) [98.185.120.41]:40853: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 12 05:19:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<qAj4yrVFYLE+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.120.62
country_id: 6252001
description:
Dec 12 05:21:46 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.235.120.62, lip=66.85.158.91, TLS, session=</k3k07VF+slK63g+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.111
country_id: 6252001
description:
Dec 12 05:21:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.111, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<LvPt07VFP8STuYRv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 05:21:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<L7f107VFGq8+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 05:22:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<7J4U1bVFWqY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-12 05:23:02 dovecot_plain authenticator failed for (fetwaxige) [38.248.111.238]:59001: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-12 05:23:15 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:43003: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-12 05:23:29 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:40961: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 05:24:58 host2 sshd[79081]: Disconnected from invalid user admin 2.57.121.112 port 16588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec 12 05:25:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<r16U37VF4sE+PIcp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.251
country_id: 6252001
description:
Dec 12 05:27:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.251, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6eGn5rVFJtXG6xj7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.233
country_id: 6252001
description:
2025-12-12 05:27:49 dovecot_login authenticator failed for wsip-184-191-242-233.fv.ks.cox.net [184.191.242.233]:37846: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-12-12 05:27:56 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:45164: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-12 05:29:05 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:55111: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-12 05:28:17 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:55840: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-12 05:28:44 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:45174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-12 05:29:01 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:34844: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.20
country_id: 798549
description:
Dec 12 05:29:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.20, lip=66.85.158.91, session=<Zwpd7rVFk5fUSZQU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.10
country_id: 6252001
description:
2025-12-12 05:29:35 dovecot_login authenticator failed for wsip-184-191-243-10.fv.ks.cox.net [184.191.243.10]:33278: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.10
country_id: 798549
description:
Dec 12 05:30:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.10, lip=66.85.158.91, session=<SjSJ8bVFXeJV2ZUK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 05:30:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<oLZ18rVFTISWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 05:31:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<2R9o9rVFGIII3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-12 05:32:51 dovecot_plain authenticator failed for (hypel) [88.149.153.106]:51281: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 05:32:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mLeX+7VF9qVm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 05:32:52 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (annic) [87.103.126.54]:28785: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-12-12 05:33:43 dovecot_login authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:58287: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-12 05:34:08 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:35279: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.114
country_id: 6252001
description:
2025-12-12 05:34:39 dovecot_login authenticator failed for wsip-184-191-250-114.fv.ks.cox.net [184.191.250.114]:42379: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-12 05:35:02 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:33883: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 05:34:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@seyawin.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<c6G9AbZFYo8+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 12 05:35:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<ITw1BbZF3Jk+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 05:35:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<m+UoBrZF/qkuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 12 05:36:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@melanifinefood.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<TRD0B7ZFpt4+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 05:36:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<j/qUCbZF2IRAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 05:36:57 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cones) [87.103.126.54]:35621: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-12 05:37:00 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (miara) [37.150.8.174]:56445: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 05:37:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<cXkWDLZF0MeKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 05:38:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<sFwYDrZFJK1npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 05:39:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<y+rgE7ZF5pZntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 05:43:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<1qb0H7ZFuKUv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-12 05:43:29 dovecot_login authenticator failed for (cm-84.213.188.130.get.no) [84.213.188.130]:44968: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 05:43:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<HisgIrZFytMv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-12 05:43:46 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:46678: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.196.233
country_id: 3996063
description:
2025-12-12 05:43:57 dovecot_login authenticator failed for ([201.173.196.233]) [201.173.196.233]:59402: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 05:44:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<IiW7I7ZF/jV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 05:44:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<k5y7I7ZFZMMImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 05:45:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<qeT9J7ZFxoYI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 05:46:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<hzgVLbZFgN+l6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 05:46:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Kr7iLbZFEL+kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-12 05:46:16 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:43565: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-12 05:46:35 dovecot_login authenticator failed for ([84.211.11.216]) [84.211.11.216]:46845: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.50
country_id: 6252001
description:
Dec 12 05:46:41 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.50, lip=66.85.158.91, session=<98T+LLZFduTG6xgy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-12 05:48:06 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (mallered) [73.213.236.66]:36880: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-12-12 05:47:45 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:44183: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-12-12 05:47:58 dovecot_login authenticator failed for ([61.246.205.1]) [125.19.218.2]:48216: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-12 05:49:16 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:41067: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-12 05:49:24 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:40381: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 05:49:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<8n0XN7ZFVsmG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 05:51:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<39jPPrZFEqSH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 05:51:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<UabuPrZFpKnD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-12 05:53:06 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:33220: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-12 05:52:23 dovecot_login authenticator failed for 24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:42360: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 05:52:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<+A2BQbZFHtvO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-12 05:52:51 dovecot_login authenticator failed for (ws99-36-153-203.rcil.gov.in) [136.233.79.230]:38070: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-12 05:53:53 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:34082: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 05:54:54 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60296: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-12 05:54:23 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:36348: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 12 05:54:46 host2 sshd[106381]: Disconnected from invalid user manager 45.230.150.7 port 58150 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 12 05:55:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ceylondigest.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<WVMpS7ZFfLM+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 05:55:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<84PKTLZF+rs+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 05:56:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Wq+dULZF3J3D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 05:56:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<eVCrUbZFBsPCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 12 05:56:30 host2 sshd[108018]: Disconnected from invalid user deep 103.139.59.214 port 51954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Dec 12 05:58:06 host2 sshd[109124]: Disconnected from invalid user git 156.239.45.43 port 48612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 12 05:57:28 host2 sshd[108697]: Disconnected from invalid user ubuntu 45.230.150.7 port 50588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 05:58:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<TyhaVbZFKJYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 05:58:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<S7rmVbZFSMwu4ntB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 12 05:58:12 host2 sshd[109182]: Disconnected from invalid user deep 45.230.150.7 port 36760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2025-12-12 05:58:22 dovecot_login authenticator failed for (82.193.121.147.ipnet.ua) [82.193.121.147]:52633: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 12 05:58:25 host2 sshd[109305]: Disconnected from invalid user debian 103.139.59.214 port 58100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.145
country_id: 6252001
description:
2025-12-12 05:58:43 dovecot_login authenticator failed for ([70.174.167.145]) [70.174.167.145]:54353: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-12 05:59:19 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:40446: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Dec 12 05:59:25 host2 sshd[110179]: Disconnected from invalid user t128 156.239.45.43 port 48796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 12 05:59:39 host2 sshd[110315]: Disconnected from invalid user ubuntu 103.139.59.214 port 52774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.219.159
country_id: 3374766
description:
2025-12-12 05:59:47 dovecot_login authenticator failed for ([41.215.219.159]) [41.215.219.159]:58830: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 12 05:59:53 host2 sshd[110472]: Disconnected from invalid user test 43.154.195.142 port 48684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 05:59:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<RVqsWbZFFqgIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 12 06:00:36 host2 sshd[111169]: Disconnected from invalid user ai 43.154.195.142 port 55534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 06:01:03 host2 sshd[111416]: Disconnected from invalid user user 2.57.121.25 port 41297 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Dec 12 06:01:33 host2 sshd[112024]: Disconnected from invalid user teste2 156.239.45.43 port 49044 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 06:01:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@venee.lk>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<mPZ1YrZFVtg+PIdc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 12 06:02:28 host2 sshd[112610]: Disconnected from invalid user es 43.154.195.142 port 57712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Dec 12 06:03:09 host2 sshd[113271]: Disconnected from invalid user andrew 156.239.45.43 port 49228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 12 06:03:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Lxc3abZFRrQ+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 12 06:03:44 host2 sshd[113717]: Disconnected from invalid user ts 43.154.195.142 port 55194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 06:03:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<xjwNarZFyok+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 06:03:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<aY+barZFZJG8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 06:04:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<towrbbZF2NiLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 06:04:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<FQw6bLZFdztetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 06:04:36 dovecot_plain authenticator failed for (shookiens) [154.144.243.93]:40710: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-12 06:05:56 dovecot_plain authenticator failed for (rashave) [41.248.243.181]:37870: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-12 06:05:59 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (achabacks) [68.82.141.145]:56806: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 06:06:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<3KIgdLZF/oC8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-12 06:08:25 dovecot_login authenticator failed for (aes-static-137.135.17.125.airtel.in) [182.95.228.10]:39676: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 06:08:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<atgme7ZF7ImB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-12-12 06:08:40 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:39054: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 06:08:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<CXh1fLZFVqo+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 06:08:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<7x+/ebZFeJzAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 06:08:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<3UQIerZF/KGnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.123
country_id: 6252001
description:
2025-12-12 06:10:24 dovecot_login authenticator failed for wsip-184-191-250-123.fv.ks.cox.net [184.191.250.123]:39245: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-12 06:10:37 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:46024: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 12 06:10:45 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<1cgMg7ZFSKOLonQW>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.107
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.107: 250 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.177
country_id: 2215636
description:
2025-12-12 06:12:08 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:42852: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-12 06:12:25 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:44176: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-12 06:13:13 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (horbross) [98.203.34.136]:58648: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 06:13:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<7u9ZjLZFmKCkXGTY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec 12 06:13:24 host2 pure-ftpd[121834]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec 12 06:13:25 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS, session=<EW6SjLZF8uYzn+p2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 06:13:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<2ZhKjrZFyMIro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 06:15:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<8Z5blLZF0Ko+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 06:16:49 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (fundelle) [24.15.216.41]:38110: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-12 06:16:57 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:48942: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-12 06:17:48 dovecot_plain authenticator failed for (trogon) [65.20.147.45]:32956: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 06:17:09 host2 sshd[125059]: Disconnected from invalid user admin 2.57.121.112 port 61888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.175
country_id: 1733045
description:
2025-12-12 06:17:20 dovecot_login authenticator failed for ([49.124.155.175]) [49.124.155.175]:38274: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.98.71
country_id: 3144096
description:
2025-12-12 06:17:42 dovecot_login authenticator failed for (cm-46.212.98.71.get.no) [46.212.98.71]:35300: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-12 06:17:48 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:39190: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.90
country_id: 1269750
description:
2025-12-12 06:18:22 dovecot_login authenticator failed for ([182.95.20.43]) [182.95.228.90]:49542: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 06:18:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<bwTPn7ZFuI4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-12 06:18:54 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (aptar) [144.64.157.244]:45544: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.81.217
country_id: 6252001
description:
Dec 12 06:19:19 host2 sshd[127004]: Disconnected from invalid user test 66.116.81.217 port 45706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 12 06:19:35 host2 sshd[127153]: Disconnected from invalid user openstack 103.186.0.68 port 49704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 06:19:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<a3Abo7ZFlIRm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec 12 06:20:06 host2 sshd[127688]: Disconnected from invalid user ec2-user 103.76.120.90 port 33300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-12 06:20:28 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (spikins) [73.208.81.125]:47346: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.188.126.107
country_id: 2750405
description:
Dec 12 06:20:29 host2 sshd[128146]: Disconnected from invalid user alex 64.188.126.107 port 46666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 12 06:20:57 host2 sshd[128575]: Disconnected from invalid user seekcy 103.186.0.68 port 44398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.81.217
country_id: 6252001
description:
Dec 12 06:21:26 host2 sshd[129003]: Disconnected from invalid user testa 66.116.81.217 port 39812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 06:21:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Y26eqbZFlt6WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-12 06:21:47 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:60174: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 06:21:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<gif2qLZFwJpAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-12 06:22:15 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (unaredism) [73.197.194.98]:33070: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-12 06:22:44 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (celean) [68.52.119.193]:57040: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 06:22:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<tEshrrZFVLYuZXpm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.90
country_id: 1643084
description:
Dec 12 06:22:08 host2 sshd[129485]: Disconnected from invalid user test 103.76.120.90 port 47106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.101
country_id: 6252001
description:
2025-12-12 06:22:55 dovecot_login authenticator failed for ([70.174.168.101]) [70.174.168.101]:35568: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 12 06:22:57 host2 sshd[130047]: Disconnected from invalid user testa 103.186.0.68 port 56964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-12 06:24:06 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:47710: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.226.112
country_id: 3469034
description:
2025-12-12 06:24:05 dovecot_plain authenticator failed for 170-81-226-112.globoinfo.net.br ([89.116.164.85]) [170.81.226.112]:42301: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.215.12.224
country_id: 290557
description:
2025-12-12 06:23:52 dovecot_plain authenticator failed for ([89.116.164.85]) [31.215.12.224]:56986: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.40.125.148
country_id: 3469034
description:
2025-12-12 06:24:03 dovecot_plain authenticator failed for ([89.116.164.85]) [177.40.125.148]:60386: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.138.95.108
country_id: 3865483
description:
2025-12-12 06:24:06 dovecot_plain authenticator failed for host108.190-138-95.telecom.net.ar ([89.116.164.85]) [190.138.95.108]:44642: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-12 06:23:10 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:46664: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.49.242.200
country_id: 2510769
description:
2025-12-12 06:23:36 dovecot_login authenticator failed for 200.red-83-49-242.dynamicip.rima-tde.net [83.49.242.200]:43051: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.174.230.214
country_id: 3686110
description:
2025-12-12 06:23:52 dovecot_plain authenticator failed for ([89.116.164.85]) [181.174.230.214]:41207: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.82.208
country_id: 3996063
description:
2025-12-12 06:24:04 dovecot_plain authenticator failed for ([89.116.164.85]) [177.239.82.208]:1072: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.153.67.125
country_id: 3625428
description:
2025-12-12 06:23:53 dovecot_plain authenticator failed for ([89.116.164.85]) [190.153.67.125]:28165: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 06:23:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<QGmMsLZF4usI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 12 06:23:39 host2 sshd[130429]: Disconnected from invalid user user 103.186.0.68 port 51056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.190.44.42
country_id: 6252001
description:
2025-12-12 06:23:51 dovecot_plain authenticator failed for ([89.116.164.85]) [75.190.44.42]:41736: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.121.150
country_id: 6252001
description:
2025-12-12 06:24:15 dovecot_plain authenticator failed for ([89.116.164.85]) [70.112.121.150]:57207: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 12 06:24:19 host2 sshd[130794]: Disconnected from invalid user webuser 103.186.0.68 port 39538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.82.208
country_id: 3996063
description:
2025-12-12 06:24:10 dovecot_login authenticator failed for ([89.116.164.85]) [177.239.82.208]:1072: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.226.112
country_id: 3469034
description:
2025-12-12 06:24:12 dovecot_login authenticator failed for 170-81-226-112.globoinfo.net.br ([89.116.164.85]) [170.81.226.112]:42301: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 12 06:24:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@rehanseo.online>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<5ycfs7ZFwsg+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.54.124.252
country_id: 2264397
description:
2025-12-12 06:24:17 dovecot_plain authenticator failed for 252.124.54.77.rev.vodafone.pt ([89.116.164.85]) [77.54.124.252]:49271: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.178.98.82
country_id: 3865483
description:
2025-12-12 06:24:26 dovecot_plain authenticator failed for ([89.116.164.85]) [45.178.98.82]:59706: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.40.125.148
country_id: 3469034
description:
2025-12-12 06:24:10 dovecot_login authenticator failed for ([89.116.164.85]) [177.40.125.148]:60386: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.138.95.108
country_id: 3865483
description:
2025-12-12 06:24:13 dovecot_login authenticator failed for host108.190-138-95.telecom.net.ar ([89.116.164.85]) [190.138.95.108]:44642: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.89.42
country_id: 99237
description:
2025-12-12 06:24:16 dovecot_plain authenticator failed for ([89.116.164.85]) [130.255.89.42]:40642: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-12 06:25:20 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:54272: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 06:25:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<k6dZuLZFPrY+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 12 06:25:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shuf@dataesite.lk>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<3YwFuLZFEJ4+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 06:25:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ADZSuLZFDOqKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.60
country_id: 1210997
description:
2025-12-12 06:25:44 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.60]:56915: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Dec 12 06:26:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zw7iurZFesCTuYSK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.101.110
country_id: 6252001
description:
Dec 12 06:26:50 host2 pure-ftpd[132374]: (?@68.183.101.110) [INFO] New connection from 68.183.101.110


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 06:28:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<nIPZwLZFqp8+PIMh>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.172.57.122
country_id: 2635167
description:
Dec 12 06:27:34 host2 pure-ftpd[132896]: (?@167.172.57.122) [INFO] New connection from 167.172.57.122


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 06:29:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<EdcWxrZFQs9ntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 12 06:29:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<WH+uxrZFiro+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 12 06:29:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@nsteeleng.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<DgAIx7ZFqI8+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.44.70
country_id: 294640
description:
2025-12-12 06:30:00 dovecot_login authenticator failed for ([84.211.24.143]) [109.226.44.70]:58838: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 06:30:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<9VrDyLZFuM9npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-12 06:30:25 dovecot_login authenticator failed for ([182.74.216.122]) [182.74.12.86]:54698: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 06:30:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<sFs6yrZFgrNo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.94
country_id: 3144096
description:
2025-12-12 06:32:59 dovecot_login authenticator failed for (cm-84.211.13.94.get.no) [84.211.13.94]:40698: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.236
country_id: 2635167
description:
Dec 12 06:33:16 host2 dovecot[3988696]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.236, lip=66.85.158.91, TLS, session=<ErKP07ZFr6VX7LDs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-12 06:33:20 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:56740: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 06:33:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<hBgt1bZFIKSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 06:33:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<L+U71bZFaMkv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec 12 06:34:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@essenceceylontea.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<yaF92LZFSKw+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-12 06:35:42 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (stioning) [73.199.161.144]:47142: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.40
country_id: 1880251
description:
Dec 12 06:35:58 host2 sshd[138655]: Disconnected from invalid user openstack 45.78.205.40 port 59850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 06:36:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<e/JY3bZFjtQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 06:36:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hLAd3rZF65Z100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 06:36:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<Mv9t4LZFDJCl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-12-12 06:37:01 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:44548: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 06:37:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<BZsa47ZFnrU+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 06:37:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<Pahz47ZFaOoI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-12 06:37:21 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:37758: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.40
country_id: 1880251
description:
Dec 12 06:38:11 host2 sshd[140064]: Disconnected from invalid user portal 45.78.205.40 port 46688 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 12 06:39:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<tNRr6LZFaMU+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 06:39:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<dW+S6LZFUNbD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-12 06:41:47 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:59552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-12-12 06:42:15 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:41022: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-12-12 06:42:18 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:51915: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-12 06:42:40 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:49590: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-12-12 06:43:07 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:35496: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-12 06:43:23 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:47210: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 06:43:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<DFPn97ZF9OXO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.88
country_id: 2635167
description:
Dec 12 06:43:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.88, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jw2x+LZFp8+594lY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.196
country_id: 2635167
description:
Dec 12 06:43:37 host2 dovecot[3988696]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.196, lip=66.85.158.92, TLS, session=<Scqg+LZFece594nE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 06:44:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<GdgZ+rZFCuU+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-12 06:44:20 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (oddumbion) [24.98.45.238]:57672: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 06:44:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<8Fz6+7ZFDr2G0Wp/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 12 06:44:45 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<rEOp/LZFpYZX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.87
country_id: 2635167
description:
Dec 12 06:44:12 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.87, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9WSs+rZFD8K594lX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 06:44:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<RxvI+rZFwpvD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Dec 12 06:45:18 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<gQSl/rZFl4lX7LBd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-12 06:45:26 dovecot_plain authenticator failed for (nonle) [90.160.139.163]:48259: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.91
country_id: 2635167
description:
Dec 12 06:45:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.91, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<6DehALdFF6+594lb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 06:45:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<sVES/rZFrMk+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 06:46:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<rfLSAbdF1tPCBa8Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.86
country_id: 2635167
description:
Dec 12 06:46:25 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Az+bArdF49tX7LBW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 12 06:46:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shuf@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<JcwPA7dFmMA+PIcc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 12 06:46:58 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<0suaBLdFi4hX7LBO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 06:47:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<LkZyBbdFCtUu4ntB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.74
country_id: 2635167
description:
Dec 12 06:47:32 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.74, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<rWWXBrdF1bS594lK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.148
country_id: 1694008
description:
2025-12-12 06:47:48 dovecot_login authenticator failed for ([124.105.219.170]) [124.105.218.148]:40478: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 12 06:48:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<JEmRCLdFA+hX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.92
country_id: 2635167
description:
Dec 12 06:48:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.92, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<NjqNCrdFfaW594lc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-12 06:48:44 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:48142: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.216
country_id: 1733045
description:
2025-12-12 06:49:01 dovecot_login authenticator failed for ([49.124.152.216]) [49.124.152.216]:43930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-12 06:48:28 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (denonch) [69.142.126.37]:59608: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-12 06:48:31 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (unesizer) [67.172.54.29]:38140: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 06:49:06 host2 sshd[149707]: Disconnected from invalid user admin 62.60.131.157 port 47013 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 12 06:49:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ceylondigest.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<177IDLdF5og+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 06:49:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Ii5XDbdFeoWH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 06:50:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<BiMWEbdFSuEIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 06:50:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<Gh+pEbdFCsw+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-12 06:50:45 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (inparous) [174.59.253.88]:41638: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 12 06:51:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@essenceceylontea.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<nOhvE7dFuIc+PIdn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.14.236.224
country_id: 6252001
description:
Dec 12 06:51:52 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=128.14.236.224, lip=66.85.158.91, session=<pSQYFrdFtoCADuzg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.14.236.224
country_id: 6252001
description:
Dec 12 06:52:11 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=128.14.236.224, lip=66.85.158.91, session=<tWM/F7dF/puADuzg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.14.236.224
country_id: 6252001
description:
Dec 12 06:53:49 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=128.14.236.224, lip=66.85.158.92, session=<dKcbHbdFFIiADuzg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.150.20
country_id: 3686110
description:
Dec 12 06:54:03 host2 sshd[153996]: Disconnected from invalid user david 200.118.150.20 port 54684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Dec 12 06:53:23 host2 sshd[153355]: Disconnected from invalid user admin 200.118.150.20 port 42046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 12 06:53:28 host2 sshd[153416]: Disconnected from invalid user admin 42.200.66.164 port 35616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 06:53:33 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sulutale) [87.103.126.54]:12918: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.14.236.224
country_id: 6252001
description:
Dec 12 06:54:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=128.14.236.224, lip=66.85.158.92, session=<gIM1HrdFIoiADuzg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 06:54:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<RxKnH7dFp/detwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 12 06:55:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shuf@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<6ZJsI7dF4Oo+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 12 06:55:20 host2 sshd[155518]: Disconnected from invalid user git 156.241.128.48 port 57378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Dec 12 06:55:23 host2 sshd[155570]: Disconnected from invalid user dino 200.118.150.20 port 51740 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 12 06:55:23 host2 sshd[155568]: Disconnected from invalid user mk 42.200.66.164 port 45152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 06:56:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<Ieh2JbdF6KbAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 12 06:56:51 host2 sshd[156746]: Disconnected from invalid user ftpuser 156.241.128.48 port 55110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 12 06:57:31 host2 sshd[157200]: Disconnected from invalid user sftpuser 118.193.61.170 port 54318 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 06:57:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<a4KnK7dFPNy8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-12 06:58:03 dovecot_login authenticator failed for (nsg-corporate-126.60.187.122.airtel.in) [122.187.60.126]:38064: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.2.166.30
country_id: 2635167
description:
2025-12-12 06:59:05 dovecot_login authenticator failed for ([151.2.166.30]) [151.2.166.30]:58161: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 12 06:58:09 host2 sshd[157758]: Disconnected from invalid user admin 118.193.61.170 port 40800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-12 06:58:17 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:56724: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 06:58:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<qOmJLbdFSLW8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-12 06:58:39 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:48413: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 12 06:59:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@rehanseo.online>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<M/azMLdF9Nk+PIdq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 12 06:59:22 host2 sshd[158693]: Disconnected from invalid user ubuntu 118.193.61.170 port 36272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 07:00:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<v4J4NbdFHMCB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-12 07:02:05 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:42996: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 07:01:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<cyzGOLdFSqY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 07:02:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<6aoMO7dFvrGkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-12 07:02:34 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:42630: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 12 07:02:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<R268PbdFKoA+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 07:03:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<7e+8P7dFktwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 07:03:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<gQ0dQLdFOIkro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.33
country_id: 3865483
description:
Dec 12 07:04:08 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.181.97.33, lip=66.85.158.91, TLS, session=<I53iQLdFw6C+tWEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.94
country_id: 3277605
description:
Dec 12 07:04:26 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=188.246.73.94, lip=66.85.158.91, TLS, session=<v/kLQrdFZAy89kle>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-12 07:06:46 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (donthous) [68.40.189.43]:48334: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 07:07:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<o6oxT7dFKK1m1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-12 07:07:54 dovecot_login authenticator failed for ([125.19.173.202]) [152.52.236.2]:51106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-12 07:07:11 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:47106: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-12 07:07:27 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:47400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-12 07:07:39 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:48492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 07:08:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<kWZ5UrdFjMxAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-12-12 07:08:09 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:57524: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 07:08:24 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:34348: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 07:09:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<kLNXVbdF8pMv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.127
country_id: 99237
description:
2025-12-12 07:09:38 dovecot_login authenticator failed for ([65.20.251.127]) [65.20.251.127]:42850: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-12 07:09:59 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:41066: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 07:11:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<1le7WrdFfMEuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-12 07:12:43 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:59709: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 07:13:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<F/GWYrdF8IGKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 07:13:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<2RLJYrdFxJ6WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-12 07:13:54 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:57244: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-12 07:15:59 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (sechip) [98.193.112.85]:43890: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 07:15:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<KhjgardFyoA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 07:16:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<sp+BbbdFxqAI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 07:19:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<lMHVeLdFrs1ntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 07:19:09 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (elentist) [174.169.224.27]:46706: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.22
country_id: 3469034
description:
Dec 12 07:20:11 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.11.251.22, lip=66.85.158.91, TLS, session=<OU1DerdFLI+xC/sW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.31
country_id: 3469034
description:
Dec 12 07:20:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=186.209.250.31, lip=66.85.158.91, TLS, session=<Nph9e7dFA8C60fof>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 07:21:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<vd+GfrdFpNukXF7M>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.180.144.185
country_id: 6252001
description:
Dec 12 07:21:38 host2 pure-ftpd[175317]: (?@52.180.144.185) [INFO] New connection from 52.180.144.185


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 07:22:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<UFY5hLdFyIw+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 07:22:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<Mf9rhLdFfI1npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-12 07:23:11 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:49196: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-12 07:23:33 dovecot_plain authenticator failed for (accased) [24.187.213.29]:38292: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2025-12-12 07:23:41 dovecot_login authenticator failed for ([49.124.146.42]) [49.124.146.42]:43294: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-12 07:23:42 dovecot_login authenticator failed for ([161.8.241.121]) [161.8.241.121]:58639: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 07:23:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<rcQuiLdFxJwv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-12 07:23:58 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:47016: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 07:24:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Gvipi7dFRusv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 12 07:25:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<J8YJjbdFoMQ+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.42
country_id: 6252001
description:
2025-12-12 07:26:52 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:58307: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 07:27:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ev+ik7dF0ozD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 07:27:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<54CQlLdFXJSl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 07:28:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<+IOal7dF1qU+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 07:28:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<dQxCmbdFKskImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 07:28:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<anL+mbdFKIR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 07:29:33 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (deproceyd) [87.103.126.54]:23661: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 07:30:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<pZ72n7dFQsAI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.218
country_id: 798544
description:
Dec 12 07:30:44 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=178.216.25.218, lip=66.85.158.91, TLS, session=<2l8eoLdF6e2y2Bna>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.183
country_id: 953987
description:
Dec 12 07:31:06 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.33.183, lip=66.85.158.91, TLS, session=<pzQ8obdFi5xmQCG3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-12 07:31:50 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:37309: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-12 07:31:57 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:49786: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 07:32:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<eCq/pbdFzs/D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 12 07:32:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@dataesite.lk>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<NykSprdFfow+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-12 07:32:39 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:33408: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.16.64
country_id: 3175395
description:
Dec 12 07:33:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.43.16.64, lip=66.85.158.91, TLS, session=<nGo6qLdFrrW5KxBA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-12 07:32:09 dovecot_login authenticator failed for (cm-178.232.237.107.get.no) [178.232.237.107]:32936: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 07:33:20 host2 sshd[183366]: Disconnected from invalid user user 2.57.121.25 port 39059 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.138.83
country_id: 3469034
description:
Dec 12 07:33:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=177.85.138.83, lip=66.85.158.91, TLS, session=<P7NjqbdF2LexVYpT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-12 07:33:26 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:42830: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-12 07:33:37 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36183: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-12-12 07:33:49 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:52682: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-12 07:33:56 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (lulfuld) [68.83.181.181]:58784: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-12 07:34:23 dovecot_plain authenticator failed for (quineity) [102.53.15.56]:59965: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 07:34:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=</f/QrrdFUrPO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-12 07:34:43 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (miciate) [73.144.27.228]:37556: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 07:35:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<yEhrsbdFAKvCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-12 07:36:30 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:34717: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-12 07:36:49 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:36716: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 12 07:36:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<xPrVtrdFKOsu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-12 07:37:18 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:51618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-12 07:37:27 dovecot_plain authenticator failed for (chothhea) [102.88.10.10]:58844: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.211.219.73
country_id: 3175395
description:
2025-12-12 07:37:58 dovecot_login authenticator failed for host-62-211-219-73.pool62211.interbusiness.it ([185.196.221.176]) [62.211.219.73]:43234: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-12 07:38:13 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:36068: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-12 07:38:38 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:55671: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 12 07:38:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@kiriaswanu.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<+J7WvbdFPO4+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.54
country_id: 2186224
description:
2025-12-12 07:39:01 dovecot_login authenticator failed for ([121.73.162.54]) [121.73.162.54]:50406: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 07:39:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Aw+4v7dF3NmG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 12 07:40:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@kiriaswanu.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<w4a3w7dFXuw+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 12 07:41:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@essenceceylontea.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<rKhUx7dFwLI+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 07:41:54 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (quatown) [87.103.126.54]:61666: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 07:42:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<k0iOybdF1q8IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 12 07:42:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@nsteeleng.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<yFL4yrdFGK8+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 07:42:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<BJsey7dFuLqLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 07:44:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<0lOi0LdF/tDAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 07:44:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<qCfs0bdFEIynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 07:44:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<PKiV07dFVXhetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.252.202.6
country_id: 1643084
description:
Dec 12 07:45:35 host2 sshd[191326]: Disconnected from invalid user rahul 180.252.202.6 port 33814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.2
country_id: 6252001
description:
Dec 12 07:46:36 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.2, lip=66.85.158.92, TLS, session=<POHg2bdFyP7N0h8C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-12-12 07:47:37 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:41294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 12 07:48:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<w4/y3rdFNMw+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-12 07:48:06 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:38986: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 07:47:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<geq927dFKKaH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.252.202.6
country_id: 1643084
description:
Dec 12 07:48:39 host2 sshd[193301]: Disconnected from invalid user titus 180.252.202.6 port 38512 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 07:49:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<GOY65bdFFr28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 07:50:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<sE+K6LdFNLg+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 07:51:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<fGZ06bdF6oWkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 12 07:51:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<Fya96bdFyI4+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-12 07:51:20 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:36244: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-12 07:51:33 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:58818: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 07:52:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<P3OS7rdFDK2B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 07:52:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<JTeB8LdFLsu8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 07:53:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<22R58bdF0NY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 07:53:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<22Ca8bdF4IMro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 07:53:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<9jIB87dFnIcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 07:55:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<knZ5+bdFtohm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 07:55:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<93n8+bdFfM1AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-12 07:56:15 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:49451: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-12 07:56:29 dovecot_login authenticator failed for (dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:49388: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-12-12 07:56:52 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:43208: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-12 07:57:55 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:60243: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 07:57:13 host2 sshd[201563]: Disconnected from invalid user hadoop 154.73.168.229 port 49100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-12-12 07:57:34 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:46529: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 12 07:57:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<TiJRAbhFfN0+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 07:59:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<AqP3CLhFuOouZXpm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.162.42
country_id: 1562822
description:
Dec 12 07:59:55 host2 sshd[204906]: Disconnected from invalid user cy 152.32.162.42 port 55176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Dec 12 08:01:07 host2 sshd[206431]: Disconnected from invalid user l 211.24.41.44 port 40250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 08:02:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Qr3/ELhFEtuKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 08:01:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<iIHlDbhFmIY+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 08:01:14 host2 sshd[206535]: Disconnected from invalid user neo 154.73.168.229 port 49196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.162.42
country_id: 1562822
description:
Dec 12 08:01:44 host2 sshd[207140]: Disconnected from invalid user l 152.32.162.42 port 46068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.88
country_id: 6252001
description:
2025-12-12 08:01:55 dovecot_login authenticator failed for ([70.174.168.88]) [70.174.168.88]:37339: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 211.24.41.44
country_id: 1733045
description:
Dec 12 08:01:55 host2 sshd[207372]: Disconnected from invalid user admin 211.24.41.44 port 57310 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-12-12 08:02:45 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:53408: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-12 08:02:10 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:36346: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2025-12-12 08:02:17 dovecot_login authenticator failed for ([195.133.156.133]) [195.133.156.133]:34689: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 08:02:43 host2 sshd[208669]: Disconnected from invalid user cy 154.73.168.229 port 49296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.162.42
country_id: 1562822
description:
Dec 12 08:03:09 host2 sshd[209387]: Disconnected from invalid user xu 152.32.162.42 port 52564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Dec 12 08:03:14 host2 sshd[209464]: Disconnected from invalid user agent 211.24.41.44 port 59728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-12 08:03:17 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:54794: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 08:03:24 host2 sshd[209905]: Disconnected from invalid user xu 154.73.168.229 port 49352 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-12 08:03:31 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:35944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.73.168.229
country_id: 149590
description:
Dec 12 08:04:04 host2 sshd[210571]: Disconnected from invalid user wangbo 154.73.168.229 port 49406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.162.42
country_id: 1562822
description:
Dec 12 08:04:34 host2 sshd[210896]: Disconnected from invalid user oracle 152.32.162.42 port 34838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 08:04:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<IkyvGrhFatSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 08:05:07 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (wermoer) [87.103.126.54]:38444: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-12 08:08:52 dovecot_plain authenticator failed for (heabilik) [65.20.191.12]:55536: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 08:08:54 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (fairrums) [87.103.126.54]:49812: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 87.103.126.54
country_id: 2264397
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[87.103.126.54] [Authentication Database]=[mail] [Username]=[info@ksoft.lk] (10/10 failures) (blocked until [Sat Dec 13 02:38:52 2025 UTC/Sat Dec 13 08:08:52 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 08:09:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<340OKrhFPIMI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec 12 08:08:27 host2 sshd[213336]: Disconnected from invalid user seekcy 105.27.148.94 port 35146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 08:08:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<kQIPKLhF9rGkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 08:08:45 host2 sshd[213736]: Disconnected from invalid user  62.60.131.157 port 64507 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 08:09:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<7G1TK7hF5Ipntrtb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.215
country_id: 6252001
description:
Dec 12 08:10:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.215, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<iuQ3LrhFWNGi2JbX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.215
country_id: 6252001
description:
Dec 12 08:11:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.215, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<D0kmMrhFJPCi2JbX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec 12 08:11:21 host2 sshd[216374]: Disconnected from invalid user temp 102.220.23.233 port 52148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec 12 08:11:51 host2 sshd[216805]: Disconnected from invalid user test_user 105.27.148.94 port 34978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-12 08:14:06 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (untelly) [98.192.74.183]:41226: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec 12 08:13:16 host2 sshd[217995]: Disconnected from invalid user l 105.27.148.94 port 35642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec 12 08:14:16 host2 sshd[219337]: Disconnected from invalid user brandon 102.220.23.233 port 52922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.244.63
country_id: 3469034
description:
Dec 12 08:14:18 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=186.209.244.63, lip=66.85.158.91, TLS, session=<dcTgO7hF6dS60fQ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.208.119
country_id: 798544
description:
Dec 12 08:14:35 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=91.246.208.119, lip=66.85.158.91, TLS, session=<h1b7PLhFtaZb9tB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 08:14:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<hdXwPrhFju3D+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Dec 12 08:15:57 host2 sshd[220568]: Disconnected from invalid user guest 105.27.148.94 port 36908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-12 08:15:59 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:52466: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 08:15:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<8KclQbhFDq9npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-12 08:15:44 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:41171: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 08:15:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GwNAQrhFlJ8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 08:16:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<+TehQ7hFgspo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.90.45
country_id: 1643084
description:
Dec 12 08:17:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=202.155.90.45, lip=66.85.158.91, session=<G1ekSLhFZK7Km1ot>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.215
country_id: 6252001
description:
Dec 12 08:18:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.215, lip=66.85.158.92, TLS, session=<gu2OSrhFFvGi2JbX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.215
country_id: 6252001
description:
Dec 12 08:18:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.215, lip=66.85.158.92, TLS, session=<VqrrSrhFJumi2JbX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 08:19:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<QwzzULhFOpXD+hnW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 195.250.25.214
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[195.250.25.214] [Remote Port]=[38202] [Authentication Database]=[mail] [Username]=[test@essenceceylontea.com] (10/10 failures) (blocked until [Sat Dec 13 02:49:54 2025 UTC/Sat Dec 13 08:19:54 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 08:19:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<XymyTrhFItKl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-12-12 08:19:43 dovecot_plain authenticator failed for (hetuadives) [5.32.61.6]:55975: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-12 08:20:20 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (abled) [75.74.211.27]:37436: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-12 08:21:10 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:37544: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 08:21:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<sQWSVrhFntZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 08:21:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<+JLsVrhFZtcImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-12 08:21:57 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:51426: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-12 08:22:11 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:37502: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 08:23:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<yTloXLhFWtwI3tq7>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.222.218.187
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.222.218.187] [Remote Port]=[56410] [Authentication Database]=[mail] [Username]=[sales@essenceceylontea.com] (10/10 failures) (blocked until [Sat Dec 13 02:53:06 2025 UTC/Sat Dec 13 08:23:06 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 12 08:23:56 host2 sshd[225834]: Disconnected from invalid user image 41.58.186.130 port 51880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 08:24:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<SQhFYrhFxqLCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 08:25:05 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (phieste) [96.230.65.90]:37172: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 12 08:25:45 host2 sshd[227388]: Disconnected from invalid user deploy 41.58.186.130 port 42506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-12 08:27:10 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:37092: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 08:26:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<oNUIaLhFTJ/O7iqJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.241.128.91
country_id: 1819730
description:
Dec 12 08:26:28 host2 sshd[227727]: Disconnected from invalid user wpyan 156.241.128.91 port 44016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec 12 08:26:39 host2 sshd[227824]: Disconnected from invalid user ubuntu 103.16.202.187 port 24373 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 12 08:26:56 host2 sshd[228085]: Disconnected from invalid user steam 41.58.186.130 port 43190 [preauth]


