# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.76
country_id: 953987
description:
Dec 13 04:44:13 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.57.76, lip=66.85.158.91, TLS, session=<GL1PaslF+odmgTlM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.194.94
country_id: 1269750
description:
2025-12-13 04:43:21 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:50568: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-13 04:43:31 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (ytive) [73.224.171.101]:59490: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.193
country_id: 6252001
description:
Dec 13 04:45:57 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.193, lip=66.85.158.92, session=<x6qecclFY6hb5qjB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.196
country_id: 6252001
description:
Dec 13 04:46:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.196, lip=66.85.158.92, session=<pb7NcclFU9pb5qjE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.175
country_id: 732800
description:
Dec 13 04:46:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.255.215.175, lip=66.85.158.91, TLS, session=<cnIccclFZOy5/9ev>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-13 04:45:32 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (litaxe) [73.0.235.30]:57616: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.242
country_id: 6252001
description:
Dec 13 04:45:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.242, lip=66.85.158.92, session=<KM02cMlF4ZBb5qjy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.199
country_id: 6252001
description:
Dec 13 04:45:44 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.199, lip=66.85.158.92, session=<wFHgcMlF34lb5qjH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.67
country_id: 3469034
description:
Dec 13 04:46:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<designdpt>, method=PLAIN, rip=186.209.249.67, lip=66.85.158.91, TLS, session=<c8SIcslFn+260flD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-13 04:46:40 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (ferach) [73.195.211.98]:38356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-13 04:46:54 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:54946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 04:47:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<gzmjdclF/rml6L5h>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 04:47:58 host2 sshd[1203902]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-13 04:47:49 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:51184: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 04:49:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<HnWsfMlFaMY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 04:50:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<oxRHgMlF7NZnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-13 04:52:08 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:50504: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-13 04:51:40 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (fators) [174.161.27.82]:33278: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-13 04:51:46 dovecot_plain authenticator failed for (unial) [5.11.221.119]:34972: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.251
country_id: 1733045
description:
2025-12-13 04:51:46 dovecot_login authenticator failed for ([49.124.152.251]) [49.124.152.251]:45304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-13 04:51:56 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:43184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-13 04:52:19 dovecot_login authenticator failed for ([128.185.247.254]) [125.19.158.2]:32916: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 04:52:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<mtVHiclFhoTO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-13 04:53:06 dovecot_login authenticator failed for host-148-170-156-248.public.eastlink.ca [148.170.156.248]:41664: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 04:53:36 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:56290: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 04:56:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Ylwal8lF3MOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-13 04:58:16 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:33782: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.203
country_id: 6252001
description:
2025-12-13 04:57:34 dovecot_login authenticator failed for ([72.214.132.203]) [72.214.132.203]:58464: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 04:57:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pAmhm8lFuHEvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 04:57:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<k/w4nMlFxLxm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-13 04:58:01 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:48051: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-13 04:58:26 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:53202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 04:58:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<QHtKnslFpIdo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 04:59:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<OS44oMlFzOQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-13 04:59:05 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:33956: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 04:59:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ZaBioclFXNvD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 04:59:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Bx6qoclFUN6WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-13 05:01:13 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:59474: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 05:00:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<s8gJpslF6KO8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 05:01:32 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:53234: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 05:02:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<VxOXq8lFdEpetwuC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 13 05:03:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS handshaking: Connection closed, session=</QKfsMlF8gZChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 05:05:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<845ntslFYpfD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 05:05:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<uhH7tslFHqZAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 05:07:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<Qmp0vslFwpJntrtb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.138
country_id: 2635167
description:
Dec 13 05:07:57 host2 dovecot[3988696]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.138, lip=66.85.158.91, TLS, session=<6C1NwMlFtcO594mK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2025-12-13 05:07:58 dovecot_login authenticator failed for ([49.124.153.35]) [49.124.153.35]:46962: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-13 05:08:25 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:56486: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 05:08:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<rj1SwslF3v5100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-13 05:08:39 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (demens) [73.144.27.228]:55620: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-13 05:10:07 dovecot_plain authenticator failed for (ounde) [173.25.186.130]:54323: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-13 05:09:27 dovecot_plain authenticator failed for (fuseudo) [91.73.188.251]:55574: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 05:09:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<QbRex8lFfN2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 05:10:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<spjrx8lFqLnAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 05:10:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hm5CyslFWLKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-13 05:11:54 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:44584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-13 05:12:16 dovecot_login authenticator failed for ([149.54.62.62]) [149.54.62.62]:58854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-13 05:12:39 dovecot_plain authenticator failed for (amimatic) [65.20.143.159]:54764: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-13 05:13:05 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:58507: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-13 05:14:02 dovecot_login authenticator failed for (cm-178.232.126.146.get.no) [178.232.126.146]:49184: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 05:13:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<zSJ408lF/KY+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-13 05:14:00 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (psers) [24.1.200.187]:53846: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-13 05:15:44 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (plosisable) [73.53.254.168]:54550: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-13 05:16:43 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:53368: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.29
country_id: 6252001
description:
2025-12-13 05:16:50 dovecot_login authenticator failed for ([98.181.46.29]) [98.181.46.29]:39215: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-12-13 05:16:57 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:32779: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 05:16:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<WBWF4MlF/KLCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-13 05:17:02 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:57514: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:16:35 host2 sshd[1229361]: Disconnected from invalid user admin 103.39.243.15 port 38240 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 13 05:17:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<+Z2F4clFfqpog7HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 05:17:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<V63Z4clFgrQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-12-13 05:18:09 dovecot_login authenticator failed for (190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:51638: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.100.26.107
country_id: 1269750
description:
2025-12-13 05:18:25 dovecot_login authenticator failed for (as135139-skylinkfibernet.com) [27.100.26.107]:32936: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 05:20:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<I+WV68lFQt6kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-13 05:19:38 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (tereck) [73.183.74.177]:47256: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 05:20:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<YqmM7slF/uoImxNM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:21:08 host2 sshd[1231782]: Disconnected from invalid user nima 103.39.243.15 port 53616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:21:47 host2 sshd[1232036]: Disconnected from invalid user supermaint 103.39.243.15 port 37774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-12-13 05:22:09 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:45343: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-13 05:22:31 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:48150: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-13 05:23:29 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:51585: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-13 05:23:36 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:47338: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 05:25:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<BdN3/8lFKqvCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 05:25:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<lsvA/8lF6My8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 05:26:56 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (dicapped) [73.197.236.163]:35286: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 05:28:54 host2 sshd[1235492]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.40
country_id: 6252001
description:
Dec 13 05:28:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.40, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Cs4tCspFPcOTuYQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 05:28:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<svElCspFHtqB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-13 05:29:11 dovecot_plain authenticator failed for (joidae) [24.105.248.218]:32914: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.184
country_id: 6252001
description:
Dec 13 05:30:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EMhvEcpF9dzG6xi4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 05:30:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<BbtwEcpFOpYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 05:31:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<80wkE8pFqoA+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 05:31:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<P+n0FcpFQIqH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 05:32:24 host2 sshd[1237147]: Disconnected from invalid user user 2.57.121.25 port 6913 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 05:32:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<rY0YGcpFxJMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 05:33:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<VsJ0GspF3qMuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-13 05:33:16 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:54406: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-13 05:33:28 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:60088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.16
country_id: 6252001
description:
2025-12-13 05:33:52 dovecot_login authenticator failed for wsip-184-191-243-16.fv.ks.cox.net [184.191.243.16]:45001: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 05:34:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<x0+uHspF7tsro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-13 05:34:46 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:37642: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 05:35:16 host2 sshd[1238877]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 52780


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 05:37:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<LrcOKMpFco0IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-13 05:37:11 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:33218: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-13 05:37:44 dovecot_login authenticator failed for ([128.185.247.254]) [125.19.158.2]:51044: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-13 05:38:55 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (consicae) [73.213.237.28]:56368: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-13 05:39:16 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (ersheed) [2.135.31.74]:49570: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 05:40:07 host2 sshd[1241211]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 54961


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 05:40:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<j8AnNcpFoJ2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-13 05:41:39 dovecot_plain authenticator failed for (giess) [12.182.125.210]:40895: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-13 05:41:57 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:55100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-13 05:42:09 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:53977: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 05:41:33 host2 sshd[1241914]: Disconnected from invalid user admin 2.57.121.112 port 45591 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-13 05:42:24 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:41588: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-12-13 05:42:54 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:36217: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-13 05:43:24 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:38960: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-13 05:44:04 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:55677: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 05:44:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<3suPRMpFNJCl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 05:45:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<tPLTRMpF6LyLOxGe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:45:06 host2 sshd[1243913]: Disconnected from invalid user user 128.199.155.236 port 50276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 05:45:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<MvecRspFMthnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:47:34 host2 sshd[1245521]: Disconnected from invalid user user 34.58.124.191 port 34738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:47:43 host2 sshd[1245576]: Disconnected from invalid user user 128.199.155.236 port 38292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-13 05:48:37 dovecot_plain authenticator failed for (apping) [92.62.243.175]:54460: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:48:43 host2 sshd[1246019]: Disconnected from invalid user spectrum 34.58.124.191 port 36694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:49:05 host2 sshd[1246285]: Disconnected from invalid user deploy 128.199.155.236 port 59554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-13 05:48:19 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:46062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 05:48:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Rl9dUcpFiJA+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-13 05:48:41 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:51751: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:49:16 host2 sshd[1246473]: Disconnected from invalid user mikrotik 34.58.124.191 port 37394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-13 05:49:21 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:51343: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-13 05:49:35 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:50900: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:51:05 host2 sshd[1247514]: Disconnected from invalid user roots 128.199.155.236 port 39388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-13 05:50:35 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (coffic) [24.127.53.61]:53616: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 05:50:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lkvfWcpF4OrO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:51:29 host2 sshd[1247690]: Disconnected from invalid user kserge 34.58.124.191 port 59504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:52:13 host2 sshd[1248051]: Disconnected from invalid user chrism 101.47.162.24 port 40354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 05:52:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<bYWEYMpFLsxm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:53:19 host2 sshd[1248535]: Disconnected from invalid user testing 101.47.162.24 port 42126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.238.68
country_id: 6252001
description:
2025-12-13 05:54:13 dovecot_login authenticator failed for ([75.110.238.68]) [75.110.238.68]:46292: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.60
country_id: 1880251
description:
Dec 13 05:54:15 host2 sshd[1249098]: Disconnected from invalid user nmr 45.78.201.60 port 49466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 05:54:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<6EJJZspF4O3D+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:54:29 host2 sshd[1249480]: Disconnected from invalid user ubuntu 101.47.162.24 port 45594 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.247.79
country_id: 2921044
description:
Dec 13 05:54:45 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=209.38.247.79, lip=66.85.158.92, session=<aGSvZ8pFKszRJvdP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 05:54:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<V+qoZ8pFEl8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-13 05:54:48 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:33528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 05:55:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<H8lUacpF1NCG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 05:56:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<0hnGbspFWLBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 05:56:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<WNX3bcpFHMi8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-13 05:58:15 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:51828: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.145.35
country_id: 2750405
description:
Dec 13 05:57:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.145.35, lip=66.85.158.92, TLS: Connection closed, session=<wveyccpFHtChI5Ej>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.182.92
country_id: 6252001
description:
Dec 13 05:57:48 host2 dovecot[3988696]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=165.154.182.92, lip=66.85.158.92, TLS, session=<KD2YcspFeuKlmrZc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.92
country_id: 6252001
description:
Dec 13 05:57:48 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.182.92, lip=66.85.158.92, session=<3yqWcspFvOGlmrZc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-13 05:57:58 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (hiactal) [98.40.101.10]:50050: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.57.97.103
country_id: 2510769
description:
2025-12-13 05:58:02 dovecot_login authenticator failed for 103.red-83-57-97.dynamicip.rima-tde.net [83.57.97.103]:38481: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 05:58:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<6CYEdcpFvNs+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 05:58:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<kz1mdspFIr2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:00:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<QBxoe8pF5OXD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.60
country_id: 1880251
description:
Dec 13 06:00:54 host2 sshd[1252212]: Disconnected from invalid user mikrotik 45.78.201.60 port 47002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 06:01:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<5T47gcpFGKlAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 06:01:18 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:43116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-12-13 06:01:44 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:4961: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 06:01:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<hbuIgMpFgGRetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:03:04 host2 sshd[1253004]: Disconnected from invalid user wangjia 152.32.129.236 port 60276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-13 06:02:20 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:55283: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:02:25 host2 sshd[1252760]: Disconnected from invalid user zihan 152.32.129.236 port 40722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-13 06:02:37 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (oueitting) [73.183.74.177]:52230: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-13 06:03:11 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:38388: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-13 06:02:16 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:41987: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-13 06:02:22 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:49223: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-13 06:02:49 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:37872: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:04:16 host2 sshd[1253668]: Disconnected from invalid user kkadmin 152.32.129.236 port 43514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-13 06:04:49 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (hoodism) [24.1.200.187]:60360: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 06:05:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<EQVijspFytOKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-13 06:06:33 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:50387: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-13 06:06:39 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:46078: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 06:07:09 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:43069: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-13 06:06:28 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:52012: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 06:06:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<KCOxkcpF+C9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-13 06:06:46 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:50213: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.3.138
country_id: 1605651
description:
2025-12-13 06:06:56 dovecot_login authenticator failed for ([110.49.3.138]) [110.49.3.138]:51602: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 06:06:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<kuQ3k8pFvr3AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.3
country_id: 1733045
description:
2025-12-13 06:07:45 dovecot_login authenticator failed for ([49.124.153.3]) [49.124.153.3]:49972: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-13 06:12:58 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:60361: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-13 06:12:25 dovecot_login authenticator failed for (cm-178.232.153.184.get.no) [178.232.153.184]:38336: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-13 06:12:46 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:37190: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 06:12:49 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65466: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.50
country_id: 1269750
description:
2025-12-13 06:13:24 dovecot_login authenticator failed for ([128.185.212.50]) [128.185.212.50]:36006: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-13 06:13:58 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (perge) [73.213.237.28]:51720: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-13 06:14:02 dovecot_plain authenticator failed for (tracented) [38.248.111.238]:56686: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 06:14:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<vjF8rspFYO0I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.20
country_id: 690791
description:
Dec 13 06:16:09 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=176.103.7.20, lip=66.85.158.91, TLS, session=<cltBs8pFu5awZwcU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.102
country_id: 953987
description:
Dec 13 06:16:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.47.102, lip=66.85.158.91, TLS, session=<QwNftMpFx4dmQC9m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Dec 13 06:17:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=<mm3CucpFIuGnXpIx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 06:17:47 dovecot_plain authenticator failed for (catirize) [154.144.243.93]:41614: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 06:17:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<6a1cuMpFwqSkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 06:20:21 host2 sshd[1261486]: Disconnected from invalid user  62.60.131.157 port 17986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-13 06:21:09 dovecot_plain authenticator failed for (gless) [5.11.221.119]:58934: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-13 06:22:13 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:45046: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 06:22:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<R5u3y8pFfqwImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 06:23:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ZykuzcpFjoa8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 06:22:26 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:34890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 06:24:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Mt780cpF7urCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 06:25:25 dovecot_plain authenticator failed for (jicaphy) [154.144.243.93]:37716: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-12-13 06:26:15 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:33666: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2025-12-13 06:26:29 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:47282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 06:28:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<zD1T4MpFGMQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 06:28:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<9FQf4MpFyLOB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 06:28:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<PgQq4MpFXLcuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 06:30:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<O/Cd5cpFNIQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 06:30:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<awiU58pF0tYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-13 06:31:14 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:51842: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-13 06:31:25 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:43198: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-13 06:31:29 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:40284: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-13 06:31:48 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:34783: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.35.3
country_id: 1269750
description:
Dec 13 06:32:01 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.118.35.3, lip=66.85.158.91, TLS, session=<QBGj68pFtYgtdiMD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.37
country_id: 3865483
description:
Dec 13 06:32:23 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=186.124.218.37, lip=66.85.158.91, TLS, session=<58oZ7cpFkNW6fNol>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 06:32:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<jOkB8MpFaM0+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-12-13 06:33:36 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:1195: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 06:34:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<yBsr9spFauKH6yFP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.13
country_id: 798549
description:
Dec 13 06:34:46 host2 pure-ftpd[1270323]: (?@85.217.149.13) [INFO] New connection from 85.217.149.13


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 06:36:51 host2 sshd[1271580]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 06:36:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<tWmZ/MpFJIo+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-13 06:37:42 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:55245: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-12-13 06:38:19 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:51728: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 06:38:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<49VIA8tFdMM+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 06:38:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<mjLUA8tFAswIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-13 06:38:32 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:52357: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.87
country_id: 6252001
description:
Dec 13 06:40:40 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.87, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5OXrC8tFJcbN0h9X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 06:41:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<jk1VDstFROlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.40
country_id: 3469034
description:
Dec 13 06:42:17 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.246.40, lip=66.85.158.91, TLS, session=<bnhyEMtFwoa60fYo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.183
country_id: 798544
description:
Dec 13 06:42:34 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.232.165.183, lip=66.85.158.91, TLS, session=<bsy7EctF1bZb6KW3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 06:44:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<k7FTGMtF5plo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 06:44:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<BOJlGMtF+OKl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.35
country_id: 3865483
description:
Dec 13 06:44:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.251.35, lip=66.85.158.91, TLS, session=<su7OF8tFhrSzAPsj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.37
country_id: 933860
description:
Dec 13 06:44:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=41.216.213.37, lip=66.85.158.91, TLS, session=<rMg3GctFUrMp2NUl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 06:44:46 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (crize) [73.197.236.163]:33918: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-13 06:45:49 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (lacon) [73.0.235.30]:39816: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-13 06:47:44 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:33814: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-13 06:47:55 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:53775: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 06:47:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<TSmqJctFjJZm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-13 06:48:00 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:56782: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-13 06:48:07 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:58686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 06:48:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<lG36J8tFEsdntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 06:49:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KJJgK8tF9tSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 06:49:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<4f8pLMtF8MrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:49:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<2KpkLMtFNNvD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.120.212
country_id: 6252001
description:
Dec 13 06:49:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=13.89.120.212, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<BmosLctFqM0NWXjU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 06:52:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<ZuljNMtFLOE+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 06:52:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<f9ClNMtFPC8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-12-13 06:52:41 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:49042: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.226.80.143
country_id: 6252001
description:
2025-12-13 06:54:56 dovecot_login authenticator failed for dhcp-011-143.coonvalley.mwt.net ([91.126.40.196]) [216.226.80.143]:57172: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 06:54:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<xKjZPstFfL68pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 06:55:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<XSeSQMtFOoaG0Wp/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.220.172.154
country_id: 6252001
description:
[2025-12-13 06:55:41 +0530] info [whostmgrd] 24.220.172.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:55:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<MVuVQctFUOXD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 06:56:06 host2 sshd[1283467]: Disconnected from invalid user  62.60.131.157 port 28045 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-13 06:57:12 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:62456: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-13 06:57:59 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:40950: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-13 06:57:34 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:41919: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-13 06:57:42 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:59122: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 13 06:58:31 host2 dovecot[1284827]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 06:58:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<S4h6TMtF/t2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 06:58:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<LgH9TMtFpqtAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 07:01:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<JGzsVMtF4BVetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 07:01:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<stixVctFTLiKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-13 07:03:56 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:47696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 07:04:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<qRSzX8tFqNrAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 07:04:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<huQOYctFLDN100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-13 07:05:06 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (crophioted) [81.225.30.107]:56290: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-13 07:04:17 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:41821: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.1.17
country_id: 6252001
description:
Dec 13 07:06:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.1.17, lip=66.85.158.91, session=<x//eZstF7KAUowER>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.31
country_id: 6252001
description:
Dec 13 07:05:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.125.31, lip=66.85.158.92, session=<phVcZMtFtKENWX0f>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-13 07:07:57 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (matershaus) [81.225.30.107]:35841: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 07:09:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<pJkRdMtFZrykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 07:10:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<obeYdstFsLk+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-13 07:13:32 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:53447: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 07:13:48 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:36362: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-12-13 07:16:11 dovecot_plain authenticator failed for (zierlity) [5.32.61.6]:49317: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-13 07:17:48 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:50686: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-13 07:18:19 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:56524: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.81.222
country_id: 732800
description:
Dec 13 07:20:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=109.107.81.222, lip=66.85.158.91, TLS, session=<7SKimstFCcBta1He>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.44.68
country_id: 2395170
description:
Dec 13 07:20:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=154.127.44.68, lip=66.85.158.91, TLS, session=<t8O7mstFSbyafyxE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.165
country_id: 3865483
description:
Dec 13 07:20:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers>, method=PLAIN, rip=179.0.252.165, lip=66.85.158.91, TLS, session=<CdbCmstFVsOzAPyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.104
country_id: 953987
description:
Dec 13 07:20:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.51.104, lip=66.85.158.91, TLS, session=<Qg9omctFN5dmgTNo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.12.160
country_id: 2300660
description:
Dec 13 07:20:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.139.12.160, lip=66.85.158.91, TLS, session=<uERrmctFg6Apiwyg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.27
country_id: 3865483
description:
Dec 13 07:20:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=181.191.223.27, lip=66.85.158.91, TLS, session=<BJqBmctFOd61v98b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 07:21:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<TeQfnctF0rC8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-13 07:21:48 dovecot_plain authenticator failed for (genaty) [154.146.240.123]:60982: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.200
country_id: 3865483
description:
Dec 13 07:22:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.251.200, lip=66.85.158.91, TLS, session=<hk/lnstFl4KzAPvI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-13 07:22:27 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:44851: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.142.125
country_id: 99237
description:
Dec 13 07:22:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=65.20.142.125, lip=66.85.158.91, TLS, session=<3mRgoMtFyoRBFI59>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-13 07:22:54 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:55028: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-13 07:23:00 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:60188: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-13 07:24:06 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:47460: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-13 07:23:10 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:56464: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 07:23:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<k6q/pMtFALzCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-13 07:23:38 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:38136: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-13 07:24:02 dovecot_login authenticator failed for ([182.95.178.206]) [182.95.178.206]:42324: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2025-12-13 07:24:27 dovecot_login authenticator failed for 236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:55680: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 07:24:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<OStvqMtFYNsuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 07:24:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<lb6HqctFtMSLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 07:25:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<YKjUq8tFqsQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 07:26:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<RWg3r8tFGoYv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-12-13 07:26:33 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:51133: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 07:26:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<r0gfsMtF0pUro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-12-13 07:26:56 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:37192: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-13 07:26:57 dovecot_login authenticator failed for (BUc5y4RL) [178.16.54.97]:62517: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 07:27:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<9PABsstFwrAI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-13 07:27:21 dovecot_login authenticator failed for (T1aLkiKv) [178.16.54.97]:55810: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 07:27:27 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:46818: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 13 07:27:40 host2 sshd[1301764]: Disconnecting authenticating user root 82.67.140.251 port 41969: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 13 07:27:40 host2 sshd[1301764]: error: maximum authentication attempts exceeded for root from 82.67.140.251 port 41969 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 13 07:27:49 host2 sshd[1301845]: Disconnecting invalid user admin 82.67.140.251 port 42897: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 07:28:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<xhwktstFJNY+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-13 07:28:32 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:53504: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 07:28:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<ha0At8tFYIeB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.72
country_id: 6252001
description:
2025-12-13 07:28:47 dovecot_login authenticator failed for ([98.185.120.72]) [98.185.120.72]:34747: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-13 07:28:09 dovecot_login authenticator failed for (MvNgmbW) [178.16.54.97]:65105: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-13 07:29:30 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:32929: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 07:29:43 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:58495: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 07:31:49 host2 sshd[1303917]: Disconnected from invalid user  62.60.131.157 port 12882 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 07:34:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<iTXIzMtFlt+H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 07:34:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<rvSxzctFGrg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-13 07:36:21 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:61209: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.107
country_id: 6252001
description:
2025-12-13 07:36:44 dovecot_login authenticator failed for ([70.174.168.107]) [70.174.168.107]:46388: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 07:37:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<wZwd18tFeIpnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-13 07:38:29 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:54998: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.47
country_id: 6252001
description:
Dec 13 07:38:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.118.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xzke28tFuOusynYv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-12-13 07:38:44 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:34918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 07:40:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<aqkG4stFhJ0IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-13 07:41:56 dovecot_plain authenticator failed for (pstet) [5.31.15.108]:37766: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.191
country_id: 1733045
description:
2025-12-13 07:42:53 dovecot_login authenticator failed for ([49.124.148.191]) [49.124.148.191]:52830: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 07:42:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<F0hn6MtFHKFm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 07:42:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<fUdk6MtFVoOl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-13 07:42:28 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:42746: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 07:45:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<bdYC8stF0rBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 07:45:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<cPGd8stF9LDD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-13 07:46:12 dovecot_plain authenticator failed for (gered) [24.187.213.29]:33124: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-13 07:48:07 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:18726: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 13 07:47:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<0ETU+ctF9p/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-13 07:47:30 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:58982: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 13 07:47:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nR0z+8tF6A9ChJl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-13 07:47:49 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:60088: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-13 07:48:24 dovecot_login authenticator failed for (nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:33474: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 07:48:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<g5c1/stF/K/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-13 07:48:43 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:47723: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-13 07:48:54 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:43358: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 07:49:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PEkVAcxFpHovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 07:50:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<zl+/BcxFhJm8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 07:51:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<SSa8B8xF2LbD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-13 07:51:29 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (unducks) [73.213.236.66]:59540: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 13 07:51:43 host2 sshd[1315895]: Disconnected from invalid user user 43.155.21.198 port 52436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-12-13 07:53:25 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:50753: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-13 07:54:01 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:38784: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 07:54:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<agU4FcxFRuiG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.248
country_id: 6252001
description:
2025-12-13 07:55:03 dovecot_login authenticator failed for ([98.185.121.248]) [98.185.121.248]:44997: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-13 07:54:21 dovecot_login authenticator failed for ([125.18.210.161]) [182.95.119.118]:41988: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.113
country_id: 6252001
description:
2025-12-13 07:54:46 dovecot_login authenticator failed for wsip-184-191-250-113.fv.ks.cox.net [184.191.250.113]:35823: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2025-12-13 07:55:22 dovecot_login authenticator failed for ([182.95.52.170]) [182.95.52.170]:59752: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-13 07:55:30 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (epted) [73.129.57.71]:40954: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 07:55:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<cymBF8xF7MNAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 13 07:55:54 host2 sshd[1319059]: Disconnected from invalid user ali 43.155.21.198 port 42660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 07:56:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<8ASbG8xFVIeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-13 07:56:47 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (trane) [73.183.74.177]:48892: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 07:57:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Q08gH8xF3ryWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.168
country_id: 6252001
description:
Dec 13 07:59:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.168, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<rrgEJ8xFu86i2JWo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.168
country_id: 6252001
description:
Dec 13 08:00:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.168, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<MMkOKsxFpO+i2JWo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 08:00:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<v9X4KMxFzLNetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 08:01:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<H8DXK8xF0qjAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 08:02:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<elrmMMxFoph100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-13 08:03:33 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:38436: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 08:03:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<OZouM8xFFKSkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-13 08:03:18 dovecot_login authenticator failed for (nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:56882: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.168
country_id: 6252001
description:
Dec 13 08:07:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.168, lip=66.85.158.91, TLS, session=<W+7iQMxFtPyi2JWo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.214
country_id: 1733045
description:
2025-12-13 08:07:10 dovecot_login authenticator failed for ([49.124.149.214]) [49.124.149.214]:56350: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-13 08:07:51 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:42810: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 08:08:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<dAVXR8xFqIgI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-13 08:10:36 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (morroly) [24.1.200.187]:55376: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-13 08:10:51 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (copalo) [98.204.134.124]:51982: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.77.184
country_id: 1269750
description:
2025-12-13 08:12:08 dovecot_login authenticator failed for (static.ftth.bgn.117.211.77.184.bsnl.in) [117.211.77.184]:32908: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-12-13 08:12:10 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:35087: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-12-13 08:12:20 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:60091: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-13 08:12:46 dovecot_login authenticator failed for ([161.8.241.121]) [161.8.241.121]:41758: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 08:13:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<N+12WMxFiKA+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-13 08:13:52 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:54636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-12-13 08:14:12 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:63083: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.33.198
country_id: 226074
description:
Dec 13 08:14:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=196.0.33.198, lip=66.85.158.91, TLS, session=<XWaHWsxFus3EACHG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.93
country_id: 3175395
description:
Dec 13 08:14:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.93, lip=66.85.158.91, TLS, session=<iSvAW8xF7bq5D6td>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-13 08:19:02 dovecot_login authenticator failed for (nsg-static-033.187.72.182.airtel.in) [182.95.228.110]:39674: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-12-13 08:18:32 dovecot_login authenticator failed for (nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:59170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-12-13 08:18:45 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:58009: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 08:19:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<nzeobMxFBIe8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-13 08:19:47 dovecot_plain authenticator failed for (tably) [185.214.169.10]:41493: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 08:20:12 host2 sshd[1335456]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 51329


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 08:20:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Ng12cMxFJpAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 08:21:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<CM4Kc8xFKr3CBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-13 08:21:28 dovecot_plain authenticator failed for (cieste) [12.182.125.210]:60700: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 08:22:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<u0Lcd8xFcKAro2np>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.222.218.187
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.222.218.187] [Remote Port]=[39418] [Authentication Database]=[mail] [Username]=[admin@essenceceylontea.com] (13/10 failures) (blocked until [Sun Dec 14 02:54:16 2025 UTC/Sun Dec 14 08:24:16 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 08:24:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<puhefsxF+pkI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 08:24:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<W5ZHf8xFOLYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 08:27:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<P3PjisxFIJ+B4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-13 08:29:04 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:37671: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-13 08:28:22 dovecot_login authenticator failed for (nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:43870: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 08:28:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<a4wLjcxF2Kxo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.255.38.183
country_id: 6252001
description:
Dec 13 08:28:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=38.255.38.183, lip=66.85.158.91, session=<E4p/jcxFrvgm/ya3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 08:29:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<6hZGkcxFcI4ImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 08:29:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Z8rlj8xFNt6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.48.24
country_id: 2963597
description:
Dec 13 08:30:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.203.48.24, lip=66.85.158.91, TLS, session=<bnZvksxFr5ElyzAY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.168
country_id: 3469034
description:
Dec 13 08:30:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=187.120.72.168, lip=66.85.158.91, TLS, session=<pmGUk8xFtrm7eEio>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-13 08:31:47 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:46618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-13 08:32:12 dovecot_login authenticator failed for (static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:50646: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-13 08:32:35 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:37166: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-13 08:32:57 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:42778: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 08:33:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<ROY+oMxFEI9npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 08:33:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<fqLmoMxFAtaH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 08:35:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<DmcapsxFytaB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-13 08:35:44 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (uppred) [73.129.57.71]:53658: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 08:35:14 host2 sshd[1343654]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 52509


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 08:36:07 host2 sshd[1344086]: Disconnected from invalid user admin 2.57.121.112 port 54279 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-13 08:36:30 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (inexialuta) [71.224.169.28]:43842: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 08:36:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<JFVyq8xFtppm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-13 08:38:05 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:38423: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-13 08:37:20 dovecot_login authenticator failed for ([122.187.168.129]) [125.19.163.58]:36910: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 08:37:37 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:39230: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.170.21.223
country_id: 6252001
description:
2025-12-13 08:38:00 dovecot_login authenticator failed for (75-170-21-223.rcmt.centurylink.net) [75.170.21.223]:43260: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-13 08:38:35 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:51623: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-13 08:38:35 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:40354: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-13 08:38:47 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:54860: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-13 08:38:50 dovecot_login authenticator failed for (nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:50264: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.195
country_id: 3469034
description:
Dec 13 08:40:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=191.240.96.195, lip=66.85.158.91, TLS, session=<H5aruMxFmsm/8GDD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 08:41:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<+sVuusxFdKBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 08:40:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<n51YuMxF7q2l6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.26
country_id: 3469034
description:
Dec 13 08:40:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.247.26, lip=66.85.158.91, TLS, session=<EdV/t8xFGsG60fca>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 08:40:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<UgyGuMxFNJ3D+hnW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 195.250.25.214
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[195.250.25.214] [Remote Port]=[40244] [Authentication Database]=[mail] [Username]=[no-reply@lankaherbalsolutions.com] (12/10 failures) (blocked until [Sun Dec 14 03:10:31 2025 UTC/Sun Dec 14 08:40:31 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 08:43:06 host2 sshd[1347648]: Disconnected from invalid user  62.60.131.157 port 11960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.223.86
country_id: 798544
description:
Dec 13 08:42:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=213.92.223.86, lip=66.85.158.91, TLS, session=<qaxav8xFTLTVXN9W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.79
country_id: 2510769
description:
Dec 13 08:43:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=46.39.212.79, lip=66.85.158.91, TLS, session=<hK5vwMxF3rAuJ9RP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 08:43:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<q0SawsxFhuwIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-13 08:43:32 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:59200: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-13 08:43:50 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:45523: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-13 08:43:56 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:39397: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-13 08:44:14 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:43446: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-13 08:44:28 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:43029: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-13 08:44:39 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:46470: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-13 08:44:46 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (amimatic) [71.41.202.12]:50590: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.108.185
country_id: 3175395
description:
Dec 13 08:44:51 host2 sshd[1349342]: Disconnected from invalid user wy 156.54.108.185 port 37166 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.108.185
country_id: 3175395
description:
Dec 13 08:45:25 host2 sshd[1350768]: Disconnected from invalid user geo 156.54.108.185 port 43393 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 13 08:45:54 host2 sshd[1351295]: Disconnected from invalid user pal 162.223.91.130 port 45530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 08:45:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<4A7fy8xFhqy8pkxr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 13 08:47:00 host2 sshd[1351805]: Disconnected from invalid user admin 162.223.91.130 port 42808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 08:47:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Fs6nz8xFehIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 08:47:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<S/m/z8xFEO7O7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 08:46:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ZLF8zcxFNJfD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 13 08:46:27 host2 sshd[1351589]: Disconnected from invalid user debian 162.223.91.130 port 58232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 13 08:48:05 host2 sshd[1352341]: Disconnected from invalid user elasticsearch 162.223.91.130 port 39754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 13 08:48:13 host2 sshd[1352415]: Disconnected from invalid user gamer 62.219.172.50 port 53760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 08:49:36 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (diores) [98.227.25.115]:60218: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 08:49:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<fPL52cxF+K8+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.219.172.50
country_id: 294640
description:
Dec 13 08:50:25 host2 sshd[1353646]: Disconnected from invalid user dev 62.219.172.50 port 43896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 13 08:51:29 host2 sshd[1354118]: Disconnected from invalid user zxl 62.219.172.50 port 57818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.88.228.7
country_id: 3017382
description:
Dec 13 08:51:33 host2 sshd[1354159]: Disconnected from invalid user john 166.88.228.7 port 49026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 08:52:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<6Vvk4cxFys6KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 08:52:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<nqYk4sxFTuRAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.157
country_id: 6252001
description:
Dec 13 08:53:11 host2 sshd[1354912]: Disconnected from invalid user admin 108.85.73.157 port 51306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-13 08:53:34 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:56598: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 08:54:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<feOl6MxFcuWG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.123.148
country_id: 1819730
description:
2025-12-13 08:54:05 dovecot_login authenticator failed for (161.81.123.148.hk.chinamobile.com) [161.81.123.148]:60624: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:54:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<iGEm68xFXJQDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 08:54:57 host2 sshd[1356349]: Disconnected from invalid user work 81.9.149.44 port 49654 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:55:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EDgQ7sxF4tIDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 08:56:03 host2 sshd[1357028]: Disconnected from invalid user dixi 81.9.149.44 port 45728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 08:57:05 host2 sshd[1357503]: Disconnected from invalid user epadmin 81.9.149.44 port 37896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-12-13 08:56:22 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:57793: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 08:56:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<RjI08sxFEOqWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-12-13 08:56:52 dovecot_login authenticator failed for (190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:52214: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:57:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bdx788xFqp8Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-12-13 08:57:26 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:56385: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-12-13 08:57:49 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:46135: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 08:57:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<mFKp9sxFdOnAqZl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:58:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wGPQ+MxFQJoDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 08:59:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<RrPj+sxF271etwuC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:59:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Gh0B/MxF/IADg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 08:59:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Z8Nn/cxFKI6kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 09:01:14 host2 sshd[1359803]: Disconnected from invalid user sms 81.9.149.44 port 34922 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:01:24 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<Q28rA81FMKADg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-13 09:02:07 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (skingful) [73.213.236.66]:41650: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:02:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8yzVBc1FYMEDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-13 09:02:12 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:59362: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 09:02:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<KX8IB81FrJl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-13 09:02:29 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:52613: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-13 09:02:31 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:48006: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-13 09:03:50 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:48202: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:03:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+VrhC81F6IYDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 09:03:16 host2 sshd[1361303]: Disconnected from invalid user vishal 81.9.149.44 port 36264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-13 09:03:21 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:48985: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 09:05:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<1OJJEM1FYLSLOxGe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:05:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<g5npEc1FIuIDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 09:05:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<pDZQE81FSqgI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.95
country_id: 6252001
description:
Dec 13 09:05:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.95, lip=66.85.158.92, session=<dHiVE81Fau7N0h9f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 09:06:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<GE+0E81F8rnCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-13 09:05:09 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (clowed) [67.172.54.29]:57928: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.253
country_id: 2542007
description:
2025-12-13 09:05:13 dovecot_plain authenticator failed for (semed) [105.73.203.253]:46284: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:06:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<ugXrFM1FmMEDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-13 09:07:59 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:40000: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 09:08:11 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:55864: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.184.94.75
country_id: 2328926
description:
2025-12-13 09:08:32 dovecot_login authenticator failed for 41-184-94-75.rv.ipnxtelecoms.com ([102.164.35.116]) [41.184.94.75]:47284: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-13 09:08:43 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (hentable) [50.74.136.134]:52034: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 09:08:45 dovecot_plain authenticator failed for (nonra) [12.150.243.22]:42084: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-13 09:08:47 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:36568: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-13 09:08:49 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (hycosphum) [73.195.211.98]:47932: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-13 09:09:01 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:36824: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 09:10:28 host2 sshd[1365504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 09:11:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<snJHKM1FiNM+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 09:15:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<PZ3cNs1FxosuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-13 09:17:14 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:58438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-13 09:17:27 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:58357: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 09:17:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<rUeUPM1FSLq8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 09:17:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<0pNKPc1FALUro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-12-13 09:17:45 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:45163: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-13 09:18:12 dovecot_login authenticator failed for (cm-178.232.194.231.get.no) [178.232.194.231]:51025: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 09:18:35 host2 sshd[1370373]: Disconnected from invalid user  62.60.131.157 port 39863 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 09:18:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<ycfBQc1F4InCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.110.203.174
country_id: 953987
description:
2025-12-13 09:21:16 dovecot_plain authenticator failed for ([31.57.166.48]) [152.110.203.174]:41430: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.42.176.104
country_id: 3895114
description:
2025-12-13 09:21:31 dovecot_plain authenticator failed for ([31.57.166.48]) [181.42.176.104]:33006: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.245.233.188
country_id: 3865483
description:
2025-12-13 09:21:30 dovecot_plain authenticator failed for ([31.57.166.48]) [170.245.233.188]:38464: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-13 09:21:55 dovecot_login authenticator failed for (nsg-corporate-90.179.185.122.airtel.in) [136.232.73.130]:58612: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.226.61.95
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.226.61.95: 629 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 09:21:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<eHj8Sc1F6sUI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.66.152.93
country_id: 3017382
description:
2025-12-13 09:21:17 dovecot_plain authenticator failed for 93.152.66.81.rev.sfr.net ([31.57.166.48]) [81.66.152.93]:43380: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.188.177.50
country_id: 3469034
description:
2025-12-13 09:21:45 dovecot_plain authenticator failed for ([31.57.166.48]) [38.188.177.50]:57735: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 09:22:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<DENpT81F1OUv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-13 09:22:08 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:44900: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 09:26:54 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:60314: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 09:27:56 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:59127: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-13 09:27:11 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:52592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 09:27:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Ov1AX81F/qmB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-13 09:27:27 dovecot_plain authenticator failed for (entoging) [178.250.191.189]:34234: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-13 09:28:22 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:37318: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 09:30:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<W69nac1FmutnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-13 09:30:03 dovecot_plain authenticator failed for (exante) [92.62.243.175]:51618: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 09:30:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<JPUBbM1FppeB4gum>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 13 09:31:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<I3H1bs1FttkD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 09:31:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<GXTPb81FTLtm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-13 09:32:59 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:41752: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 09:33:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<LngndM1FmIcImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-13 09:32:43 dovecot_login authenticator failed for (mail3.hurst.co.uk) [77.89.143.122]:53657: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-12-13 09:33:44 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:50424: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-13 09:34:07 dovecot_login authenticator failed for (dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:39048: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 09:35:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<hv0Qfs1FWsOH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 09:35:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<se2Vfc1FENTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 09:36:18 host2 sshd[1380603]: Disconnected from invalid user user 2.57.121.25 port 20761 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 09:36:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<mvjwgc1FTpBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 09:39:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<tAXkis1FKoel6L5h>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 09:41:47 host2 sshd[1383650]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 09:41:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Ytedks1FGL/D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.92.68.200
country_id: 732800
description:
Dec 13 09:42:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=91.92.68.200, lip=66.85.158.91, TLS, session=<hn/Zls1F6gpbXETI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.40.236.31
country_id: 2510769
description:
2025-12-13 09:43:06 dovecot_login authenticator failed for 31.red-83-40-236.dynamicip.rima-tde.net [83.40.236.31]:58703: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.69.251.106
country_id: 597427
description:
2025-12-13 09:43:44 dovecot_login authenticator failed for (md-188-69-251-106.omni.lt) [188.69.251.106]:36532: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 09:43:52 host2 sshd[1385098]: Disconnected from invalid user admin 2.57.121.112 port 45676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 09:43:29 dovecot_plain authenticator failed for (culimic) [64.72.74.162]:46359: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.241.165.8
country_id: 3469034
description:
Dec 13 09:43:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.241.165.8, lip=66.85.158.91, TLS, session=<FWAHmM1FmNK/8aUI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-13 09:43:26 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (ableas) [188.219.104.210]:57623: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-13 09:43:27 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:54796: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-13 09:43:29 dovecot_plain authenticator failed for (tedist) [178.250.191.189]:43224: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 09:44:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<fNUlns1FVrYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 09:45:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<nPM2n81FRNc+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 09:44:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<C0/RnM1FUNa8pkxr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.130
country_id: 6252001
description:
Dec 13 09:44:36 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.133.130, lip=66.85.158.92, session=<+u2wnc1FJvmTuYWC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 09:45:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<FecToc1FnMgIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.35.153.120
country_id: 6252001
description:
2025-12-13 09:45:40 dovecot_plain authenticator failed for ([31.57.166.48]) [50.35.153.120]:44090: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 09:45:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<4nLRoc1Fbo/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.30.24
country_id: 99237
description:
2025-12-13 09:45:58 dovecot_plain authenticator failed for ([31.57.166.48]) [185.106.30.24]:48722: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-13 09:46:38 +0530] info [cpaneld] 89.249.55.106 - cloudtou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.0.20
country_id: 2750405
description:
Dec 13 09:46:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=159.223.0.20, lip=66.85.158.91, TLS: Connection closed, session=<6MECpc1FyJyf3wAU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 09:47:04 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:41806: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 09:47:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<5e6Fp81FQqiKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 09:47:23 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:60117: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 09:48:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<abavrM1FrtdAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-13 09:48:58 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (adisord) [50.74.136.134]:52938: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.72.153.59
country_id: 6252001
description:
[2025-12-13 09:49:03 +0530] info [cpaneld] 71.72.153.59 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.195.176.86
country_id: 6252001
description:
[2025-12-13 09:49:04 +0530] info [cpaneld] 150.195.176.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.187
country_id: 6252001
description:
[2025-12-13 09:49:06 +0530] info [cpaneld] 172.58.212.187 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 09:48:20 host2 sshd[1388345]: Disconnected from invalid user user 2.57.121.25 port 53633 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.72.153.59
country_id: 6252001
description:
[2025-12-13 09:49:09 +0530] info [cpaneld] 71.72.153.59 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.65.142
country_id: 6252001
description:
[2025-12-13 09:49:10 +0530] info [cpaneld] 67.209.65.142 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.141.155.64
country_id: 6252001
description:
[2025-12-13 09:49:08 +0530] info [cpaneld] 74.141.155.64 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.102.54.243
country_id: 6252001
description:
[2025-12-13 09:49:07 +0530] info [whostmgrd] 76.102.54.243 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-13 09:52:06 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:58030: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-13 09:52:27 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:44699: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.182
country_id: 1733045
description:
2025-12-13 09:52:27 dovecot_login authenticator failed for ([49.124.155.182]) [49.124.155.182]:51036: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 09:52:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Hm/Ruc1FmJ4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.92.147
country_id: 2029969
description:
2025-12-13 09:52:38 dovecot_login authenticator failed for ([202.126.92.147]) [202.126.92.147]:53520: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 09:53:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<HaW5u81FvtaG0Wp/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.20.1.201
country_id: 6252001
description:
[2025-12-13 09:54:28 +0530] info [cpaneld] 67.20.1.201 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.176.251.208
country_id: 6252001
description:
[2025-12-13 09:54:26 +0530] info [cpaneld] 97.176.251.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.130.106.210
country_id: 6252001
description:
[2025-12-13 09:54:30 +0530] info [cpaneld] 76.130.106.210 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.235.82
country_id: 6252001
description:
[2025-12-13 09:54:34 +0530] info [cpaneld] 76.33.235.82 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 09:54:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<Gv9Ywc1F0LjAqZl0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.56.103
country_id: 6252001
description:
[2025-12-13 09:54:25 +0530] info [cpaneld] 73.235.56.103 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.56.157.248
country_id: 6252001
description:
[2025-12-13 09:54:29 +0530] info [whostmgrd] 208.56.157.248 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.23.189.194
country_id: 6252001
description:
[2025-12-13 09:54:32 +0530] info [cpaneld] 75.23.189.194 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 09:55:00 host2 sshd[1393085]: Disconnected from invalid user admin 2.57.121.112 port 40215 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-13 09:54:08 dovecot_login authenticator failed for ([125.16.246.121]) [182.95.63.50]:38048: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 09:56:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xgKdxs1FtNiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 09:56:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<sf0RyM1FSoWkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.159
country_id: 6252001
description:
2025-12-13 09:58:03 dovecot_login authenticator failed for wsip-184-191-250-159.fv.ks.cox.net [184.191.250.159]:39946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 09:58:57 host2 sshd[1396537]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 57102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-12-13 09:59:03 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:33112: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-13 09:59:02 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 09:58:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<h1MHzs1FY+BetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-13 09:58:21 dovecot_login authenticator failed for (cm-84.214.63.110.get.no) [84.214.63.110]:36915: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.142
country_id: 6252001
description:
Dec 13 09:58:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.142, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<HVQqz81F6NCi2JaO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 09:59:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53490: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.142
country_id: 6252001
description:
Dec 13 09:59:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.142, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<6ytr0s1F7OKi2JaO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2025-12-13 09:59:23 dovecot_login authenticator failed for ([87.200.94.102]) [87.200.94.102]:43487: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-13 09:59:36 dovecot_plain authenticator failed for (exechs) [65.20.184.80]:56502: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 10:00:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1KIh1s1FwFR100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.31.145
country_id: 2802361
description:
Dec 13 10:01:27 host2 pure-ftpd[1398721]: (?@35.187.31.145) [INFO] New connection from 35.187.31.145


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 10:02:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<E2Kg3s1FEI4I3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.142
country_id: 6252001
description:
Dec 13 10:04:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.142, lip=66.85.158.92, TLS, session=<pKie481FqPWi2JaO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Dec 13 10:07:20 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<C2QD781FMJQDU5En>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.113
country_id: 6252001
description:
Dec 13 10:09:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.113, lip=66.85.158.91, session=<NVce9c1F29PDuExx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-12-13 10:08:35 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:39485: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-13 10:08:47 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:56680: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.17
country_id: 6252001
description:
Dec 13 10:08:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=195.184.76.17, lip=66.85.158.91, session=<j0Bx9M1FC8fDuEwR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.114
country_id: 6252001
description:
Dec 13 10:09:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.114, lip=66.85.158.91, session=<3yqO9c1FqejDuExy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Dec 13 10:09:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.18, lip=66.85.158.91, session=<pRe+9c1FEcfDuEwS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 10:10:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<vhmk+s1FOuynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 10:11:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<yYul/M1F1tYuZXpm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.114.19.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.114.19.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.2.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.2.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.167.218.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.167.218.57 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.76.247
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.76.247 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.176.151.96
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.176.151.96 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.112.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.112.16 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.212.202.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.212.202.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-13 10:13:52 dovecot_plain authenticator failed for (mograrans) [5.32.99.14]:37278: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 10:13:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<NBA2Bs5F2Loro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 10:14:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<7h4RCs5Fip68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-13 10:15:09 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:40002: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.124.35.65
country_id: 3469034
description:
2025-12-13 10:16:00 dovecot_plain authenticator failed for ([31.57.166.48]) [177.124.35.65]:34161: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 10:16:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<fVlqD85FPsNo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 10:16:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Dj06Ec5FbuXCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.23.92.193
country_id: 6252001
description:
2025-12-13 10:16:12 dovecot_plain authenticator failed for 165-23-92-193-dynamic.midco.net ([31.57.166.48]) [165.23.92.193]:34576: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.139.41.107
country_id: 3865483
description:
2025-12-13 10:16:25 dovecot_plain authenticator failed for host107.190-139-41.telecom.net.ar ([31.57.166.48]) [190.139.41.107]:16937: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-13 10:17:29 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:55812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-12-13 10:17:30 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:59233: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-13 10:17:42 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:57310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-13 10:17:18 dovecot_login authenticator failed for (189.219.138.45-clientes-izzi.mx) [189.219.138.45]:42366: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 10:18:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<uP4sFs5FBNoI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.97
country_id: 6252001
description:
2025-12-13 10:18:54 dovecot_login authenticator failed for ([70.174.168.97]) [70.174.168.97]:33949: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-13 10:19:13 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:46422: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 10:20:06 host2 sshd[1410057]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 63992


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-13 10:20:05 dovecot_plain authenticator failed for (chous) [38.248.111.238]:48824: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 10:21:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<iFQlIc5FAqgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-13 10:22:38 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:39457: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-13 10:22:47 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:41500: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-13 10:22:52 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (pedle) [2.135.31.74]:39795: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-13 10:23:31 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:53950: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-13 10:23:57 dovecot_login authenticator failed for ([182.95.181.22]) [182.95.181.22]:46176: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-13 10:24:19 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:47492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-13 10:24:40 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:47196: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.79.208
country_id: 2661886
description:
2025-12-13 10:24:59 dovecot_plain authenticator failed for c-83-226-79-208.bbcust.telenor.se ([31.57.166.48]) [83.226.79.208]:57520: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 10:25:27 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (depigy) [196.47.172.253]:56579: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.198.13.144
country_id: 3865483
description:
2025-12-13 10:25:26 dovecot_plain authenticator failed for ([31.57.166.48]) [192.198.13.144]:57871: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.66.226.23
country_id: 2635167
description:
2025-12-13 10:25:12 dovecot_plain authenticator failed for ([31.57.166.48]) [84.66.226.23]:55990: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-13 10:25:24 dovecot_plain authenticator failed for (unmenderd) [5.31.15.108]:33376: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 10:26:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<zvhsMs5FXJlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 10:26:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<g+QVNc5FeLNm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.174.162.68
country_id: 3469034
description:
Dec 13 10:28:05 host2 sshd[1414848]: Disconnected from invalid user joe 45.174.162.68 port 58122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 10:27:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<sutENs5FKoaB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec 13 10:27:56 host2 sshd[1414703]: Disconnected from invalid user cad 124.155.125.131 port 60258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:28:29 host2 sshd[1415137]: Disconnected from invalid user ansible 37.32.13.93 port 40476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 10:28:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<K567O85F2L8+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:29:04 host2 sshd[1415781]: Disconnected from invalid user nvr 194.74.196.10 port 48166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 10:29:34 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:60948: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-13 10:29:46 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:39517: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:29:51 host2 sshd[1416182]: Disconnected from invalid user hqadmin 37.32.13.93 port 59780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:29:13 host2 sshd[1415886]: Disconnected from invalid user ubuntu 154.92.109.196 port 24836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:29:25 host2 sshd[1416011]: Disconnected from invalid user ubuntu 107.174.41.51 port 53398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 10:29:32 host2 sshd[1416056]: Disconnected from invalid user  62.60.131.157 port 49220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:30:29 host2 sshd[1416840]: Disconnected from invalid user nvr 68.183.144.238 port 59588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:30:14 host2 sshd[1416667]: Disconnected from invalid user deployer 194.74.196.10 port 56818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:31:55 host2 sshd[1417542]: Disconnected from invalid user sgp 154.92.109.196 port 41732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:31:10 host2 sshd[1417128]: Disconnected from invalid user panel 37.32.13.93 port 55260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 10:31:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<D1N5RM5FMuTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:31:18 host2 sshd[1417232]: Disconnected from invalid user ubuntu 154.92.109.196 port 53773 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 13 10:32:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<t+/CR85FVKlog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-13 10:32:32 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:16908: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:32:35 host2 sshd[1417942]: Disconnected from invalid user proxyuser 37.32.13.93 port 57832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:32:38 host2 sshd[1417886]: Disconnected from invalid user docker 154.222.24.142 port 33626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 13 10:32:43 host2 sshd[1418012]: Disconnected from invalid user appadmin 202.4.106.201 port 33556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-12-13 10:32:53 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:51854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:32:56 host2 sshd[1418111]: Disconnected from invalid user nick 194.74.196.10 port 53548 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 13 10:33:26 host2 sshd[1418405]: Disconnected from invalid user docker 202.4.106.201 port 45950 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:33:26 host2 sshd[1418415]: Received disconnect from 194.74.196.10 port 50930:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:33:59 host2 sshd[1418795]: Disconnected from invalid user temp 68.183.144.238 port 46846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 10:33:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<qXQyS85FItdntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 13 10:33:22 host2 sshd[1418387]: Disconnected from invalid user ubuntu 213.6.203.226 port 46172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 13 10:35:03 host2 sshd[1419392]: Disconnected from invalid user admins 213.6.203.226 port 40992 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-13 10:34:09 dovecot_login authenticator failed for ([182.95.20.28]) [182.95.228.10]:39530: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:34:50 host2 sshd[1419242]: Disconnected from invalid user alice 141.227.137.228 port 51092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2025-12-13 10:34:55 dovecot_login authenticator failed for ([122.186.230.25]) [125.19.161.150]:37822: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:35:31 host2 sshd[1419810]: Disconnected from invalid user user123 107.174.41.51 port 53576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 10:35:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Cvw1VM5FfsGH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:36:21 host2 sshd[1420201]: Disconnected from invalid user max 154.222.24.142 port 60972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.145
country_id: 3865483
description:
Dec 13 10:36:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.249.145, lip=66.85.158.91, TLS, session=<l5ioVc5FE6GzAPmR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:36:41 host2 sshd[1420367]: Disconnected from invalid user docker 107.174.41.51 port 53676 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.136
country_id: 3469034
description:
Dec 13 10:36:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=187.120.72.136, lip=66.85.158.91, TLS, session=<fcryVs5F25G7eEiI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:36:50 host2 sshd[1420449]: Disconnected from invalid user vinay 68.183.144.238 port 55970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:36:06 host2 sshd[1420102]: Disconnected from invalid user appadmin 107.174.41.51 port 53624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:36:29 host2 sshd[1420290]: Disconnected from invalid user user123 141.227.137.228 port 49984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 13 10:36:57 host2 sshd[1420480]: Disconnected from invalid user ubuntu 110.164.228.242 port 55996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:36:12 host2 sshd[1420122]: Disconnected from invalid user issabel 103.186.1.120 port 38816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 10:37:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<YVaiWc5FdIrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 10:37:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<NH33Ws5FALIImxNM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:37:35 host2 sshd[1420956]: Disconnected from invalid user arthur 154.222.24.142 port 57144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:37:59 host2 sshd[1421181]: Disconnected from invalid user mpi 141.227.137.228 port 59918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 13 10:38:11 host2 sshd[1421307]: Disconnected from invalid user max 110.164.228.242 port 33164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 10:38:30 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:50688: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:38:47 host2 sshd[1421682]: Disconnected from invalid user issabel 154.222.24.142 port 54016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 10:38:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<C+KSX85FZKel6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-13 10:38:08 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:38432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:39:20 host2 sshd[1422197]: Disconnected from invalid user admin 103.186.1.120 port 47884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 10:40:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<o/70Y85FNJe8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:40:59 host2 sshd[1423250]: Disconnected from invalid user administrator 154.222.24.142 port 45100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-13 10:40:31 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (nestive) [68.52.119.193]:35306: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:40:48 host2 sshd[1423151]: Disconnected from invalid user ftptest 103.186.1.120 port 42474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:40:57 host2 sshd[1423227]: Disconnected from invalid user vinay 151.46.198.234 port 39247 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:41:38 host2 sshd[1423630]: Disconnected from invalid user john 151.46.198.234 port 39810 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.166.86.83
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 174.166.86.83 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.73.94.253
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.73.94.253 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.154.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.2.154.34 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 10:42:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<S2CNbc5FxKYvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:42:20 host2 sshd[1424029]: Disconnected from invalid user deployer 151.46.198.234 port 39871 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.208.124.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.208.124.100 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.20.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.147.20.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 10:42:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ncUgbc5FFumKxX03>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.205.34.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.205.34.6 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.86.99.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.86.99.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.232.204.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.232.204.210 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.24.108
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.193.24.108 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.166.222.109
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.166.222.109 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.238.16.128
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.238.16.128 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.99.225.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.99.225.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.186.77.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.186.77.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.130.66.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.130.66.217 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-13 10:43:51 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:57431: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-13 10:43:10 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:49452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2025-12-13 10:43:21 dovecot_login authenticator failed for ([107.85.14.208]) [107.85.14.208]:43676: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-13 10:43:33 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:44386: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-13 10:45:00 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:39807: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 10:44:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lV2Bdc5FTovO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:44:58 host2 sshd[1426230]: Disconnected from invalid user guest 151.46.198.234 port 39220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-13 10:44:58 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:40661: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 10:45:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<uHaReM5FNJ5AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-12-13 10:45:22 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:56088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-13 10:45:40 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:45610: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-13 10:46:50 dovecot_plain authenticator failed for (nintledive) [65.20.164.137]:54013: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-13 10:47:09 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (aking) [73.27.33.174]:56082: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.236
country_id: 6252001
description:
Dec 13 10:47:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</VVefc5F7MvG6xjs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 10:47:12 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (subleting) [98.227.25.115]:44236: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.35
country_id: 1733045
description:
2025-12-13 10:49:16 dovecot_login authenticator failed for ([49.124.151.35]) [49.124.151.35]:39630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 10:49:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<w+Mzhc5FQp8IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-13 10:49:43 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:57839: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 10:50:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<onibh85FKOA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-12-13 10:50:09 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:51173: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-13 10:51:21 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:41390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 10:51:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<2TQmjc5F9oHAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 10:51:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<aEHsjc5FxIyG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 10:54:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<B9D2ls5FXr+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 10:55:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<vtb5ms5F6IyWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.151.7.93
country_id: 6252001
description:
2025-12-13 10:55:50 dovecot_plain authenticator failed for ([31.57.166.48]) [35.151.7.93]:31610: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-13 10:56:01 dovecot_plain authenticator failed for (porapers) [5.11.143.72]:46522: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.12.40.68
country_id: 3865483
description:
2025-12-13 10:56:05 dovecot_plain authenticator failed for ([31.57.166.48]) [198.12.40.68]:49238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.114.233.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 69.114.233.176 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.154.51.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.154.51.18 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.90.168.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.90.168.4 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 10:56:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<3PIOoM5F3J5100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.163.12.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.163.12.68 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.60.66.14
country_id: 3895114
description:
2025-12-13 10:56:19 dovecot_plain authenticator failed for ([31.57.166.48]) [179.60.66.14]:56290: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.119.109.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.119.109.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.32.130.42
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.32.130.42 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.205.150.113
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.205.150.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.12.40.68
country_id: 3865483
description:
2025-12-13 10:56:12 dovecot_login authenticator failed for ([31.57.166.48]) [198.12.40.68]:49238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 10:57:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<+zrQos5FZUBetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 10:58:52 host2 sshd[1433994]: Disconnected from invalid user es 41.57.65.25 port 59376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.162
country_id: 3658394
description:
2025-12-13 10:58:59 dovecot_plain authenticator failed for ([31.57.166.48]) [181.199.46.162]:54083: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-13 11:00:02 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:58452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-13 11:00:01 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (spismatii) [73.161.96.107]:46828: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 10:59:10 host2 sshd[1434147]: Disconnected from invalid user umar 102.211.234.150 port 59206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.158.35
country_id: 1733045
description:
2025-12-13 10:59:14 dovecot_plain authenticator failed for ([31.57.166.48]) [161.142.158.35]:5029: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.23.228
country_id: 1282988
description:
2025-12-13 10:59:32 dovecot_plain authenticator failed for ([31.57.166.48]) [103.148.23.228]:12927: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:00:11 host2 sshd[1434808]: Disconnected from invalid user hb 190.111.211.81 port 42520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 11:00:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<vbuOrM5FAtAI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-12-13 11:00:24 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:43678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 11:00:38 host2 sshd[1435062]: Disconnected from invalid user cloud 102.211.234.150 port 33162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 11:01:23 host2 sshd[1435573]: Disconnected from invalid user opsadmin 102.211.234.150 port 48494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 11:02:46 host2 sshd[1436453]: Disconnected from invalid user oscar 41.57.65.25 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:02:51 host2 sshd[1436496]: Disconnected from invalid user oscar 190.111.211.81 port 43802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-13 11:02:40 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (tigene) [73.88.196.91]:57264: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 11:03:37 host2 sshd[1437223]: Disconnected from invalid user dev 41.57.65.25 port 48482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-13 11:03:48 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:56694: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:03:53 host2 sshd[1437356]: Disconnected from invalid user user10 190.111.211.81 port 43430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2025-12-13 11:03:59 dovecot_login authenticator failed for adsl-89-217-204-91.adslplus.ch [89.217.204.91]:59354: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-13 11:04:12 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:59614: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-13 11:04:36 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:47124: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.121.114.141
country_id: 3865483
description:
2025-12-13 11:05:54 dovecot_plain authenticator failed for ([31.57.166.48]) [138.121.114.141]:37442: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 13 11:06:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<bDHgwM5F/N42rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.40.161
country_id: 1282988
description:
2025-12-13 11:05:25 dovecot_plain authenticator failed for ([31.57.166.48]) [103.190.40.161]:2548: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.226.153.126
country_id: 3996063
description:
2025-12-13 11:05:38 dovecot_plain authenticator failed for ([31.57.166.48]) [177.226.153.126]:3441: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 11:07:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<6VgNxs5FmrIuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-13 11:09:00 dovecot_login authenticator failed for (aes-static-041.73.22.125.airtel.in) [122.186.201.62]:34916: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-13 11:08:34 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:56188: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-13 11:08:56 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:42440: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-13 11:09:29 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:35628: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 11:10:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<S7hh0M5FiuEro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-13 11:10:36 dovecot_login authenticator failed for (cm-178.232.194.231.get.no) [178.232.194.231]:39220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 11:10:06 host2 sshd[1441453]: Disconnected from invalid user user 2.57.121.25 port 45423 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-13 11:14:07 dovecot_plain authenticator failed for (pling) [65.20.164.137]:46807: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-12-13 11:15:28 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:42148: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 11:15:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Ctre4s5FEtrCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 11:15:38 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:44968: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 11:16:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<xKF75M5FZJsI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-13 11:16:21 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:40704: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-13 11:16:43 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (rheat) [71.62.34.216]:36542: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-13 11:17:01 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (frism) [72.241.202.216]:38170: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 11:20:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<wEhw9M5FHtsv7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 11:21:08 host2 sshd[1448282]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-13 11:21:45 dovecot_plain authenticator failed for (dehyde) [178.250.191.189]:57528: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 11:22:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<yX/u+85F6M1npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-13 11:22:37 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (aultry) [174.58.87.108]:50734: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 11:22:40 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (sedneers) [96.230.65.90]:51372: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 11:22:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<AyW3+85F9qNm1bVi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 11:25:03 host2 sshd[1450712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-13 11:24:45 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (flineal) [69.123.219.82]:51305: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-13 11:25:05 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:48608: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-13 11:25:19 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:58190: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:25:44 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<r1BfB89FLtkDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.22.225.7
country_id: 3865483
description:
2025-12-13 11:25:47 dovecot_plain authenticator failed for ([31.57.166.48]) [186.22.225.7]:22897: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.61.51.166
country_id: 6252001
description:
2025-12-13 11:25:59 dovecot_plain authenticator failed for c-71-61-51-166.hsd1.pa.comcast.net ([31.57.166.48]) [71.61.51.166]:40262: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 13 11:27:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qvkCDM9FBBdChJl8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 11:27:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<QS8iDM9FLtTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.244.51
country_id: 1733045
description:
2025-12-13 11:26:13 dovecot_plain authenticator failed for ([31.57.166.48]) [180.75.244.51]:63505: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec 13 11:26:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UxumCc9Fp9uTuYRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:26:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<TCX3Cs9FuJEDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.219.159
country_id: 3374766
description:
2025-12-13 11:28:59 dovecot_login authenticator failed for ([41.215.219.159]) [41.215.219.159]:32895: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 11:28:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<9jzPEM9FNOKB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-13 11:29:39 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:33690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 11:29:56 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:45060: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-13 11:29:11 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:58304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:29:21 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<y5lPFM9FQosDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-13 11:29:36 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:53032: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 11:30:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<X2cOGc9F1Ipntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.7
country_id: 719819
description:
Dec 13 11:31:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=178.48.181.7, lip=66.85.158.91, TLS, session=<awcPG89FlsqyMLUH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.85
country_id: 3469034
description:
Dec 13 11:31:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.247.85, lip=66.85.158.91, TLS, session=<pF/4G89Fq6i60fdV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.84
country_id: 690791
description:
Dec 13 11:31:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=176.103.2.84, lip=66.85.158.91, TLS, session=<a/OzHM9FiaGwZwJU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 11:33:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<FFVlIc9Fjps+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 11:33:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<fUKaIc9FqIjD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.5
country_id: 3469034
description:
Dec 13 11:32:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=177.8.251.5, lip=66.85.158.91, TLS, session=</yk+Hc9FjKuxCPsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 11:33:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Vdu6Is9Fcrs+PIdf>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:34:45 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<ZiKkJ89FdJUDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-12-13 11:35:02 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:45913: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-13 11:34:17 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:46284: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-13 11:34:20 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:51016: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-13 11:34:38 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (inonspragy) [73.199.161.144]:55952: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.111.140
country_id: 6252001
description:
2025-12-13 11:34:42 dovecot_login authenticator failed for ([75.110.111.140]) [75.110.111.140]:45289: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-13 11:34:57 dovecot_login authenticator failed for ([84.213.189.183]) [84.213.189.183]:56355: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-13 11:35:09 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:61759: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-12-13 11:35:19 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:43361: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-13 11:35:43 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:54042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 11:36:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<MDArLM9Fos+H6yFP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.189.131.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.189.131.45 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 11:36:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<wH1hLs9FioC8pkxr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.20.245.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.20.245.239 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.61.145.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.61.145.91 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:36:22 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<75NtLc9FepMDlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.174.40.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.174.40.35 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.119.96.2
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 52.119.96.2 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.199.220.184
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.199.220.184 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.242.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 107.136.242.37 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 11:38:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=</beINs9FJpal6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 11:38:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Sq1kNM9FCuaKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Dec 13 11:39:59 host2 sshd[1459641]: Disconnected from invalid user smart 115.241.83.2 port 53388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-12-13 11:40:55 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:62639: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-13 11:40:57 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:45536: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.241.83.2
country_id: 1269750
description:
Dec 13 11:40:46 host2 sshd[1460166]: Disconnected from invalid user hadoop 115.241.83.2 port 48312 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 11:41:47 host2 sshd[1460502]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 11:41:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<XexePs9FWJAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-13 11:41:14 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:32939: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-13 11:42:57 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (alnes) [174.161.27.82]:57435: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.149.97
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.168.149.97 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 11:43:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<nagMR89FLOZAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Dec 13 11:44:01 host2 sshd[1461565]: Disconnected from invalid user hieu 115.241.83.2 port 57446 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.12.248.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.12.248.45 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.185.109.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.185.109.176 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.196.96.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.196.96.186 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.180.160.169
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 67.180.160.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.50.52
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.150.50.52 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.54.202.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.54.202.17 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 11:43:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<c9FZR89FSIkImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 11:44:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<vlLiSs9FgpfO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.31.253
country_id: 99237
description:
2025-12-13 11:46:11 dovecot_plain authenticator failed for ([31.57.166.48]) [185.106.31.253]:22867: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 11:46:15 dovecot_plain authenticator failed for (unionil) [12.150.243.22]:63694: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.184.22.178
country_id: 3865483
description:
2025-12-13 11:46:21 dovecot_plain authenticator failed for ([31.57.166.48]) [45.184.22.178]:51042: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.217.180.188
country_id: 6252001
description:
2025-12-13 11:46:22 dovecot_plain authenticator failed for c-98-217-180-188.hsd1.nh.comcast.net ([31.57.166.48]) [98.217.180.188]:45066: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.27.91.52
country_id: 6252001
description:
2025-12-13 11:46:32 dovecot_plain authenticator failed for ([31.57.166.48]) [50.27.91.52]:55112: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.139.159
country_id: 3658394
description:
2025-12-13 11:46:43 dovecot_plain authenticator failed for ([31.57.166.48]) [200.24.139.159]:54166: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 11:46:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<3MLPUs9FdrrAqZl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 13 11:48:00 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<dF8IV89F+pkD7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-13 11:50:26 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:58618: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 11:50:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<9mABYc9FOK+G0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-13 11:51:18 dovecot_login authenticator failed for (aes-static-105.28.22.125.airtel.in) [182.95.228.22]:60324: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 11:53:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kBsybM9F/Ph100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 11:53:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<SM5has9FEsGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 11:53:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<MLaKas9FhuIIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-13 11:54:30 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:43360: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-13 11:54:41 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:53491: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.62.174.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.62.174.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.97.34.136
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.97.34.136 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.232.56.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.232.56.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.55.146.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.55.146.145 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.182.218.90
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.182.218.90 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.219.220.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.219.220.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.20.150.23
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.20.150.23 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 11:55:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<w56vcc9FZKSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 11:56:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<h6dLdM9FMKqnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 11:57:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lrCOeM9FUX1etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 11:58:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<eslJfM9FksgI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 11:59:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<VBWUgM9F7O0uZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-13 11:59:47 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:40710: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-13 12:00:02 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:57294: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-13 11:59:17 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:52257: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-13 11:59:31 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:59536: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-13 12:00:54 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:53652: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.174.85
country_id: 1643084
description:
2025-12-13 12:05:50 dovecot_login authenticator failed for ([36.92.174.85]) [36.92.174.85]:60529: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-13 12:05:54 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (hanageoble) [73.129.57.71]:60390: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 12:05:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<JTKKlM9FnNVo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-12-13 12:05:30 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:53246: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-13 12:05:51 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (sming) [76.97.155.25]:57670: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-13 12:06:08 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:57318: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-13 12:06:20 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:57811: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 12:06:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<dGkCmc9FIsYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.20.179.199
country_id: 3865483
description:
2025-12-13 12:08:42 dovecot_plain authenticator failed for ([31.57.166.48]) [181.20.179.199]:47988: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.129.191.8
country_id: 3469034
description:
2025-12-13 12:09:02 dovecot_plain authenticator failed for ([31.57.166.48]) [177.129.191.8]:42324: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 12:09:19 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (unproaccum) [196.47.172.253]:49998: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.129.191.8
country_id: 3469034
description:
2025-12-13 12:09:08 dovecot_login authenticator failed for ([31.57.166.48]) [177.129.191.8]:42324: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 12:10:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<7i8Cqc9FAOy8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 12:11:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<PpEirM9FyNc+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 12:14:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<ZzUutM9FKJwI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Dec 13 12:13:56 host2 sshd[1480831]: Disconnected from invalid user la 103.210.22.17 port 57570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 12:14:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<V7Q6tc9FrN/CBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Dec 13 12:14:34 host2 sshd[1481284]: Disconnected from invalid user user11 103.210.22.17 port 51168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 12:15:24 host2 sshd[1482076]: Disconnected from invalid user  62.60.131.157 port 59324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-13 12:15:53 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:43738: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.17
country_id: 1880251
description:
Dec 13 12:16:29 host2 sshd[1482933]: Disconnected from invalid user fivem 103.210.22.17 port 53852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 12:16:34 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (buctortis) [85.225.19.144]:40931: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-13 12:16:12 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:48978: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-13 12:16:18 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:49018: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-12-13 12:17:10 dovecot_login authenticator failed for (14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:58378: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 12:17:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<sBAWwM9F/Ihm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Dec 13 12:17:34 host2 sshd[1483742]: Disconnected from invalid user ca 178.128.147.10 port 49696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Dec 13 12:18:11 host2 sshd[1484170]: Disconnected from invalid user syncthing 178.128.147.10 port 53016 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.147.10
country_id: 6252001
description:
Dec 13 12:18:45 host2 sshd[1484478]: Disconnected from invalid user omm 178.128.147.10 port 52798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 12:18:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<D/hQxc9FluVnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Dec 13 12:19:45 host2 sshd[1485183]: Disconnected from invalid user sonar 103.210.22.17 port 45200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-13 12:19:49 dovecot_login authenticator failed for ([1.7.229.162]) [136.232.73.130]:47910: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Dec 13 12:19:52 host2 sshd[1485265]: Disconnected from invalid user newuser 178.128.147.10 port 53404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 12:20:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<HcLWyc9FKqcv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-13 12:22:00 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:45844: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 12:22:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<aq+X0s9FTMDCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.37
country_id: 1733045
description:
2025-12-13 12:22:16 dovecot_login authenticator failed for ([49.124.146.37]) [49.124.146.37]:56480: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-12-13 12:24:07 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:44185: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 12:23:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<u4GV1c9F3qfD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.203
country_id: 6252001
description:
Dec 13 12:23:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.203, lip=66.85.158.92, TLS, session=<hsMk1s9FXv/G6xjL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-12-13 12:23:47 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:63279: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-12-13 12:23:54 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:35286: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 12:23:56 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:43783: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-13 12:25:36 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:51256: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-13 12:27:52 dovecot_plain authenticator failed for (squarremal) [102.53.15.17]:40709: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-13 12:27:55 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (luldst) [73.13.220.220]:54766: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 12:28:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<+6Vg589FztQ+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.119.98
country_id: 3865483
description:
Dec 13 12:28:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=190.181.119.98, lip=66.85.158.91, TLS, session=<r0Cr589F+Li+tXdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 12:28:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<QLYF6c9F5uRntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 12:30:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<mLBa7c9FJr6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.12
country_id: 3469034
description:
Dec 13 12:29:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=186.209.247.12, lip=66.85.158.91, TLS, session=<YTUL6c9FnJi60fcM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 12:29:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<yib+6s9FgNTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-13 12:29:32 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:41558: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-13 12:29:52 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:51088: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-13 12:30:35 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:48926: 535 Incorrect authentication data (set_id=office@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-13 12:31:12 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:47082: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 12:31:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<Ln4d8s9F8qo+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 12:33:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<qK3j+s9F8Iu8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 12:34:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<DlVq+89FUKCKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 12:35:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<nLsU/89FYNM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.215.39.32
country_id: 630336
description:
2025-12-13 12:36:14 dovecot_plain authenticator failed for mm-32-39-215-37.mfilial.dynamic.pppoe.byfly.by ([31.57.166.48]) [37.215.39.32]:1547: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.202.149.125
country_id: 6252001
description:
2025-12-13 12:36:25 dovecot_plain authenticator failed for 107-202-149-125.lightspeed.sntcca.sbcglobal.net ([31.57.166.48]) [107.202.149.125]:34676: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.176.117.128
country_id: 99237
description:
2025-12-13 12:36:36 dovecot_plain authenticator failed for ([31.57.166.48]) [198.176.117.128]:28496: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-13 12:37:15 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:48258: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 12:37:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<tSMtB9BFvImH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-13 12:37:29 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:42650: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 12:37:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<uxFHCdBF+OjAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-13 12:39:42 dovecot_plain authenticator failed for (busit) [102.88.10.10]:34394: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 12:39:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<x+QTENBF4OQvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-13 12:40:00 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:39492: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 12:40:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<g24jEdBFisul6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-13 12:39:33 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:47383: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 12:41:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<c075FdBFYLJAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-13 12:41:48 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (miathers) [174.166.153.20]:47482: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 12:42:19 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (emedned) [85.225.19.144]:39650: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 13 12:42:08 host2 sshd[1498798]: Disconnected from invalid user backuppc 205.185.115.224 port 45100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-13 12:42:09 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (salia) [78.66.119.139]:37296: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 12:43:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<dnR1HtBFLpzO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 13 12:43:55 host2 sshd[1499844]: Disconnected from invalid user user 205.185.115.224 port 52604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-13 12:43:57 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:42831: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.92.8.45
country_id: 6252001
description:
2025-12-13 12:44:04 dovecot_plain authenticator failed for ([31.57.166.48]) [23.92.8.45]:47770: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-13 12:43:36 dovecot_login authenticator failed for (80.130.83.103.static.rapidnet.in) [103.83.130.80]:43750: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.92.8.45
country_id: 6252001
description:
2025-12-13 12:44:10 dovecot_login authenticator failed for ([31.57.166.48]) [23.92.8.45]:47770: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.209.87.158
country_id: 3865483
description:
2025-12-13 12:44:17 dovecot_plain authenticator failed for ([31.57.166.48]) [181.209.87.158]:53201: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.183.237.167
country_id: 6252001
description:
2025-12-13 12:44:27 dovecot_plain authenticator failed for ([31.57.166.48]) [65.183.237.167]:58849: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-13 12:44:29 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:44606: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-13 12:47:59 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (lisele) [68.193.149.88]:54513: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-13 12:48:29 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:52784: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2025-12-13 12:48:51 dovecot_login authenticator failed for ([180.94.76.126]) [180.94.76.126]:36808: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-13 12:48:55 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:34643: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-12-13 12:49:09 dovecot_login authenticator failed for ([110.77.148.87]) [110.77.148.87]:47130: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-13 12:49:56 dovecot_login authenticator failed for 14-0-142-131.static.pccw-hkt.com [14.0.142.131]:52262: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 12:50:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<6v7mNNBFStOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-13 12:50:10 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:55719: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 12:50:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<RP8oNtBFxL4ImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-13 12:50:30 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (oungradmed) [68.82.141.145]:41040: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 12:51:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<RB8GOtBF9jt100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-13 12:53:07 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:43630: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-13 12:52:35 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:44088: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 12:52:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<60fLPdBF0L0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 12:52:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<r00lP9BF4J6kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.171
country_id: 1733045
description:
2025-12-13 12:54:33 dovecot_login authenticator failed for ([49.124.152.171]) [49.124.152.171]:35558: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.65
country_id: 1733045
description:
2025-12-13 12:54:56 dovecot_login authenticator failed for ([49.125.201.65]) [49.125.201.65]:53654: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 12:55:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<SBxpSdBFRI2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-13 12:55:33 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:38182: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.123.148
country_id: 1819730
description:
2025-12-13 12:56:11 dovecot_login authenticator failed for (161.81.123.148.hk.chinamobile.com) [161.81.123.148]:46400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 12:56:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<8cnDS9BFSsMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 12:57:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<6m4UUdBFIJRetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 12:58:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<FtMxU9BFhrwIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 12:59:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Sj2xV9BFdrc+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.42
country_id: 3017382
description:
Dec 13 13:01:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.42, lip=66.85.158.92, session=<fOWpXtBFG71bxJgq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.66
country_id: 3017382
description:
Dec 13 13:01:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.66, lip=66.85.158.92, session=<Mx9HX9BFt6NbxJhC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.207
country_id: 3175395
description:
Dec 13 13:01:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=217.26.179.207, lip=66.85.158.91, TLS, session=<ZQrxXdBFt6bZGrPP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.83
country_id: 3017382
description:
Dec 13 13:02:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.83, lip=66.85.158.92, session=<R1GvX9BF19RbxJhT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 13 13:02:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS: Connection closed, session=<oof3X9BFUN9ChJl5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.66
country_id: 3017382
description:
Dec 13 13:02:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.66, lip=66.85.158.92, session=<+7htYNBFhalbxJhC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.134
country_id: 3865483
description:
Dec 13 13:02:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=179.0.251.134, lip=66.85.158.91, TLS, session=<9ndUX9BFsN6zAPuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.58
country_id: 3017382
description:
Dec 13 13:02:27 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.58, lip=66.85.158.92, session=<UM1AYdBFe6hbxJg6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 13:02:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<kFdRYtBFnI0ro2np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.40
country_id: 3017382
description:
Dec 13 13:02:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.40, lip=66.85.158.92, session=<H/s6YNBFv+tbxJgo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.60
country_id: 3017382
description:
Dec 13 13:02:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.60, lip=66.85.158.92, session=<ySVRYNBFF7dbxJg8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-13 13:04:56 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:40251: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-13 13:05:44 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:43000: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 13 13:06:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<OTwYb9BFHMcDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.234
country_id: 2186224
description:
2025-12-13 13:07:22 dovecot_login authenticator failed for ([121.73.169.234]) [121.73.169.234]:58514: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-13 13:07:35 dovecot_login authenticator failed for (201.173.56.28-clientes-izzi.mx) [201.173.56.28]:39921: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2025-12-13 13:08:38 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:64413: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-13 13:08:50 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:18757: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 13:09:37 host2 sshd[1516732]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 13:09:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<BgofedBFLLO8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.54
country_id: 6252001
description:
Dec 13 13:09:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.54, lip=66.85.158.91, TLS, session=</IIAetBF4PXG6xg2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.5.39.49
country_id: 3895114
description:
2025-12-13 13:11:23 dovecot_plain authenticator failed for ([31.57.166.48]) [190.5.39.49]:51811: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.165
country_id: 3175395
description:
Dec 13 13:11:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.197.9.165, lip=66.85.158.91, TLS, session=<rIzpgdBFp+K5xQml>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 13:13:33 host2 sshd[1520160]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.121.205
country_id: 294640
description:
2025-12-13 13:13:35 dovecot_login authenticator failed for ([46.210.121.205]) [46.210.121.205]:41578: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 13:13:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<yxwJidBFqqnCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 13:13:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Ftx5idBFoJpm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-13 13:13:49 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:46686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 13 13:14:21 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, session=<DcLSi9BFesw2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 13:14:45 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:53632: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-13 13:14:58 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:61410: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 13:15:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<OgYtjtBFNO5npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 13:17:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<cI3FldBFuI4+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 13 13:17:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<J+8iltBFouDBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-13 13:19:50 dovecot_plain authenticator failed for (eennaceled) [65.20.250.163]:34786: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 13:19:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<5MpYn9BFatgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 13:19:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Q+h4n9BFpqLD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-13 13:19:26 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:43812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-12-13 13:19:39 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:57570: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-13 13:20:58 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:58986: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-13 13:21:01 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:41159: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-13 13:20:42 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:45153: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-13 13:23:43 dovecot_plain authenticator failed for (nogyropa) [192.81.229.181]:40228: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 13:25:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Wq0MtdBFesTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 13:25:47 host2 sshd[1528574]: Disconnected from invalid user  62.60.131.157 port 51286 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 13:27:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<dsAlu9BFlI5ntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-13 13:27:41 dovecot_plain authenticator failed for (halout) [92.62.243.174]:32965: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-13 13:27:44 dovecot_plain authenticator failed for (preoventic) [176.113.155.132]:44647: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.215
country_id: 3175395
description:
Dec 13 13:29:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.26.179.215, lip=66.85.158.91, TLS, session=<Hns/v9BF6YLZGrPX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-12-13 13:29:29 dovecot_plain authenticator failed for (salkass) [65.20.129.67]:37468: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-13 13:29:30 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:35283: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 13:29:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<+hXSwtBF3p2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.96.213
country_id: 3996063
description:
Dec 13 13:29:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=138.122.96.213, lip=66.85.158.91, TLS, session=<cZdOwNBFbeaKemDV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-13 13:29:23 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:58204: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-12-13 13:30:23 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:43001: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.80
country_id: 6252001
description:
Dec 13 13:30:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.80, lip=66.85.158.92, TLS, session=<Fv4fxdBFUPjG6xhQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 13:31:19 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (packen) [96.230.65.90]:52296: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 13:32:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<SV49zdBFmsiB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-13 13:33:37 dovecot_login authenticator failed for (cm-84.210.149.45.get.no) [84.210.149.45]:48315: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 13:33:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<x62E0dBF0oK8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 13:35:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<HzgU2dBFSLzAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 13:36:11 host2 sshd[1536261]: Disconnected from invalid user admin 2.57.121.112 port 47386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 13:36:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<0Mre2dBF4qM+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 13:38:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<eR7S4tBFhl0vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-13 13:38:44 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:58672: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 13:39:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<7Cii5NBFWr1AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-13 13:38:22 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:47294: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-13 13:38:23 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:53390: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.77
country_id: 1733045
description:
2025-12-13 13:38:40 dovecot_login authenticator failed for ([49.125.201.77]) [49.125.201.77]:60394: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-12-13 13:39:25 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:46130: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 13:40:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<6yit6tBFkKil6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 13:41:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<1kUF69BFVtaB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 13:40:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<tspA6dBFVLyH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 13:43:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<sGgA89BFsKfO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2025-12-13 13:44:03 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:32870: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-13 13:44:44 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:52174: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2025-12-13 13:45:17 dovecot_login authenticator failed for ([177.236.146.149]) [177.236.146.149]:39506: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-13 13:45:33 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:56520: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 13:46:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50087: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 13:46:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<IBLv/9BFDKinrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 13:47:35 dovecot_plain authenticator failed for (subar) [64.72.74.162]:35062: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 13:48:29 host2 sshd[1544298]: Disconnected from invalid user user 2.57.121.25 port 14708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 13:49:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<YaDpCtFFBMSG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 13:50:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<gCaLC9FFwqV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 13:50:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Wp6TDNFFUtkuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-13 13:54:02 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:60800: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 13:53:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<JKlkF9FFnsykXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.154
country_id: 6252001
description:
Dec 13 13:53:34 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.133.154, lip=66.85.158.91, session=<TzgSGNFFYOKTuYWa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-13 13:53:37 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (dindiatine) [217.215.74.195]:56588: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-13 13:53:56 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:55766: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2025-12-13 13:54:19 dovecot_login authenticator failed for ([128.185.194.190]) [128.185.194.190]:44528: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.238.221.65
country_id: 3996063
description:
2025-12-13 13:54:21 dovecot_login authenticator failed for ([177.238.221.65]) [177.238.221.65]:49613: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 13:54:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<ttADHdFFcsMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 13:55:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Z0AnHtFFwsM+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 13:55:25 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (relheted) [96.230.65.90]:46746: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 13:57:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<7qJfJNFF9qEImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 13:56:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<iCRWItFFkKI+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 13:56:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Rhe2ItFFsL2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-13 13:57:51 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:60095: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-13 13:58:06 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:54299: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 13 13:58:14 host2 sshd[1551285]: Disconnected from invalid user bank 103.26.136.173 port 46898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-13 13:57:43 dovecot_plain authenticator failed for (dinop) [187.161.198.68]:41584: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-13 13:59:02 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:55500: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-13 13:59:16 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (unkireps) [67.173.58.47]:47802: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-13 13:58:46 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:35712: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 13:59:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<EivfLdFFaupo1joy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 13 13:59:59 host2 sshd[1552301]: Disconnected from invalid user lighthouse 103.26.136.173 port 42672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 13:59:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<IVWDLdFFQutetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.159.139.26
country_id: 6252001
description:
Dec 13 14:00:26 host2 sshd[1552803]: Disconnected from invalid user gabriel 43.159.139.26 port 44824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.2.208
country_id: 1819730
description:
Dec 13 14:00:43 host2 sshd[1552933]: Disconnected from invalid user rke 103.144.2.208 port 48700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.159.139.26
country_id: 6252001
description:
Dec 13 14:01:41 host2 sshd[1553482]: Disconnected from invalid user steam 43.159.139.26 port 42660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-13 14:02:50 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12173: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2025-12-13 14:03:13 dovecot_login authenticator failed for ([103.79.237.54]) [103.79.237.54]:53136: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.2.208
country_id: 1819730
description:
Dec 13 14:03:17 host2 sshd[1554788]: Disconnected from invalid user ubuntu 103.144.2.208 port 50566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 14:02:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<MnorONFF/uYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-13 14:03:43 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:44144: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-13 14:04:02 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:45036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 14:03:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<TufOOtFFpo4IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-12-13 14:03:21 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:55140: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.44.136.205
country_id: 1269750
description:
2025-12-13 14:04:39 dovecot_login authenticator failed for ([103.44.136.205]) [103.44.136.205]:60110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 13 14:04:58 host2 sshd[1555744]: Disconnected from invalid user app 118.194.231.208 port 58942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 13 14:05:08 host2 sshd[1555954]: Disconnected from invalid user ian 103.26.136.173 port 54966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 13 14:06:15 host2 sshd[1556587]: Disconnected from invalid user sambauser 118.194.231.208 port 59074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 13 14:06:33 host2 sshd[1556733]: Disconnected from invalid user dspace 103.26.136.173 port 54444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-13 14:06:47 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (gamster) [67.173.58.47]:49878: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 13 14:08:10 host2 sshd[1557499]: Disconnected from invalid user guest 118.194.231.208 port 59268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.61
country_id: 6252001
description:
Dec 13 14:08:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.61, lip=66.85.158.91, session=<dExgTNFFBOMUQcM9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 14:08:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<0BFfTNFFLri8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.167.44
country_id: 6252001
description:
Dec 13 14:08:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.84.167.44, lip=66.85.158.92, session=<WotVTdFFXKIUVKcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-13 14:08:57 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:38916: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-13 14:09:20 dovecot_login authenticator failed for ([182.95.119.118]) [182.95.119.118]:54090: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-13 14:09:50 dovecot_login authenticator failed for ([47.247.80.227]) [14.195.19.75]:36146: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 14:10:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<4BgfVdFFUKgI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 14:10:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mAFoVNFFfs9m1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-13 14:11:59 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:50494: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 14:12:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<H23ZWdFFsr9npBQq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 13 14:11:25 host2 sshd[1559317]: Disconnected from invalid user gabriel 118.194.231.208 port 59606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-13 14:11:36 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:45342: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 14:13:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<9gObXtFFbKXCBa8Y>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.203.8.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 168.203.8.68 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 14:14:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<4ny5Y9FFJoM+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 14:16:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<czJIatFFkpQ+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 14:16:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<NZFDa9FFMs3D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 14:19:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Cj02dtFF1pwv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-13 14:21:24 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (inize) [71.224.169.28]:51074: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-13 14:22:40 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:41370: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 14:22:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<GMLlgNFFxLTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-13 14:22:58 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:45842: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 13 14:24:51 host2 sshd[1566263]: Disconnected from invalid user elasticsearch 104.248.245.89 port 39454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 14:26:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<LCETjNFFaumKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-13 14:26:06 dovecot_plain authenticator failed for (zizeng) [176.113.155.132]:41213: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 14:26:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<rntbjtFFuLVntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 13 14:26:19 host2 sshd[1567331]: Disconnected from invalid user transmission 190.60.51.173 port 59694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2025-12-13 14:27:40 dovecot_login authenticator failed for (aes-static-097.188.22.125.airtel.in) [122.184.118.126]:49026: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 13 14:27:51 host2 sshd[1568344]: Disconnected from invalid user a 190.60.51.173 port 52490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-12-13 14:27:51 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:49687: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 14:27:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<q0rwktFFnr4+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Dec 13 14:27:26 host2 sshd[1568111]: Disconnected from invalid user daisy 81.192.46.49 port 41514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-13 14:28:21 dovecot_login authenticator failed for ([182.95.63.50]) [182.95.63.50]:40088: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Dec 13 14:28:36 host2 sshd[1568782]: Disconnected from invalid user r 81.192.46.49 port 38244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-13 14:28:49 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:47034: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 13 14:28:56 host2 sshd[1569020]: Disconnected from invalid user sepehr 27.254.149.199 port 44606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-13 14:29:00 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:37660: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.49
country_id: 2542007
description:
Dec 13 14:29:08 host2 sshd[1569166]: Disconnected from invalid user release 81.192.46.49 port 50724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 13 14:29:12 host2 sshd[1569191]: Disconnected from invalid user sepehr 190.60.51.173 port 42424 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-13 14:29:57 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:59626: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 13 14:29:36 host2 sshd[1569385]: Disconnected from invalid user seal 27.254.149.199 port 57988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Dec 13 14:29:41 host2 sshd[1569432]: Disconnected from invalid user lab 81.192.46.49 port 34968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 13 14:30:22 host2 sshd[1570012]: Disconnected from invalid user esuser 202.165.22.246 port 40932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-12-13 14:30:28 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:42976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.209.254
country_id: 6252001
description:
Dec 13 14:31:56 host2 sshd[1571011]: Disconnected from invalid user winter 107.175.209.254 port 56600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 13 14:31:29 host2 sshd[1570670]: Disconnected from invalid user lab 190.60.51.173 port 45980 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 14:31:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<OSNaoNFFWuy8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 13 14:31:54 host2 sshd[1570994]: Disconnected from invalid user alumno 104.248.245.89 port 33164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 13 14:32:26 host2 sshd[1571325]: Disconnected from invalid user crypto 202.165.22.246 port 50732 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 14:33:04 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (untinal) [196.47.172.253]:58094: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 14:33:09 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (gotymphass) [96.230.65.90]:33362: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-13 14:33:12 dovecot_plain authenticator failed for (eprocy) [178.158.142.39]:32888: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.96
country_id: 2542007
description:
2025-12-13 14:33:54 dovecot_login authenticator failed for ([105.73.203.96]) [105.73.203.96]:41420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-13 14:34:15 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:57198: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 13 14:33:43 host2 sshd[1572117]: Disconnected from invalid user cms 104.248.245.89 port 48074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 14:33:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<dAXEp9FFTo3AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-12-13 14:35:08 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:52770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-13 14:34:31 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:48836: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.191
country_id: 1733045
description:
2025-12-13 14:34:33 dovecot_login authenticator failed for ([49.124.159.191]) [49.124.159.191]:37494: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.209.254
country_id: 6252001
description:
Dec 13 14:34:47 host2 sshd[1572784]: Disconnected from invalid user sammy 107.175.209.254 port 43848 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 14:35:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<b8ggrtFFLJWB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-13 14:35:37 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (muffludes) [68.38.201.238]:54684: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 14:35:27 host2 sshd[1573304]: Disconnected from invalid user odoo 62.60.131.157 port 58717 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 14:35:33 dovecot_plain authenticator failed for (betation) [154.144.243.93]:33312: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 14:36:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<uK30stFFsJyB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 14:37:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<thHetdFFHKdAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 14:37:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<tyy4tdFFXh0vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-13 14:39:19 dovecot_plain authenticator failed for (intables) [24.105.248.218]:57610: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 14:42:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<IdEzxdFFlN2H6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-12-13 14:42:08 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:47195: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-13 14:41:56 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:54006: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 14:42:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<9cGiyNFFIOfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 14:42:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<fOsTx9FF6JSl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Dec 13 14:44:10 host2 sshd[1578957]: Disconnected from invalid user alumno 160.251.251.171 port 41328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-13 14:44:37 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:33812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.61.131.129
country_id: 2510769
description:
2025-12-13 14:44:50 dovecot_login authenticator failed for 129.red-83-61-131.dynamicip.rima-tde.net [83.61.131.129]:33135: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.178
country_id: 3017382
description:
Dec 13 14:45:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.178, lip=66.85.158.91, session=</7+e0tFFba1bxJiy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.215
country_id: 3017382
description:
Dec 13 14:46:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.215, lip=66.85.158.91, session=<7o6209FFF5xbxJjX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.210
country_id: 3017382
description:
Dec 13 14:45:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.210, lip=66.85.158.91, session=<g30B0tFFKatbxJjS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-13 14:45:41 dovecot_plain authenticator failed for (beack) [192.81.229.181]:44408: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.159
country_id: 6252001
description:
2025-12-13 14:49:13 dovecot_login authenticator failed for ([72.214.132.159]) [72.214.132.159]:54759: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-13 14:48:38 dovecot_login authenticator failed for ([89.218.247.234]) [89.218.247.234]:55416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 14:48:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<5sXx3NFFos0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 14:49:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</5qs39FFg0l100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 14:50:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Jecv5NFFBLuG0Wp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Dec 13 14:51:40 host2 sshd[1584233]: Disconnected from invalid user seal 160.251.251.171 port 41796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 14:52:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<VFiO6dFFwog+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 14:53:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<AenC7NFFxIEI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-12-13 14:53:42 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:54525: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-13 14:53:50 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:60267: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2025-12-13 14:53:57 dovecot_login authenticator failed for ([125.19.183.66]) [125.19.183.66]:34160: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-13 14:54:04 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:48798: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 14:54:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<WUaO8NFFgrmkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 14:54:38 host2 sshd[1586983]: Disconnected from invalid user user 2.57.121.25 port 10563 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-12-13 14:54:55 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:54625: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.251.171
country_id: 1861060
description:
Dec 13 14:54:54 host2 sshd[1587326]: Disconnected from invalid user sftpuser 160.251.251.171 port 33288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-13 14:55:10 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:52919: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 14:57:54 host2 sshd[1589996]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 14:57:47 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (etifibele) [85.225.19.144]:52164: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-13 14:57:51 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (seccle) [24.23.125.83]:36580: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 14:57:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<9Sjf/NFFXtSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-13 15:01:04 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:46397: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 15:00:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<y5DABtJF+LEro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-13 15:00:32 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:55783: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-13 15:00:36 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:41336: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 15:01:48 host2 sshd[1592553]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 15:01:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<H80kC9JFl8tetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 15:01:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<6p3iC9JF6OQ+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.136
country_id: 3469034
description:
Dec 13 15:03:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.92.247.136, lip=66.85.158.91, TLS, session=<eEpBEdJFPYGxXPeI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.50
country_id: 3175395
description:
Dec 13 15:03:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=185.15.170.50, lip=66.85.158.91, TLS, session=<AIVkEtJFZ4u5D6oy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 15:04:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<HfIhFtJFsuIImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 15:06:08 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (efooching) [196.47.172.253]:32809: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 15:07:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<byXUH9JFANhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 15:07:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<CzlyIdJFULG8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 15:09:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<yu2xJdJFAL9npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 15:08:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<hG+CI9JF1s0IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 15:08:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<7Sr9JNJFoqUI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.230
country_id: 6252001
description:
Dec 13 15:09:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.230, lip=66.85.158.91, TLS, session=<dE9SKdJFYPvG6xjm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 15:10:25 host2 sshd[1598685]: Disconnected from invalid user debian 62.60.131.157 port 31936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.117.114
country_id: 3865483
description:
2025-12-13 15:10:40 dovecot_login authenticator failed for (red.170.233.117.114.ssservicios.com.ar) [170.233.117.114]:51841: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 15:10:49 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:36020: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.17
country_id: 6252001
description:
2025-12-13 15:11:13 dovecot_login authenticator failed for wsip-184-191-243-17.fv.ks.cox.net [184.191.243.17]:52148: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-13 15:11:18 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:33473: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-13 15:12:15 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (chelly) [73.208.81.125]:34066: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.188.177
country_id: 6252001
description:
Dec 13 15:12:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.232.188.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<teQtM9JFsp2s6Lyx>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.232.188.177
country_id: 6252001
description:
Dec 13 15:12:56 host2 pure-ftpd[1600273]: (?@172.232.188.177) [INFO] New connection from 172.232.188.177


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 15:13:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<paLrNNJFPNPD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 15:13:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<mpAUNdJFpNHCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-12-13 15:14:10 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:44008: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-13 15:14:51 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:42877: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.198.29
country_id: 1522867
description:
2025-12-13 15:14:38 dovecot_login authenticator failed for 2.133.198.29.dynamic.telecom.kz [2.133.198.29]:47133: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-12-13 15:15:19 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:58212: 535 Incorrect authentication data (set_id=washeera)


