# incident

plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec  7 02:10:34 host2 pure-ftpd[1830955]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 02:10:41 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Wbg1k05FFtkXXz9j>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.178.191.18
country_id: 1210997
description:
Dec  7 02:17:14 host2 pure-ftpd[1839285]: (?@103.178.191.18) [INFO] New connection from 103.178.191.18


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.178.191.18
country_id: 1210997
description:
Dec  7 02:21:45 host2 pure-ftpd[1843934]: (?@103.178.191.18) [INFO] New connection from 103.178.191.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-07 02:26:13 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (slable) [24.1.200.187]:43410: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-07 02:26:16 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (mated) [174.169.224.27]:54938: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 02:28:27 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<FbS80k5F3o9RvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.224.152.12
country_id: 3175395
description:
2025-12-07 02:31:23 dovecot_plain authenticator failed for (mutize) [83.224.152.12]:44750: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 02:36:18 host2 sshd[1859406]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-07 02:36:28 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:58621: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-07 02:37:03 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:36568: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 02:41:49 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-07 02:43:04 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (kamideroes) [73.145.107.251]:57020: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-07 02:44:00 dovecot_login authenticator failed for ([84.213.189.159]) [84.213.189.159]:44235: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-07 02:44:20 dovecot_login authenticator failed for 109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:33606: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 02:45:15 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-07 02:48:11 dovecot_plain authenticator failed for (bactoutess) [91.73.188.251]:41416: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 02:48:13 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (pareptight) [71.235.225.181]:33348: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.100.110
country_id: 1819730
description:
[2025-12-07 02:47:47 +0530] info [webmaild] 196.251.100.110 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.192
country_id: 6252001
description:
Dec  7 02:50:39 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9f43Ik9FH8GTuYTA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-07 02:55:10 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (aping) [69.142.126.37]:49286: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 03:02:39 host2 sshd[1890235]: Disconnected from invalid user user 2.57.121.25 port 15449 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Dec  7 03:03:34 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<db9qUE9FP8LN0h/z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-07 03:07:21 dovecot_login authenticator failed for ([80.88.102.128]) [80.88.102.128]:50356: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.254
country_id: 3469034
description:
Dec  7 03:06:44 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=191.240.36.254, lip=66.85.158.91, TLS, session=<0kK2Wk9FNMW/8CT+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.171.192
country_id: 798544
description:
Dec  7 03:07:02 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.171.192, lip=66.85.158.91, TLS, session=<WWXVW09FcLOwZ6vA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-07 03:07:53 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:5997: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-07 03:08:18 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:40972: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.146
country_id: 6252001
description:
2025-12-07 03:10:25 dovecot_login authenticator failed for ([70.174.167.146]) [70.174.167.146]:39113: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-07 03:10:40 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:44453: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.126
country_id: 1269750
description:
Dec  7 03:12:50 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=103.30.83.126, lip=66.85.158.91, TLS, session=<bHd0cE9F5NdnHlN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.71
country_id: 953987
description:
Dec  7 03:13:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.64.46.71, lip=66.85.158.91, TLS, session=<GD24cU9FJrpmQC5H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.235.31.47
country_id: 6252001
description:
Dec  7 03:15:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=50.235.31.47, lip=66.85.158.91, session=<hxXmeU9FoI8y6x8v>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.140.76.129
country_id: 2542007
description:
[2025-12-07 03:15:33 +0530] info [cpaneld] 41.140.76.129 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 24.104.225.201
country_id: 6252001
description:
Dec  7 03:15:40 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 19 secs): user=<hr@lezzarotech.com>, method=LOGIN, rip=24.104.225.201, lip=66.85.158.91, session=<cMeSek9FLuAYaOHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 24.97.253.246
country_id: 6252001
description:
Dec  7 03:15:54 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 13 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=24.97.253.246, lip=66.85.158.91, TLS, session=<Z+TCe09FiIoYYf32>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.126.144.30
country_id: 6252001
description:
Dec  7 03:16:20 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr>, method=PLAIN, rip=69.126.144.30, lip=66.85.158.91, session=<7InYfU9FZfdFfpAe>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec  7 03:17:01 host2 pure-ftpd[1905459]: (?@167.94.146.50) [INFO] New connection from 167.94.146.50


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.64.30.151
country_id: 1643084
description:
Dec  7 03:16:47 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<hr>, method=PLAIN, rip=36.64.30.151, lip=66.85.158.91, TLS, session=<9GVXfk9FCpUkQB6X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-07 03:21:37 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (saling) [73.195.211.98]:42000: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-07 03:22:29 dovecot_plain authenticator failed for (gaurpoed) [41.239.157.41]:57216: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-07 03:24:50 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (sunmucures) [76.145.10.140]:51100: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.81
country_id: 6252001
description:
Dec  7 03:25:49 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.81, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<3FAFoE9FiseTuYRR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.21.10
country_id: 3469034
description:
2025-12-07 03:28:10 dovecot_login authenticator failed for ([177.125.22.55]) [177.125.21.10]:44204: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-07 03:27:47 dovecot_login authenticator failed for ([149.54.15.90]) [149.54.15.90]:45189: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:29:21 host2 sshd[1917396]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:29:55 host2 sshd[1918345]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.221
country_id: 6252001
description:
Dec  7 03:30:47 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AGPFsU9F/87N0h/d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 03:35:18 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<lEnOwU9FOIwXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:36:58 host2 sshd[1927216]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.191.118
country_id: 3144096
description:
2025-12-07 03:37:12 dovecot_login authenticator failed for (cm-178.232.191.118.get.no) [178.232.191.118]:50399: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-07 03:36:54 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:44564: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.53.38.51
country_id: 6251999
description:
2025-12-07 03:39:53 dovecot_plain authenticator failed for (unignessis) [24.53.38.51]:36792: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-12-07 03:42:29 dovecot_login authenticator failed for ([115.248.153.209]) [115.248.4.85]:57273: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-07 03:43:10 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:50021: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:43:54 host2 sshd[1934533]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-07 03:44:51 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (obrat) [73.199.161.144]:49128: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 03:48:16 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<sz4w8E9FiMwXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 03:48:48 host2 sshd[1942588]: Disconnected from invalid user admin 2.57.121.112 port 43852 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:52:29 host2 sshd[1946794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-07 03:54:06 dovecot_plain authenticator failed for (poson) [24.105.248.218]:35128: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-07 03:54:19 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:50170: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-07 03:53:39 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:53728: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.250
country_id: 6252001
description:
2025-12-07 03:53:44 dovecot_login authenticator failed for wsip-184-191-242-250.fv.ks.cox.net [184.191.242.250]:46969: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-07 03:53:46 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:42154: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.196.233
country_id: 3996063
description:
2025-12-07 03:53:57 dovecot_login authenticator failed for ([201.173.196.233]) [201.173.196.233]:56493: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-07 03:54:02 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:39511: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 03:54:43 host2 sshd[1950434]: Disconnected from invalid user admin 2.57.121.112 port 51043 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 03:55:43 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-07 03:56:33 dovecot_plain authenticator failed for (arping) [81.0.54.119]:48296: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-07 03:56:36 dovecot_plain authenticator failed for (unanced) [41.239.157.41]:32832: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec  7 03:58:05 host2 pure-ftpd[1954758]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.158.157
country_id: 6252001
description:
Dec  7 03:58:11 host2 sshd[1954856]: Invalid user cloudtourssrilan_travel from 64.23.158.157 port 33974


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.158.157
country_id: 6252001
description:
Dec  7 03:59:05 host2 sshd[1955899]: Invalid user cloudtourssrilan_travel from 64.23.158.157 port 51212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.145
country_id: 6252001
description:
2025-12-07 04:01:12 dovecot_login authenticator failed for ([70.174.167.145]) [70.174.167.145]:52382: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-07 04:01:40 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:42950: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.165
country_id: 798544
description:
Dec  7 04:02:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=91.238.166.165, lip=66.85.158.91, TLS, session=<JnQuIVBFHetb7qal>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.118.132
country_id: 3469034
description:
Dec  7 04:02:34 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.87.118.132, lip=66.85.158.91, TLS, session=<se1kIlBFEMmxV3aE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:03:13 host2 sshd[1959599]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.6.216
country_id: 3144096
description:
2025-12-07 04:04:54 dovecot_login authenticator failed for ([178.232.6.216]) [178.232.6.216]:37797: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-07 04:05:11 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:33592: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-07 04:07:10 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:59244: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  7 04:06:45 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<vFpmMlBFuLCLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-07 04:06:53 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:45870: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.105.244
country_id: 6252001
description:
Dec  7 04:09:12 host2 pure-ftpd[1966630]: (?@20.64.105.244) [INFO] New connection from 20.64.105.244


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.30.183.186
country_id: 1643084
description:
[2025-12-07 04:09:54 +0530] info [cpaneld] 103.30.183.186 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:15:17 host2 sshd[1973132]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.109
country_id: 6252001
description:
Dec  7 04:15:02 host2 pure-ftpd[1973979]: (?@66.240.236.109) [INFO] New connection from 66.240.236.109


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:15:43 host2 sshd[1973999]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-07 04:18:33 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:56668: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.129.182
country_id: 3144096
description:
2025-12-07 04:18:59 dovecot_login authenticator failed for ([188.124.129.182]) [188.124.129.182]:53864: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 04:22:15 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:22:42 host2 sshd[1983364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec  7 04:23:57 host2 sshd[1985999]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 5053


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec  7 04:26:00 host2 sshd[1988885]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 10014


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 04:26:32 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 04:27:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63768: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:29:10 host2 sshd[1993340]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-07 04:30:32 dovecot_login authenticator failed for ([180.94.75.110]) [180.94.75.110]:60592: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-07 04:30:49 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:33254: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-07 04:31:46 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (worner) [98.193.112.85]:50746: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-07 04:32:26 dovecot_plain authenticator failed for (besslumpy) [65.20.129.28]:33450: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:35:02 host2 sshd[2000515]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.79
country_id: 6252001
description:
Dec  7 04:35:05 host2 pure-ftpd[2001700]: (?@147.185.132.79) [INFO] New connection from 147.185.132.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-07 04:35:11 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:40350: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-07 04:35:23 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:51775: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-07 04:34:57 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:48271: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-12-07 04:35:06 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:36696: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-07 04:35:17 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:62982: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-12-07 04:34:42 dovecot_login authenticator failed for ([103.57.184.151]) [103.57.184.151]:51528: 535 Incorrect authentication data


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:35:44 host2 sshd[2001267]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-07 04:37:24 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (dulank) [66.177.30.53]:43076: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:42:27 host2 sshd[2009747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-07 04:44:15 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (mistriess) [185.62.224.44]:52990: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-07 04:45:06 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (husies) [68.52.119.193]:48988: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:47:49 host2 sshd[2017810]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.201
country_id: 2635167
description:
Dec  7 04:51:16 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.211.201, lip=66.85.158.91, session=<kzKT0VBFWuYjy9PJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-07 04:53:31 dovecot_plain authenticator failed for (durimal) [102.53.15.180]:56875: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:55:18 host2 sshd[2025189]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.206
country_id: 1269750
description:
2025-12-07 04:55:14 dovecot_login authenticator failed for (nsg-static-113.51.72.182.airtel.in) [182.95.63.206]:54776: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-07 04:55:24 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:57419: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-07 04:55:29 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:53904: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:55:37 host2 sshd[2025754]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-07 04:56:19 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:49568: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2025-12-07 04:55:40 dovecot_login authenticator failed for ([87.200.93.86]) [87.200.93.86]:43018: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-07 04:55:54 dovecot_login authenticator failed for ([180.94.75.42]) [180.94.75.42]:52156: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-07 04:59:44 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (veled) [71.230.228.16]:40512: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:00:57 host2 sshd[2031450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-07 05:01:13 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:53401: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-07 05:01:33 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:60993: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec  7 05:03:55 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.91, TLS: Connection closed, session=<ex7f/lBFUrhChJmI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:07:18 host2 sshd[2037632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:07:44 host2 sshd[2038087]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.93
country_id: 6252001
description:
Dec  7 05:09:54 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<J8Q3FFFFAsSTuYRd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-07 05:10:13 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:36989: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.228.11.195
country_id: 6252001
description:
2025-12-07 05:10:29 dovecot_plain authenticator failed for c-71-228-11-195.hsd1.il.comcast.net (mawismies) [71.228.11.195]:34170: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.96
country_id: 6252001
description:
Dec  7 05:11:42 host2 pure-ftpd[2042199]: (?@195.184.76.96) [INFO] New connection from 195.184.76.96


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.101
country_id: 6252001
description:
Dec  7 05:11:42 host2 pure-ftpd[2042193]: (?@195.184.76.101) [INFO] New connection from 195.184.76.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.246.59.113
country_id: 6252001
description:
[2025-12-07 05:12:38 +0530] info [whostmgrd] 98.246.59.113 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:18:14 host2 sshd[2048657]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:18:43 host2 sshd[2049233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-07 05:21:02 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (avoking) [98.193.112.85]:38164: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-07 05:28:38 dovecot_plain authenticator failed for (hablete) [80.227.102.242]:38500: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:29:43 host2 sshd[2061852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.153
country_id: 2186224
description:
2025-12-07 05:29:52 dovecot_login authenticator failed for ([121.73.169.153]) [121.73.169.153]:37170: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-07 05:29:32 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:42464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.62.243.154
country_id: 732800
description:
Dec  7 05:34:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=92.62.243.154, lip=66.85.158.91, TLS, session=<EzkqalFF+9RcPvOa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.45
country_id: 3865483
description:
Dec  7 05:33:54 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=190.181.89.45, lip=66.85.158.91, TLS, session=<xETqaFFF9IC+tVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Dec  7 05:34:45 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS: Connection closed, session=<XG4cbVFFwoWnXpI2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:35:38 host2 sshd[2067415]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 05:38:51 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-07 05:41:25 dovecot_login authenticator failed for ([77.89.143.122]) [77.89.143.122]:51512: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-07 05:41:48 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:53882: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:44:44 host2 sshd[2075663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:45:31 host2 sshd[2076681]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-07 05:47:17 dovecot_login authenticator failed for ([149.54.15.90]) [149.54.15.90]:43215: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-07 05:47:37 dovecot_login authenticator failed for 61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:43946: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-07 05:48:30 dovecot_plain authenticator failed for (accise) [75.97.190.237]:33936: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-07 05:48:35 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (kinald) [196.47.172.253]:39382: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.185
country_id: 3996063
description:
Dec  7 05:53:28 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.122.97.185, lip=66.85.158.91, TLS, session=<553jrlFF1L2KemG5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-07 05:53:02 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (unalisa) [24.1.200.187]:48924: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.73
country_id: 3469034
description:
Dec  7 05:53:06 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.44.71.73, lip=66.85.158.91, TLS, session=<LLyJrVFF59ixLEdJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-07 05:53:16 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (penturuss) [74.218.95.154]:60562: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.166
country_id: 3175395
description:
Dec  7 05:53:58 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.234.166, lip=66.85.158.91, TLS, session=<3mDbsFFFJZyrFuqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.199
country_id: 3469034
description:
Dec  7 05:53:40 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.44.96.199, lip=66.85.158.91, TLS, session=<fQWZr1FF8qyxLGDH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:54:36 host2 sshd[2086340]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-07 05:55:27 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:53662: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 05:54:56 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:7132: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-07 05:55:33 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (chick) [51.195.117.220]:40841: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-07 05:57:06 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (zated) [68.40.189.43]:35706: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-07 06:00:59 dovecot_plain authenticator failed for (hamal) [41.239.157.41]:47666: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-07 06:01:33 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:58686: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-07 06:01:46 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:45565: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 06:05:52 host2 sshd[2100730]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-07 06:05:54 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:58456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-07 06:06:12 dovecot_login authenticator failed for (aes-static-177.143.22.125.airtel.in) [128.185.239.182]:45934: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-07 06:07:54 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:41290: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-07 06:08:12 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:52798: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-07 06:13:12 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (callous) [73.13.220.220]:36652: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 06:15:51 host2 sshd[2111246]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 06:21:59 host2 sshd[2118182]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-07 06:22:21 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:38893: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-07 06:22:53 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:59350: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-07 06:24:47 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (pacet) [73.213.236.66]:57060: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-12-07 06:26:56 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:41710: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-07 06:27:05 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:53638: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 06:36:29 dovecot_plain authenticator failed for (metriale) [96.85.104.2]:45208: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.42.170
country_id: 1821275
description:
2025-12-07 06:45:52 dovecot_login authenticator failed for (n12531z42l170.static.ctmip.net) [125.31.42.170]:43180: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-07 06:46:33 dovecot_login authenticator failed for (cm-84.211.10.140.get.no) [84.211.10.140]:57750: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-07 06:48:07 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:36381: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-07 06:48:37 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:54792: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.250
country_id: 3017382
description:
Dec  7 06:58:36 host2 pure-ftpd[2149059]: (?@91.231.89.250) [INFO] New connection from 91.231.89.250


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.153
country_id: 3017382
description:
Dec  7 06:58:37 host2 pure-ftpd[2149065]: (?@91.231.89.153) [INFO] New connection from 91.231.89.153


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:02:17 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<0RIuplJFUsMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:03:07 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<r1YnqVJFRusDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 07:04:03 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (foridia) [71.235.225.181]:52822: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:04:46 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<wjwEr1JFcrkDhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 07:05:27 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-07 07:06:26 dovecot_plain authenticator failed for (sexcid) [199.192.123.12]:50570: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:05:36 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<uxQDslJFpIgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:06:41 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<QBrktVJF8NADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:07:55 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<vQZGulJFnMADhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:08:19 host2 dovecot[2150]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<332zu1JF7O0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:08:46 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<mZ9TvVJFGIsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:09:38 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<nEtrwFJFMpMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-07 07:11:32 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:44497: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.36
country_id: 6252001
description:
Dec  7 07:25:23 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.36, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2hzB+FJFSczG6xgk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 07:27:50 dovecot_plain authenticator failed for (fempelery) [96.85.104.2]:47934: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.28
country_id: 3175395
description:
Dec  7 07:27:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.15.169.28, lip=66.85.158.91, TLS, session=<VQL7AFNF1qG5D6kc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.115.3
country_id: 3469034
description:
Dec  7 07:28:23 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=177.87.115.3, lip=66.85.158.91, TLS, session=<MLo9AlNFCeyxV3MD>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  7 07:30:12 host2 sshd[2175828]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-07 07:31:17 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:51964: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-07 07:31:33 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:37476: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-07 07:33:27 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (tives) [73.68.220.15]:49644: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-07 07:33:24 dovecot_plain authenticator failed for (viumdines) [192.81.229.179]:55050: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 07:39:19 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (borermies) [87.103.126.54]:8248: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.205.208
country_id: 99237
description:
Dec  7 07:40:42 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=65.20.205.208, lip=66.85.158.91, TLS, session=<hqd8LlNFs9hBFM3Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-07 07:40:21 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (bavinve) [76.145.10.140]:44654: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.240
country_id: 798544
description:
Dec  7 07:40:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.236.172.240, lip=66.85.158.91, TLS, session=<OIOVL1NFApBb7Kzw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:43:35 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7TPZOVNFjc+TuYSh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:44:36 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<SgmAPVNFRPuTuYSh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-07 07:45:24 dovecot_plain authenticator failed for (hilly) [91.72.153.110]:35811: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 07:45:26 dovecot_plain authenticator failed for (outiverve) [96.85.104.2]:54104: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:44:54 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 22 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<QYGXPlNFRvuTuYSh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-07 07:48:02 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (cantogiet) [68.60.77.128]:49656: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-12-07 07:49:33 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:60025: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.99.190.167
country_id: 2186224
description:
2025-12-07 07:49:38 dovecot_login authenticator failed for (dynamic-cpe-pool.orcon.net.nz) [121.99.190.167]:59269: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-07 07:49:42 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:52896: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-07 07:49:46 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:56651: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-07 07:49:51 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:50269: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 07:50:27 host2 sshd[2193368]: Disconnected from invalid user user 2.57.121.25 port 55068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-07 07:50:04 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:41621: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 07:50:07 host2 sshd[2192974]: Disconnected from invalid user admin 2.57.121.112 port 57254 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:51:05 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS, session=<D4iqVFNFrvaTuYSh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:52:03 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS, session=<UngkWFNFguqTuYSh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 07:55:43 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (tabred) [71.235.225.181]:46436: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.55
country_id: 2264397
description:
Dec  7 07:55:59 host2 dovecot[2199651]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.55, lip=66.85.158.92, TLS, session=<qgM3ZlNFh4JtadI3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.52
country_id: 2264397
description:
Dec  7 07:55:59 host2 dovecot[2199651]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.52, lip=66.85.158.92, TLS, session=<nmUtZlNFvNttadI0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.54
country_id: 2264397
description:
Dec  7 07:56:00 host2 dovecot[2199651]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.210.54, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4SJFZlNFq4BtadI2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.53
country_id: 2264397
description:
Dec  7 07:56:04 host2 dovecot[2199651]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.53, lip=66.85.158.92, TLS, session=<tBCFZlNFx6VtadI1>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.210.53
country_id: 2264397
description:
Dec  7 07:55:55 host2 dovecot[2199651]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.53, lip=66.85.158.92, TLS, session=<IEz9ZVNFt61tadI1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.165.17
country_id: 149590
description:
2025-12-07 08:00:08 dovecot_plain authenticator failed for (5HJ30XO6291) [102.69.165.17]:53885: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-07 08:00:36 dovecot_plain authenticator failed for (aremorres) [5.11.140.219]:35420: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-07 08:00:40 dovecot_plain authenticator failed for (waimostom) [24.104.225.201]:59906: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 08:00:43 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (lenals) [87.103.126.54]:63732: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 08:03:32 host2 sshd[2208946]: Disconnected from invalid user user 2.57.121.25 port 33735 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.219
country_id: 2635167
description:
Dec  7 08:05:29 host2 dovecot[2208013]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.219, lip=66.85.158.91, TLS, session=<i8MwiFNFAZG594nb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 08:06:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<hWZHjFNFHM1RvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.26.159.5
country_id: 798549
description:
2025-12-07 08:08:28 dovecot_plain authenticator failed for (5HJ30XO6291) [188.26.159.5]:59099: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-07 08:09:58 dovecot_plain authenticator failed for (chaph) [209.173.10.75]:33954: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-07 08:10:00 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (tionactied) [98.227.25.115]:38430: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 08:10:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51872: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 08:10:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (comione) [87.103.126.54]:25375: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:16:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<cLMer1NFUL4DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-07 08:17:54 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (sampels) [71.224.169.28]:38302: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:18:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ftNFtVNFNrQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:20:15 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<BlX1vFNF/J4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:21:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PCXYwFNFIpcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:22:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<IV6Xw1NFHOUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-07 08:23:44 dovecot_plain authenticator failed for (enatibled) [46.10.210.68]:40143: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:24:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<RChmy1NFTuQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Dec  7 08:24:53 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.92, session=<r86NzVNF9IpHBpK6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.93
country_id: 3865483
description:
2025-12-07 08:25:23 dovecot_login authenticator failed for (static.94.254.104.190.cps.com.ar) [190.104.254.93]:56635: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:25:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=</Ewj0FNFPIQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-07 08:25:56 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:36839: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:25:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<cu+B0VNFvpsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.80
country_id: 6252001
description:
Dec  7 08:36:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.80, lip=66.85.158.92, TLS, session=<lb5/9VNFzPjN0h9Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-07 08:36:08 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (tasmering) [81.225.30.107]:60246: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-07 08:38:39 dovecot_plain authenticator failed for (balburytic) [65.20.153.146]:45232: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-07 08:39:51 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (unrevyic) [217.215.74.195]:46395: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-07 08:47:37 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:39196: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-07 08:47:47 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:37815: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.89.22.113
country_id: 3469034
description:
2025-12-07 08:47:49 dovecot_login authenticator failed for (177-89-22-113.cable.cabotelecom.com.br) [177.89.22.113]:55049: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.13.138.139
country_id: 3175395
description:
Dec  7 08:47:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=31.13.138.139, lip=66.85.158.91, TLS, session=<A/AYH1RFZqQfDYqL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-07 08:48:12 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:59064: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.105
country_id: 732800
description:
Dec  7 08:48:15 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.255.212.105, lip=66.85.158.91, TLS, session=<t5gqIFRFgJu5/9Rp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-07 08:48:27 dovecot_login authenticator failed for ([90.173.78.90]) [90.173.78.90]:51161: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-07 08:48:34 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:59930: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-07 08:52:00 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:59116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 08:52:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<qFStL1RFHNwXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-12-07 08:52:35 dovecot_login authenticator failed for (72-107-226-38.edgetelecom.com.br) [38.226.107.70]:58910: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.33
country_id: 2264397
description:
Dec  7 08:53:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=109.105.209.33, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<V2eaMlRFvZxtadEh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.32
country_id: 2264397
description:
Dec  7 08:53:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=109.105.209.32, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<07BSMlRFoLVtadEg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.35
country_id: 2264397
description:
Dec  7 08:53:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.209.35, lip=66.85.158.91, TLS, session=<FyxgMlRF+4RtadEj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.34
country_id: 2264397
description:
Dec  7 08:53:03 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.34, lip=66.85.158.91, TLS, session=<I01IMlRFcaxtadEi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.160.96
country_id: 1643084
description:
[2025-12-07 08:56:30 +0530] info [cpaneld] 103.59.160.96 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-07 09:19:15 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:37110: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 09:19:30 host2 sshd[2282810]: Disconnected from invalid user irving 62.60.131.157 port 59133 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-07 09:18:59 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:41088: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-07 09:25:41 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (fosingly) [73.196.144.25]:41378: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.159.249.233
country_id: 1269750
description:
2025-12-07 09:29:49 dovecot_plain authenticator failed for (5D07V5) [103.159.249.233]:56793: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.159.249.233
country_id: 1269750
description:
2025-12-07 09:29:56 dovecot_login authenticator failed for (5D07V5) [103.159.249.233]:56793: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-12-07 09:31:24 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:35026: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-07 09:31:39 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:34424: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-07 09:31:05 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:51236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-07 09:32:07 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (unintic) [68.82.141.145]:52350: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.37.218
country_id: 2300660
description:
Dec  7 09:36:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.139.37.218, lip=66.85.158.91, TLS, session=<jMCVylRFzJEpiyXa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.38
country_id: 798544
description:
Dec  7 09:36:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=89.231.35.38, lip=66.85.158.91, TLS, session=<kJYKzFRFcqZZ5yMm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-07 09:39:47 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (bacel) [24.15.216.41]:52108: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-07 09:39:45 dovecot_plain authenticator failed for (deber) [102.53.15.18]:47402: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-12-07 09:41:51 dovecot_plain authenticator failed for (sultumoral) [109.226.27.227]:32949: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.52
country_id: 6252001
description:
Dec  7 09:43:30 host2 pure-ftpd[2306470]: (?@147.185.132.52) [INFO] New connection from 147.185.132.52


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-07 09:45:13 dovecot_plain authenticator failed for (undics) [75.97.190.237]:56290: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.56.59.77
country_id: 3175395
description:
2025-12-07 09:46:11 dovecot_login authenticator failed for host-79-56-59-77.retail.telecomitalia.it ([185.196.221.176]) [79.56.59.77]:42316: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-07 09:46:26 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:37801: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-07 09:46:40 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:56196: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-12-07 09:46:49 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:55300: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 09:46:02 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:44510: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec  7 09:47:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<am7W81RFkscs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-07 09:48:10 dovecot_plain authenticator failed for (disce) [24.187.213.29]:45322: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-07 09:51:07 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (forate) [73.213.237.28]:38942: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Dec  7 09:51:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.55, lip=66.85.158.91, TLS: Connection closed, session=<t+2CAVVFjKmnXpI3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.225
country_id: 953987
description:
Dec  7 09:53:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=102.129.56.225, lip=66.85.158.91, TLS, session=<a1AqClVFRK5mgTjh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-07 09:54:47 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (excered) [73.195.211.98]:49858: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.51
country_id: 99237
description:
Dec  7 09:54:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.143.51, lip=66.85.158.91, TLS, session=<bqRsC1VFF4hBFI8z>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 09:57:19 host2 sshd[2318829]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.100
country_id: 798544
description:
Dec  7 09:59:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=178.216.30.100, lip=66.85.158.91, TLS, session=<FTLdH1VFrrOy2B5k>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.132.230
country_id: 1269750
description:
Dec  7 10:00:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.59.132.230, lip=66.85.158.91, TLS, session=<FOj2IFVFkOdnO4Tm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 10:04:23 host2 sshd[2325651]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  7 10:07:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<A+HuO1VFEp0Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  7 10:08:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<QDetPlVFUKoDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  7 10:09:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wypAQlVFuOcDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-12-07 10:24:35 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:59028: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-07 10:25:00 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:36753: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 10:27:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<nQV+hVVFeOsXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.85
country_id: 6252001
description:
Dec  7 10:30:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.85, lip=66.85.158.91, TLS, session=<OPMSjVVFjvGTuYRV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec  7 10:34:46 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<CYwMnlVFXMU26lCA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 10:38:44 host2 sshd[2357125]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.127
country_id: 6252001
description:
Dec  7 10:39:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.127, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GnF8rVVFRO4UQcF/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 10:40:15 host2 sshd[2358789]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-07 10:43:29 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:57273: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-07 10:43:57 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:52550: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-07 10:45:02 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:58117: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-07 10:45:28 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:43880: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:47:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JurnyVVFAs+i2JXi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:48:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<d3zvzlVFFOGi2JXi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:49:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<gDrk0VVFCuai2JXi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.204.222
country_id: 3469034
description:
Dec  7 10:49:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.189.204.222, lip=66.85.158.91, TLS, session=<oSKc0VVFWqWzvcze>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 10:49:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<nX4f0VVFrugXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.79
country_id: 3175395
description:
Dec  7 10:49:09 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=195.177.113.79, lip=66.85.158.91, TLS, session=<6+p60FVFaqnDsXFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-07 10:53:01 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:35785: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-07 10:53:36 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:35110: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.198.1.124
country_id: 798544
description:
Dec  7 10:53:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=185.198.1.124, lip=66.85.158.91, TLS, session=<pvxo4VVFvYC5xgF8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.106.163
country_id: 3175395
description:
Dec  7 10:54:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts2>, method=PLAIN, rip=217.112.106.163, lip=66.85.158.91, TLS, session=<ZLx04lVFQ6DZcGqj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-07 10:54:15 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (mudinsum) [98.193.112.85]:51642: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.58
country_id: 953987
description:
Dec  7 10:55:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.64.42.58, lip=66.85.158.91, TLS, session=<kGVh5VVFrdBmQCo6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:55:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS, session=<dfvZ5lVFgOWi2JXi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.34.239
country_id: 6290252
description:
Dec  7 10:55:19 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=109.207.34.239, lip=66.85.158.91, TLS, session=<O/CU5lVFqpptzyLv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:57:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS, session=<AMUn71VF8uCi2JXi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.218.214
country_id: 1269750
description:
2025-12-07 11:00:22 dovecot_plain authenticator failed for (LF21D45A3WC8) [49.43.218.214]:58759: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.251
country_id: 6252001
description:
Dec  7 11:01:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.251, lip=66.85.158.91, TLS, session=<mrgy/VVFVPHN0h/7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.70
country_id: 6252001
description:
Dec  7 11:01:34 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Amvo/VVFuMHG6xhG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 11:02:19 host2 sshd[2379351]: Disconnected from invalid user user 2.57.121.25 port 30768 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.44
country_id: 6252001
description:
Dec  7 11:02:56 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.5.44, lip=66.85.158.91, TLS handshaking: Connection closed, session=<V/DDAlZFfNESYQUs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 11:06:19 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 11:07:48 host2 sshd[2384361]: Disconnected from invalid user jaxson 62.60.131.157 port 36656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.98.201.117
country_id: 2589581
description:
2025-12-07 11:09:02 dovecot_plain authenticator failed for (56QUULLY) [105.98.201.117]:60225: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-07 11:10:37 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:56667: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2025-12-07 11:09:56 dovecot_login authenticator failed for ([125.19.183.66]) [125.19.183.66]:33492: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-12-07 11:17:42 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:41642: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-07 11:17:02 dovecot_login authenticator failed for ([125.20.245.194]) [125.20.245.194]:51736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.63.161.126
country_id: 2510769
description:
2025-12-07 11:17:23 dovecot_login authenticator failed for static-126-161-63-95.ipcom.comunitel.net [95.63.161.126]:54813: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-07 11:17:23 dovecot_plain authenticator failed for (stite) [65.20.148.194]:48291: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-07 11:18:21 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:38344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-12-07 11:19:23 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:52866: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-07 11:19:42 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:45038: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-12-07 11:19:53 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:58046: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-12-07 11:19:55 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:49412: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.113
country_id: 2186224
description:
2025-12-07 11:20:15 dovecot_login authenticator failed for ([121.73.168.113]) [121.73.168.113]:54454: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec  7 11:20:52 host2 pure-ftpd[2397016]: (?@66.132.153.130) [INFO] New connection from 66.132.153.130


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 11:21:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<5n/qRFZFW8pRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-07 11:22:41 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:50365: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-12-07 11:23:05 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:16656: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 11:33:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<UuajcFZFMtoXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-07 11:33:53 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (super) [68.82.141.145]:34054: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2025-12-07 11:34:24 dovecot_plain authenticator failed for (brapheess) [50.215.95.14]:51034: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-07 11:34:38 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (elabayeds) [73.168.136.150]:57742: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 223.197.145.126
country_id: 1819730
description:
Dec  7 11:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<hr>, method=PLAIN, rip=223.197.145.126, lip=66.85.158.91, TLS, session=<hAULflZFJOLfxZF+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.219.104.210
country_id: 3175395
description:
Dec  7 11:37:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=188.219.104.210, lip=66.85.158.91, session=<SsASfVZFt5u822jS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-07 11:37:29 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (undmic) [73.144.27.228]:53756: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2025-12-07 11:38:14 dovecot_login authenticator failed for ([84.214.49.11]) [84.214.49.11]:38290: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.217
country_id: 6252001
description:
Dec  7 11:38:30 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.217, lip=66.85.158.92, session=<O8n6gVZFmOvG6xjZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-07 11:38:33 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:41141: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2025-12-07 11:38:34 dovecot_login authenticator failed for (abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:14957: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-07 11:39:04 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:44130: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.20.127.97
country_id: 3469034
description:
Dec  7 11:39:33 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 136 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=201.20.127.97, lip=66.85.158.91, session=<rR6lfVZFWI7JFH9h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-07 11:40:01 dovecot_plain authenticator failed for (partibugs) [178.250.191.189]:42330: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.109.189.167
country_id: 6252001
description:
2025-12-07 11:43:21 dovecot_plain authenticator failed for (overs) [75.109.189.167]:54054: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.240
country_id: 6252001
description:
Dec  7 11:43:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<j+DDlFZFltCTuYTw>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.62.247
country_id: 6252001
description:
Dec  7 11:44:28 host2 pure-ftpd[2417414]: (?@165.227.62.247) [INFO] New connection from 165.227.62.247


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 165.227.62.247
country_id: 6252001
description:
Dec  7 11:44:30 host2 pure-ftpd[2417447]: (?@165.227.62.247) [INFO] New connection from 165.227.62.247


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.46.20
country_id: 1269750
description:
2025-12-07 11:46:53 dovecot_plain authenticator failed for (P756S1ACH72QLPV) [152.59.46.20]:55043: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 11:47:39 host2 sshd[2421148]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.228
country_id: 3469034
description:
Dec  7 11:47:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.89.136.228, lip=66.85.158.91, TLS, session=<Jutrn1ZF8bC+WYjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.113
country_id: 798544
description:
Dec  7 11:47:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.113, lip=66.85.158.91, TLS, session=<mSKuoFZFlKAu4ydx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-07 11:47:51 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (mentical) [24.61.199.212]:45304: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.150.56
country_id: 99237
description:
Dec  7 11:53:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=65.20.150.56, lip=66.85.158.91, TLS, session=<g6jUtFZFDbxBFJY4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.46
country_id: 953987
description:
Dec  7 11:53:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.53.46, lip=66.85.158.91, TLS, session=<xjcCtlZFvJFmgTUu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 11:54:51 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57630: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-07 11:55:25 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (preancit) [73.144.27.228]:54516: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.96
country_id: 3996063
description:
2025-12-07 11:59:00 dovecot_login authenticator failed for (201.173.216.96-clientes-izzi.mx) [201.173.216.96]:52377: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-07 11:59:52 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:42891: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-07 11:59:07 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:46138: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-07 11:59:52 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36235: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-07 12:00:08 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:46123: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-07 12:00:18 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:45600: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 12:05:43 host2 sshd[2438164]: Disconnected from invalid user admin 2.57.121.112 port 43750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-07 12:09:39 dovecot_plain authenticator failed for (nomous) [102.53.15.56]:44526: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 12:09:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<lzPh8VZF28FRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-12-07 12:10:56 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:43318: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-12-07 12:11:37 dovecot_login authenticator failed for ([122.186.174.35]) [122.186.174.35]:44828: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-07 12:14:38 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (nocal) [68.40.189.43]:41834: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 12:23:44 host2 sshd[2453267]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 12:23:48 host2 sshd[2453406]: Disconnected from invalid user user 2.57.121.25 port 35715 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec  7 12:24:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<Gx7jJ1dFhIgsyhQX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 12:25:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Huk9KFdFZuwXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec  7 12:27:14 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<6gxIMFdFsKcs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2025-12-07 12:37:31 dovecot_login authenticator failed for (164-53-26-103.intechonline.net) [103.26.53.164]:46250: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.42.170
country_id: 1821275
description:
2025-12-07 12:37:31 dovecot_login authenticator failed for ([125.31.42.170]) [125.31.42.170]:45252: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-07 12:37:38 dovecot_plain authenticator failed for (cosite) [24.93.140.162]:38640: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-07 12:37:44 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:55246: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-07 12:37:47 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:55787: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-07 12:39:26 dovecot_login authenticator failed for ([41.65.118.172]) [41.239.157.41]:59944: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-12-07 12:39:38 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:52154: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.51
country_id: 3865483
description:
Dec  7 12:42:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=186.64.71.51, lip=66.85.158.91, TLS, session=<Z6J6ZFdF07W6QEcz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.76
country_id: 3469034
description:
Dec  7 12:42:29 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.44.71.76, lip=66.85.158.91, TLS, session=<2TavZVdFeomxLEdM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-07 12:49:41 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (rharper) [217.215.74.195]:52625: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-07 12:50:09 dovecot_login authenticator failed for ([125.19.156.2]) [125.19.156.2]:32822: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-07 12:50:32 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:50236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.122.21
country_id: 290557
description:
2025-12-07 12:50:58 dovecot_login authenticator failed for ([5.30.122.21]) [5.30.122.21]:56598: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-07 12:56:36 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (gueseso) [174.166.153.20]:57360: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 13:05:01 host2 sshd[2490422]: Disconnected from invalid user cailey 62.60.131.157 port 14777 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 13:10:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<SZ9Ny1dFgK4XXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 13:14:10 host2 sshd[2498839]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 13:20:52 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:33102: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-07 13:21:36 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:39194: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.84.152.142
country_id: 6252001
description:
Dec  7 13:24:28 host2 pure-ftpd[2507251]: (?@20.84.152.142) [INFO] New connection from 20.84.152.142


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.135.159
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.135.159: 250 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.135.159
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.135.159: 923 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec  7 13:29:04 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<TbxfDVhFOr426lCA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.112.52
country_id: 3865483
description:
Dec  7 13:30:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.110.112.52, lip=66.85.158.91, TLS, session=<ts/KElhFPOO+bnA0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 13:31:11 host2 sshd[2517168]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.121
country_id: 690791
description:
Dec  7 13:31:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.5.121, lip=66.85.158.91, TLS, session=<qNz+E1hFhr+wZwV5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2025-12-07 13:32:51 dovecot_login authenticator failed for (nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:38608: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-07 13:32:59 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:48242: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-07 13:36:48 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:43456: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-07 13:36:03 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:50478: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.159.20.41
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.159.20.41 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-07 13:40:08 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (neudotasm) [68.82.141.145]:53254: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.43.61
country_id: 3469034
description:
Dec  7 13:44:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=138.122.43.61, lip=66.85.158.91, TLS, session=<7J6iQVhFQKCKeis9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 13:44:11 host2 sshd[2526795]: Disconnected from invalid user user 2.57.121.25 port 51952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.35.88
country_id: 3175395
description:
Dec  7 13:44:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.239.35.88, lip=66.85.158.91, TLS, session=<NErcQlhFV5Sy7yNY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 13:45:51 dovecot_plain authenticator failed for (bysing) [154.146.240.123]:53820: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.183.30
country_id: 357994
description:
2025-12-07 13:48:08 dovecot_plain authenticator failed for (otcot) [41.33.183.30]:46973: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-07 13:48:38 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:49208: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-07 13:48:56 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:38233: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-07 13:52:26 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:37842: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-07 13:52:42 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:43300: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-07 13:58:57 dovecot_plain authenticator failed for (menot) [23.30.11.253]:38380: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.127
country_id: 3175395
description:
Dec  7 13:59:11 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=217.26.179.127, lip=66.85.158.91, TLS, session=<VdcbeFhF57TZGrN/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.136
country_id: 2300660
description:
Dec  7 13:59:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.0.136, lip=66.85.158.91, TLS, session=<NStAeVhFbNUpiwCI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-07 14:00:58 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (shandron) [73.137.7.97]:55826: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-07 14:02:46 dovecot_plain authenticator failed for (caint) [23.30.11.253]:50522: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-07 14:02:48 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (trier) [174.169.224.27]:37310: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.1.41
country_id: 6252001
description:
Dec  7 14:06:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.1.41, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<aHDnk1hF6s9o+AEp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 14:07:08 host2 sshd[2547243]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-07 14:10:04 dovecot_plain authenticator failed for (bighthes) [46.10.210.68]:60213: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-12-07 14:12:43 dovecot_login authenticator failed for ([217.26.194.79]) [217.26.194.79]:37373: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 14:21:07 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 14:24:12 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (chorcumid) [87.103.126.54]:20412: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 14:26:14 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 14:27:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<vrph3lhFepYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-07 14:27:37 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (plochness) [73.213.236.66]:45240: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-07 14:28:10 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:53179: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-07 14:29:30 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:39012: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-12-07 14:28:46 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:57142: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.59.26
country_id: 1880251
description:
2025-12-07 14:29:07 dovecot_login authenticator failed for (26.59.245.49.unknown.m1.com.sg) [49.245.59.26]:41170: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 14:33:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<ANDs8lhFQFVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-07 14:35:16 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (oaskess) [96.230.65.90]:39194: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 14:35:19 dovecot_plain authenticator failed for (liale) [96.85.104.2]:49134: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.242.50
country_id: 6252001
description:
Dec  7 14:37:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.65.242.50, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4Dt9AFlFtKqfQfIy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 14:37:51 host2 sshd[2572707]: Disconnected from invalid user admin 2.57.121.112 port 26140 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.178
country_id: 6252001
description:
Dec  7 14:40:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.178, lip=66.85.158.91, session=<7yVaDllFoOfG6xiy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-07 14:44:14 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (eckilomy) [96.230.65.90]:44264: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 14:44:32 host2 sshd[2579020]: Disconnected from invalid user charlene 62.60.131.157 port 22834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2025-12-07 14:48:36 dovecot_login authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:54087: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-07 14:48:43 dovecot_plain authenticator failed for (tracrupt) [5.32.99.14]:35943: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-12-07 14:49:07 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:53076: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.161.61.120
country_id: 1269750
description:
2025-12-07 14:53:47 dovecot_login authenticator failed for (abts-north-dynamic-120.61.161.122.airtelbroadband.in) [122.161.61.120]:44890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-07 14:54:09 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:55760: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 14:54:13 host2 sshd[2587521]: Disconnected from invalid user charlene 62.60.131.157 port 18794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-07 14:57:28 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:60514: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-12-07 14:58:23 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:40976: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-07 14:58:16 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (siveredis) [188.219.104.210]:47089: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-07 14:58:20 dovecot_plain authenticator failed for (decid) [65.20.147.45]:49016: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.115.51
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 77.68.115.51 - senthil@yashiholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-12-07 15:11:45 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:64417: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-07 15:12:00 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:56009: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 15:15:00 host2 sshd[2605244]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-07 15:15:47 dovecot_plain authenticator failed for (gartism) [94.201.22.158]:46232: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-07 15:15:51 dovecot_plain authenticator failed for (berorch) [5.31.15.108]:46692: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Dec  7 15:18:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.248, lip=66.85.158.92, TLS, session=<q2galllFdPTG6xj4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-07 15:23:08 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:60934: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-07 15:22:35 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:54506: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.71
country_id: 3996063
description:
2025-12-07 15:24:17 dovecot_login authenticator failed for (201.172.89.71-clientes-izzi.mx) [201.172.89.71]:32882: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.226
country_id: 6252001
description:
2025-12-07 15:25:18 dovecot_login authenticator failed for wsip-184-191-242-226.fv.ks.cox.net [184.191.242.226]:35540: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-12-07 15:24:42 dovecot_login authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:49844: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-07 15:24:43 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:56448: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.31.224
country_id: 290557
description:
2025-12-07 15:24:43 dovecot_login authenticator failed for ([91.74.31.224]) [91.74.31.224]:53313: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-12-07 15:25:11 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:39830: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-07 15:25:56 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:34879: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-07 15:26:33 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:59728: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 15:27:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (truff) [87.103.126.54]:42966: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec  7 15:27:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<wi8JtVlFRoyLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.129.81.82
country_id: 3202326
description:
2025-12-07 15:29:59 dovecot_plain authenticator failed for cpe-188-129-81-82.dynamic.amis.hr (7J2Z8VH88YREWO) [188.129.81.82]:5118: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-07 15:30:50 dovecot_plain authenticator failed for (mictes) [88.207.210.23]:62501: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.37.9
country_id: 3469034
description:
Dec  7 15:36:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=167.249.37.9, lip=66.85.158.91, TLS, session=<lW591VlFxImn+SUJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-07 15:36:33 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (strake) [73.68.220.15]:36310: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.168
country_id: 3175395
description:
Dec  7 15:36:34 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=194.60.212.168, lip=66.85.158.91, TLS, session=<Nb9p1FlFl+jCPNSo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-07 15:38:32 dovecot_plain authenticator failed for (nonopercan) [102.53.15.180]:17706: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.34.213.150
country_id: 798544
description:
Dec  7 15:38:40 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=193.34.213.150, lip=66.85.158.91, session=<zlHl3FlF1KXBItWW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-07 15:40:47 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:60131: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-07 15:40:55 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:49506: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 15:41:54 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60562: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.34.213.150
country_id: 798544
description:
Dec  7 15:44:15 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=193.34.213.150, lip=66.85.158.92, session=<MpbY8FlFlJjBItWW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 15:45:50 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 15:45:58 dovecot_plain authenticator failed for (tiventry) [154.146.240.123]:50128: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 15:50:29 dovecot_plain authenticator failed for (subshes) [154.146.240.123]:53000: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-07 15:50:32 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (undeud) [73.195.211.98]:58686: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 15:51:16 host2 sshd[2638419]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-07 15:52:59 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:40936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-07 15:53:25 dovecot_login authenticator failed for ([128.185.144.1]) [182.95.226.82]:43480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-07 15:56:26 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:41492: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-07 15:56:39 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:47730: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.126
country_id: 2963597
description:
Dec  7 15:57:42 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=37.203.49.126, lip=66.85.158.91, TLS, session=<0LrkH1pFuuklyzF+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.87
country_id: 3469034
description:
Dec  7 15:58:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.120.72.87, lip=66.85.158.91, TLS, session=<uhYMIVpFAuK7eEhX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-07 16:00:00 dovecot_plain authenticator failed for (subde) [103.51.26.198]:58740: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.254.161.7
country_id: 1269750
description:
2025-12-07 16:01:03 dovecot_plain authenticator failed for (56QUULLY) [38.254.161.7]:56550: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 16:03:17 host2 sshd[2649665]: Disconnected from invalid user admin 2.57.121.112 port 19705 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 16:05:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.42, lip=66.85.158.91, session=<X0YdO1pFlNI+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 16:08:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Uxn3RVpFOKYXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec  7 16:10:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, session=<R10KTVpFVv7CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-07 16:22:44 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:53466: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 16:23:03 host2 sshd[2667781]: Disconnected from invalid user user 2.57.121.25 port 13221 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.22
country_id: 6252001
description:
2025-12-07 16:23:14 dovecot_login authenticator failed for ([98.181.44.22]) [98.181.44.22]:46017: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec  7 16:23:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.99, lip=66.85.158.91, session=<H75dfVpF/qU+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-07 16:24:44 dovecot_plain authenticator failed for (noles) [64.53.7.231]:50658: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-07 16:24:49 dovecot_plain authenticator failed for (indism) [12.182.125.210]:58034: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.215
country_id: 3996063
description:
2025-12-07 16:26:24 dovecot_login authenticator failed for ([177.236.145.215]) [177.236.145.215]:35374: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.20
country_id: 6252001
description:
2025-12-07 16:27:22 dovecot_login authenticator failed for ([98.181.44.20]) [98.181.44.20]:51001: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-07 16:27:29 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:33482: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-12-07 16:27:30 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:56077: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-07 16:26:53 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:35334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-07 16:26:57 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:45027: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-07 16:27:07 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:42612: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-07 16:27:02 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:38075: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-07 16:27:37 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:33152: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:29:22 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<lik6klpF7qMDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-07 16:28:54 dovecot_plain authenticator failed for (wrize) [94.206.93.90]:45783: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 16:30:11 host2 sshd[2674540]: Disconnected from invalid user denisse 62.60.131.157 port 27477 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.115
country_id: 6252001
description:
Dec  7 16:30:26 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.115, lip=66.85.158.92, TLS: Connection closed, session=<iUgFllpFYvrHLZpz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:30:41 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<oW/kllpFrpkDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:32:00 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<a1efm1pFqq4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:33:19 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<JUZSoFpFTNMDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:33:30 host2 dovecot[2208013]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<v1D4oFpFhLsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:34:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<QtcRpVpFzOkDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:34:48 host2 dovecot[2208013]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<7iuipVpFvLcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-07 16:37:15 dovecot_plain authenticator failed for 40.red-81-42-225.staticip.rima-tde.net (cessiledne) [81.42.225.40]:39176: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.84.87.46
country_id: 1655842
description:
[2025-12-07 16:38:26 +0530] info [cpaneld] 115.84.87.46 - fhbgov "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fhbgov (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.38
country_id: 130758
description:
Dec  7 16:38:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.38, lip=66.85.158.91, session=<nVSGtFpFHO4+PIcm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.84.87.46
country_id: 1655842
description:
[2025-12-07 16:39:20 +0530] info [cpaneld] 115.84.87.46 - fhbhealt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-07 16:41:16 dovecot_plain authenticator failed for (biclave) [65.20.133.4]:33097: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-07 16:44:15 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (unerse) [196.47.172.253]:34134: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  7 16:46:57 host2 sshd[2689300]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 16:58:50 host2 sshd[2700051]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-07 16:59:02 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (pantiffric) [73.168.136.150]:54466: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-07 16:59:05 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (blegrize) [96.230.65.90]:41084: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 17:02:36 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (mingursear) [71.235.225.181]:55922: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-07 17:02:38 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (kirnachoty) [66.177.30.53]:50456: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec  7 17:03:13 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<ghxDC1tFENMsyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2025-12-07 17:03:20 dovecot_plain authenticator failed for (psynced) [185.120.142.233]:34566: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-07 17:03:24 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (preapy) [188.219.104.210]:44005: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-07 17:03:27 dovecot_plain authenticator failed for (clitical) [24.187.213.29]:52182: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-12-07 17:04:57 dovecot_login authenticator failed for ([49.124.152.172]) [49.124.152.172]:51004: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.9
country_id: 1861060
description:
2025-12-07 17:05:16 dovecot_login authenticator failed for p160010-obmd01.osaka.ocn.ne.jp [61.112.103.9]:51071: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 17:07:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pleimplut) [87.103.126.54]:48378: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.102
country_id: 130758
description:
Dec  7 17:11:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.102, lip=66.85.158.91, session=<quSrJ1tF1ps+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.40
country_id: 130758
description:
Dec  7 17:13:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.40, lip=66.85.158.91, session=<xdhDMFtFFOo+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec  7 17:22:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.99, lip=66.85.158.91, session=<gh+OT1tFCr0+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec  7 17:23:36 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, session=<208oVFtFrsQDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-07 17:27:15 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (augly) [174.59.253.88]:57052: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-07 17:27:18 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (bilight) [68.40.189.43]:42634: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-07 17:27:22 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (nouloseyer) [67.172.54.29]:55272: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.89.57.53
country_id: 1269750
description:
Dec  7 17:29:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.89.57.53, lip=66.85.158.91, TLS, session=<L210Z1tF88FnWTk1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.93
country_id: 2300660
description:
Dec  7 17:29:41 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.0.93, lip=66.85.158.91, TLS, session=<8vDXaFtF8OApiwBd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 17:35:03 host2 sshd[2730007]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 17:35:03 host2 sshd[2729839]: Disconnected from invalid user user 2.57.121.25 port 12119 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-07 17:37:15 dovecot_login authenticator failed for ([182.95.228.110]) [182.95.228.110]:56674: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.69
country_id: 294640
description:
Dec  7 17:37:37 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=149.88.26.69, lip=66.85.158.91, session=<2AFKhltF9KaVWBpF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.181
country_id: 732800
description:
Dec  7 17:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=156.146.55.181, lip=66.85.158.91, session=<4fhehltF5qickje1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.241.177.120
country_id: 3469034
description:
Dec  7 17:37:35 host2 pure-ftpd[2732644]: (?@188.241.177.120) [INFO] New connection from 188.241.177.120


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.247.46
country_id: 1562822
description:
Dec  7 17:37:37 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=173.239.247.46, lip=66.85.158.91, session=<pYpLhltFKsKt7/cu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.229
country_id: 3686110
description:
Dec  7 17:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=154.47.16.229, lip=66.85.158.91, TLS handshaking: Connection closed, session=<yGXfhltFZr6aLxDl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.42.134
country_id: 690791
description:
Dec  7 17:37:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.239.42.134, lip=66.85.158.91, session=<Pt3uhltFQpJU7yqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.125.74
country_id: 1694008
description:
Dec  7 17:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=188.214.125.74, lip=66.85.158.91, session=<hwfbhltFkIa81n1K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.174.158
country_id: 1269750
description:
Dec  7 17:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=103.108.174.158, lip=66.85.158.91, TLS, session=<zcjfhltFar5nbK6e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-12-07 17:37:25 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:50638: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.217.71.151
country_id: 3175395
description:
Dec  7 17:37:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=185.217.71.151, lip=66.85.158.91, session=<eJVPhltFHMK52UeX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.174.168
country_id: 1269750
description:
Dec  7 17:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=103.108.174.168, lip=66.85.158.91, session=<gatahltFbs1nbK6o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.182
country_id: 2802361
description:
Dec  7 17:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.218.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FvxYhltF1qO11tq2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.219
country_id: 3190538
description:
Dec  7 17:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.80.150.219, lip=66.85.158.91, session=<BUrfhltFgIbDUJbb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.102.232.94
country_id: 3057568
description:
Dec  7 17:37:35 host2 pure-ftpd[2732655]: (?@149.102.232.94) [INFO] New connection from 149.102.232.94


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.49.49
country_id: 1668284
description:
Dec  7 17:37:35 host2 pure-ftpd[2732665]: (?@173.244.49.49) [INFO] New connection from 173.244.49.49


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.177.142
country_id: 3469034
description:
Dec  7 17:37:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=188.241.177.142, lip=66.85.158.91, session=<LkhNhltF6qa88bGO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.189.114.123
country_id: 719819
description:
Dec  7 17:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.189.114.123, lip=66.85.158.91, TLS, session=<NFJZhltFhsS5vXJ7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 17:41:23 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec  7 17:40:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.99, lip=66.85.158.91, session=<8fJAkltFQrw+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 17:42:04 host2 sshd[2736732]: Disconnected from invalid user user 2.57.121.25 port 53449 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 17:42:31 dovecot_plain authenticator failed for (icatied) [154.144.243.93]:59384: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  7 17:47:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=62.60.135.108, lip=66.85.158.91, session=<pl6XqFtFkKs+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 17:47:51 dovecot_plain authenticator failed for (deass) [154.144.243.93]:41464: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-07 17:47:54 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (callopher) [185.62.224.44]:39248: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-07 17:50:25 dovecot_plain authenticator failed for (glygme) [65.20.160.107]:43558: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-07 17:54:15 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (elusky) [93.145.118.40]:49760: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.94
country_id: 3144096
description:
2025-12-07 17:54:37 dovecot_login authenticator failed for (cm-84.211.13.94.get.no) [84.211.13.94]:44889: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-07 17:55:03 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:33540: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.39
country_id: 6252001
description:
2025-12-07 17:57:45 dovecot_login authenticator failed for ([98.181.46.39]) [98.181.46.39]:54383: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-07 17:58:14 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:33622: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.225.114.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.225.114.100 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-07 17:59:25 dovecot_plain authenticator failed for (afters) [65.20.191.12]:49926: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 18:00:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<4bvE1ltFMtAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2025-12-07 18:02:59 dovecot_login authenticator failed for ([149.54.62.66]) [149.54.62.66]:37229: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-07 18:03:32 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:44458: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 18:05:42 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 18:09:28 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-07 18:11:09 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:41604: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.103
country_id: 130758
description:
Dec  7 18:11:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.103, lip=66.85.158.91, session=<bErm/1tFHMg+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2025-12-07 18:11:46 dovecot_login authenticator failed for (nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:35402: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.102.49.193
country_id: 2750405
description:
Dec  7 18:17:24 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=94.102.49.193, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<DceLFFxFEMdeZjHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 94.102.49.193
country_id: 2750405
description:
Dec  7 18:17:22 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=94.102.49.193, lip=66.85.158.92, TLS, session=<g/R0FFxFdrteZjHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-07 18:27:22 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (paluitim) [73.230.86.50]:42456: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-07 18:27:32 dovecot_plain authenticator failed for (aftic) [5.31.15.108]:60383: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
country_id: 3175395
description:
2025-12-07 18:27:02 dovecot_plain authenticator failed for (bessopory) [151.3.178.94]:55602: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-07 18:27:03 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (seens) [73.137.7.97]:57926: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.40
country_id: 130758
description:
Dec  7 18:27:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.40, lip=66.85.158.91, session=<JlWWN1xFtrY+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-07 18:27:19 dovecot_plain authenticator failed for (plean) [64.53.7.231]:45012: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 18:32:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.42, lip=66.85.158.91, session=<F2M+TFxFCr8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.12
country_id: 3175395
description:
Dec  7 18:36:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=195.177.113.12, lip=66.85.158.91, TLS, session=<IuskV1xFn8DDsXEM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.133
country_id: 3175395
description:
Dec  7 18:36:40 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.124.182.133, lip=66.85.158.91, TLS, session=<i81dWFxFRI65fLaF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.142
country_id: 798544
description:
Dec  7 18:42:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=178.216.28.142, lip=66.85.158.91, TLS, session=<TelXblxF7Z2y2ByO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 18:43:09 host2 sshd[2789422]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.164
country_id: 3865483
description:
Dec  7 18:43:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=190.122.128.164, lip=66.85.158.91, TLS, session=<emqOb1xFvK6+eoCk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec  7 18:45:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<u3wcelxFPrwzn+p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec  7 18:45:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KjQaelxFVvJChJl2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec  7 18:45:47 host2 pure-ftpd[2792140]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-07 18:47:15 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:60507: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-07 18:47:31 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:53205: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-07 18:48:10 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (supir) [68.46.148.180]:36136: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.96
country_id: 130758
description:
Dec  7 18:48:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.96, lip=66.85.158.91, session=<2Uslg1xF0sw+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-07 19:03:03 dovecot_plain authenticator failed for (delecum) [65.20.129.28]:34721: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-07 19:03:06 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (daceting) [69.123.219.82]:60198: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec  7 19:04:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<Cp7nvVxFZpxChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-12-07 19:05:09 dovecot_login authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:50867: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-07 19:05:37 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:59360: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec  7 19:04:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<JWNfvlxFZqpChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-07 19:06:29 dovecot_plain authenticator failed for (tomby) [109.226.14.93]:52421: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 19:07:47 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  7 19:07:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<gVbXyFxFdNw+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 19:09:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WkzLz1xFMIk+PIce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 19:09:58 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  7 19:10:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<+ccW01xF8IY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  7 19:10:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<Ba8k01xF1p4+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-12-07 19:11:51 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:58646: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 19:11:53 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:39772: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-07 19:12:40 dovecot_login authenticator failed for ([121.73.163.186]) [121.73.163.186]:35808: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-07 19:12:48 dovecot_login authenticator failed for (nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:39574: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-07 19:12:03 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:50998: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.59.16.119
country_id: 3175395
description:
2025-12-07 19:12:28 dovecot_login authenticator failed for ([101.59.16.119]) [101.59.16.119]:53118: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-07 19:12:32 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:11274: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.60
country_id: 6252001
description:
2025-12-07 19:12:33 dovecot_login authenticator failed for ([98.185.120.60]) [98.185.120.60]:47738: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-07 19:13:01 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:60504: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.94
country_id: 6252001
description:
Dec  7 19:15:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.94, lip=66.85.158.92, session=<XZbh41xFqn9BMQFe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec  7 19:16:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.92, session=<GfEh5lxFeO64affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.206
country_id: 6252001
description:
Dec  7 19:16:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.206, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6I+45lxFz+RBMQHO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Dec  7 19:16:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sYLM51xFTMpBMQHK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  7 19:16:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<fHZK6FxFLtQ+PIdc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 19:19:37 host2 sshd[2822473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-07 19:21:19 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (troid) [67.172.54.29]:33270: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 19:21:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<iczG+lxF6s4+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-07 19:21:52 dovecot_plain authenticator failed for (mical) [75.97.190.237]:44696: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 19:21:16 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (nounan) [71.235.225.181]:53560: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 19:22:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<Isnu+1xF4KM+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-07 19:26:30 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (mistaly) [196.47.172.253]:53353: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 19:26:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<QVC/CV1FROY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-07 19:26:25 dovecot_plain authenticator failed for (pinvele) [91.73.188.251]:47014: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.53.228.211
country_id: 1527747
description:
2025-12-07 19:27:54 dovecot_login authenticator failed for ([77.95.56.101]) [185.53.228.211]:7432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-07 19:28:42 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:38640: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  7 19:29:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<3unjFV1F6OI+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  7 19:29:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<pWHnF11FkOk+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-07 19:31:17 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:51575: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-07 19:31:36 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:60950: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 19:32:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49186: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.76
country_id: 2510769
description:
Dec  7 19:34:46 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=139.28.190.76, lip=66.85.158.91, TLS, session=<NP0/KF1FUKWLHL5M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.209.5
country_id: 3865483
description:
Dec  7 19:35:07 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=181.16.209.5, lip=66.85.158.91, TLS, session=<YPNfKV1F+uK1ENEF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-07 19:36:41 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3703: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.81.78
country_id: 1269750
description:
Dec  7 19:37:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=139.59.81.78, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kXVeMV1FdquLO1FO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-07 19:36:59 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:50262: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-07 19:38:49 dovecot_plain authenticator failed for (untiousm) [192.81.229.179]:50004: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  7 19:39:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<O4zPOV1FIJA+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-07 19:39:03 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:41828: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.92.45.236
country_id: 6252001
description:
[2025-12-07 19:42:17 +0530] info [whostmgrd] 72.92.45.236 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.6.160.129
country_id: 6252001
description:
[2025-12-07 19:42:24 +0530] info [cpaneld] 73.6.160.129 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.165.146.177
country_id: 6252001
description:
[2025-12-07 19:42:28 +0530] info [cpaneld] 75.165.146.177 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.37.127
country_id: 6252001
description:
[2025-12-07 19:42:29 +0530] info [cpaneld] 73.71.37.127 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.32.143.34
country_id: 6252001
description:
[2025-12-07 19:42:38 +0530] info [cpaneld] 65.32.143.34 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.89.72.49
country_id: 6252001
description:
[2025-12-07 19:42:14 +0530] info [cpaneld] 170.89.72.49 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.235.200
country_id: 6252001
description:
[2025-12-07 19:42:15 +0530] info [cpaneld] 73.235.235.200 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.243.58.71
country_id: 6252001
description:
[2025-12-07 19:42:18 +0530] info [cpaneld] 108.243.58.71 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.61.203
country_id: 6252001
description:
[2025-12-07 19:42:41 +0530] info [cpaneld] 98.97.61.203 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.110.120
country_id: 6252001
description:
[2025-12-07 19:42:23 +0530] info [cpaneld] 172.117.110.120 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.147.202.243
country_id: 6252001
description:
[2025-12-07 19:42:12 +0530] info [cpaneld] 24.147.202.243 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.48.52.170
country_id: 6252001
description:
[2025-12-07 19:42:20 +0530] info [cpaneld] 45.48.52.170 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  7 19:43:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<JGoRR11F1OY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  7 19:43:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<FpXZR11FGrM+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-12-07 19:45:11 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:49442: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-07 19:44:58 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:39737: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-07 19:46:27 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (rapicklen) [73.195.211.98]:44680: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.125
country_id: 6252001
description:
Dec  7 19:47:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.154.125, lip=66.85.158.92, TLS: Connection closed, session=<j7raVl1FTLfHLZp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 19:54:43 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.56.125
country_id: 6252001
description:
Dec  7 19:58:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.56.125, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<yW7PfF1FAtYUajh9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.12
country_id: 3469034
description:
Dec  7 19:59:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=191.53.131.12, lip=66.85.158.91, TLS, session=<m+J7gF1Fr9S/NYMM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.235
country_id: 3865483
description:
Dec  7 19:59:58 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<587hr>, method=PLAIN, rip=190.181.109.235, lip=66.85.158.91, TLS, session=<MtDygV1Ffqy+tW3r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 20:00:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ltSehV1FsOg+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 20:00:45 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (argishbon) [87.103.126.54]:35152: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-07 20:02:33 dovecot_plain authenticator failed for (squenur) [94.206.93.90]:41862: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  7 20:03:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<Ao72jl1F5KQ+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-07 20:10:21 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:58604: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.67.39
country_id: 3996063
description:
2025-12-07 20:10:34 dovecot_login authenticator failed for ([201.160.67.39]) [201.160.67.39]:57364: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.34
country_id: 6252001
description:
2025-12-07 20:10:41 dovecot_login authenticator failed for ([98.181.46.34]) [98.181.46.34]:40040: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.61
country_id: 1733045
description:
2025-12-07 20:10:55 dovecot_login authenticator failed for ([49.124.151.61]) [49.124.151.61]:33572: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-07 20:12:21 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (exper) [68.60.77.128]:57278: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.15.25.170
country_id: 2464461
description:
2025-12-07 20:12:42 dovecot_login authenticator failed for ([197.15.25.170]) [197.15.25.170]:49075: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  7 20:17:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<8WNMwF1FSLY+PIcd>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[38698] [Authentication Database]=[system] [Username]=[ajss] (10/10 failures) (blocked until [Fri Nov 14 05:10:03 2025 UTC/Fri Nov 14 10:40:03 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 20:18:11 dovecot_plain authenticator failed for (carity) [154.146.240.123]:46218: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  7 20:18:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Skrtxl1FZL4+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-07 20:23:02 dovecot_plain authenticator failed for (milang) [91.73.195.150]:54807: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  7 20:22:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<Bl5/1F1Fipg+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-07 20:22:57 dovecot_plain authenticator failed for (spacyllin) [5.32.22.218]:57086: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 20:25:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<+tTj311FHuo+PIcq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 20:27:39 host2 sshd[2886288]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 20:27:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<og0q511FntE+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-07 20:31:44 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:58829: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-07 20:32:03 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:45112: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-07 20:32:09 dovecot_plain authenticator failed for (jeced) [94.201.22.158]:35268: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 20:33:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<1Kdn+V1FJos+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 20:33:42 dovecot_plain authenticator failed for (trably) [154.144.243.93]:43030: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 20:33:46 dovecot_plain authenticator failed for (enthnesced) [96.85.104.2]:35490: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-07 20:33:38 dovecot_plain authenticator failed for (imped) [102.53.15.180]:48194: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.216
country_id: 99237
description:
Dec  7 20:35:43 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=65.20.143.216, lip=66.85.158.91, TLS, session=<vnf+AV5FZOZBFI/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  7 20:35:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<slNMA15FmM8+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.24.174.59
country_id: 798544
description:
Dec  7 20:35:19 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=194.24.174.59, lip=66.85.158.91, TLS, session=<bCfIAF5FJcbCGK47>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  7 20:39:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4+KyEF5FALU+PIdf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.187.161.131
country_id: 1861060
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 89.187.161.131 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  7 20:39:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<nrdXEl5FuI+l6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 20:40:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<F/JcFF5FYHBetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 20:42:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<ZpiaGV5Fu8RetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-12-07 20:42:09 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:39554: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.35
country_id: 3175395
description:
Dec  7 20:41:24 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=217.26.179.35, lip=66.85.158.91, TLS, session=<mkSDFl5F87/ZGrMj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.197
country_id: 3175395
description:
Dec  7 20:41:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.171.197, lip=66.85.158.91, TLS, session=<wLLkF15FII25D6vF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  7 20:41:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<9XUsGV5FMbpScUAC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-07 20:42:01 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:55494: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.81
country_id: 3996063
description:
2025-12-07 20:42:29 dovecot_login authenticator failed for ([177.236.144.81]) [177.236.144.81]:54369: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.45
country_id: 1733045
description:
2025-12-07 20:42:50 dovecot_login authenticator failed for ([49.124.146.45]) [49.124.146.45]:36732: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  7 20:43:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<nuj6H15FLuC8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-07 20:43:49 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:48512: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 20:44:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<5YVJIV5F1UtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  7 20:44:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7Bz8I15FFIiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  7 20:45:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<xGtKJ15FFJM+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  7 20:47:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<AHXNLF5FxtekXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  7 20:47:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<eV1OLV5F1rQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 20:48:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<wDtfL15FPO1npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  7 20:48:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<z1tWMl5FvMw+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  7 20:50:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<0j6NOV5FgtE+PIcr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.88
country_id: 6252001
description:
Dec  7 20:51:26 host2 pure-ftpd[2905703]: (?@198.235.24.88) [INFO] New connection from 198.235.24.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-07 20:52:51 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:36361: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-07 20:53:01 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:55716: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2025-12-07 20:54:10 dovecot_login authenticator failed for ([49.124.152.234]) [49.124.152.234]:33028: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.143.88
country_id: 1819730
description:
2025-12-07 20:53:46 dovecot_login authenticator failed for (m121-202-143-88.smartone.com) [121.202.143.88]:52100: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.220
country_id: 6252001
description:
Dec  7 20:54:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.132.220, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3EkaRl5FstqTuYTc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.220
country_id: 6252001
description:
Dec  7 20:56:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.132.220, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<UeZ9TV5FNuWTuYTc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 20:56:41 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (inshent) [87.103.126.54]:37198: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 20:58:12 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (puttle) [87.103.126.54]:39945: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-07 20:58:15 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (aurfonized) [71.62.34.216]:44280: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  7 20:58:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<7nk1VF5FdtyLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-07 21:00:00 dovecot_plain authenticator failed for (prory) [154.144.255.208]:48168: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  7 21:00:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<paWUXF5F8NGqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-07 21:02:06 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:52814: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-12-07 21:02:23 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:55261: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.220
country_id: 6252001
description:
Dec  7 21:02:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.220, lip=66.85.158.91, TLS, session=<7nBfY15FoP+TuYTc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 21:02:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<JjoYZF5F3rxnpBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec  7 21:03:11 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS: Connection closed, session=<4yF3ZV5F4q5ChJlx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 21:03:56 host2 sshd[2916143]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-07 21:03:33 dovecot_plain authenticator failed for (unism) [5.11.140.219]:46648: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 21:03:59 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.227
country_id: 1733045
description:
2025-12-07 21:04:13 dovecot_login authenticator failed for ([49.124.152.227]) [49.124.152.227]:50612: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 21:04:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<gbf2al5FIxNetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.115.25.4
country_id: 2077456
description:
2025-12-07 21:04:25 dovecot_login authenticator failed for ([82.115.25.4]) [82.115.25.4]:40034: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 21:05:39 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (noheted) [87.103.126.54]:11967: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 21:06:44 host2 sshd[2918365]: Disconnected from invalid user admin 2.57.121.112 port 51992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 21:07:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<o6POc15FiqhnpBQq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.62.248.21
country_id: 2921044
description:
[2025-12-07 21:09:07 +0530] info [cpaneld] 194.62.248.21 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  7 21:10:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<9cfBfV5FJu2kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 21:11:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<AcyxgV5F9uU+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 21:13:35 host2 sshd[2924298]: Disconnected from invalid user admin 2.57.121.112 port 16183 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-07 21:13:39 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (berifor) [76.145.10.140]:56814: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  7 21:13:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<HLJAil5F9qU+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  7 21:14:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<AzXsjV5FZO0P6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  7 21:14:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XeBbjl5FciWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  7 21:17:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<m/7Yl15FioYv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-07 21:18:09 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:46456: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-07 21:18:20 dovecot_login authenticator failed for ([125.23.72.129]) [125.20.245.194]:53792: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.74.102
country_id: 3469034
description:
Dec  7 21:18:58 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=177.190.74.102, lip=66.85.158.91, TLS, session=<r9ZZnF5Fet2xvkpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec  7 21:19:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<x3JOn15Fcf7CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.178
country_id: 3469034
description:
Dec  7 21:19:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.89.136.178, lip=66.85.158.91, TLS, session=<z9BSoF5FYIS+WYiy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.47
country_id: 1269750
description:
Dec  7 21:19:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts2>, method=PLAIN, rip=103.18.166.47, lip=66.85.158.91, TLS, session=<v3H8nV5FTOFnEqYv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  7 21:20:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<ZFZXpF5FBKo+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.219
country_id: 953987
description:
Dec  7 21:20:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=102.64.45.219, lip=66.85.158.91, TLS, session=<2LO6oV5FkOFmQC3b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-12-07 21:22:05 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:57250: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-07 21:22:19 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:35488: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  7 21:23:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<zEXmrV5F1r/DhTKl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  7 21:23:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<KIUBr15FKpc+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  7 21:24:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<mdhSsF5F/K9noNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Dec  7 21:24:11 host2 sshd[2932520]: Disconnected from invalid user ubuntu 82.65.43.136 port 45702 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 21:24:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<fs4As15F2IY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  7 21:24:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<7rPisF5FPtkrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  7 21:25:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<6/+utF5FwsnANXk9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.5
country_id: 6252001
description:
Dec  7 21:25:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.5, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<X7dTtV5FWNei2JUF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-07 21:26:22 dovecot_login authenticator failed for vps-f9a28e39.vps.ovh.net [51.195.117.220]:10978: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.5
country_id: 6252001
description:
Dec  7 21:26:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.5, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<EWqnuF5FOuOi2JUF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-07 21:26:36 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:41553: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  7 21:26:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<oCdDuV5FQITD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.19.79.32
country_id: 285570
description:
2025-12-07 21:27:24 dovecot_plain authenticator failed for (cecidan) [185.19.79.32]:42733: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-07 21:27:29 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (jigalerle) [73.213.236.66]:45566: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  7 21:27:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CLLKvV5F0ryuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Dec  7 21:28:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<YoRsvl5FEle4affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  7 21:28:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<rD02wV5F7ow+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  7 21:29:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<16Rkwl5FTKI+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Dec  7 21:28:32 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<uJ4dwF5FGrG4affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  7 21:28:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<6lp5wF5FoOieRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.245.141.225
country_id: 2077456
description:
2025-12-07 21:29:46 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:47567: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-12-07 21:30:05 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:37418: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.212
country_id: 798544
description:
Dec  7 21:31:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=193.192.179.212, lip=66.85.158.91, TLS, session=<mEsnyF5FNbHBwLPU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 21:30:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DoBByF5FSsNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.51.201
country_id: 3175395
description:
Dec  7 21:31:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.77.51.201, lip=66.85.158.91, TLS, session=<vnrYyV5Fva65TTPJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  7 21:32:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<SKDcz15FMqQ+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-07 21:34:12 dovecot_login authenticator failed for ([125.19.156.2]) [125.19.156.2]:45504: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.5
country_id: 6252001
description:
Dec  7 21:33:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.149.5, lip=66.85.158.92, TLS, session=<8iJ80V5FuOqi2JUF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-07 21:33:43 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:37340: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 21:34:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<YWzH1F5F7uFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 21:35:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<FCDd2V5FPKc+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  7 21:37:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<E8lj3l5F2rAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.113.62
country_id: 1269750
description:
2025-12-07 21:37:11 dovecot_login authenticator failed for ([103.68.19.170]) [49.36.113.62]:52376: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-12-07 21:36:20 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:52742: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-07 21:36:59 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:45681: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  7 21:38:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<0gHz4V5FoMOG0Wp/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.128.77.56
country_id: 1643084
description:
Dec  7 21:37:27 host2 sshd[2943343]: Disconnected from invalid user dell 34.128.77.56 port 58496 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 62.60.135.30
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[62.60.135.30] [Remote Port]=[39280] [Authentication Database]=[mail] [Username]=[info@bostonlanka.com] (10/10 failures) (blocked until [Mon Dec  8 16:08:22 2025 UTC/Mon Dec  8 21:38:22 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.128.77.56
country_id: 1643084
description:
Dec  7 21:38:45 host2 sshd[2944375]: Disconnected from invalid user cart 34.128.77.56 port 45654 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 21:38:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<l7Y+415FcJk+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Dec  7 21:40:13 host2 sshd[2946359]: Disconnected from invalid user jenkins 82.65.43.136 port 48982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.14.25
country_id: 6252001
description:
Dec  7 21:40:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.168.14.25, lip=66.85.158.92, session=<Mau86l5FGMsUqA4Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  7 21:41:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CixI715F8o8z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Dec  7 21:41:19 host2 sshd[2955288]: Disconnected from invalid user info 82.65.43.136 port 47290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  7 21:41:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<KU41715FSpPO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  7 21:43:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<xcTO815F5pAv+1Ve>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.59
country_id: 6252001
description:
Dec  7 21:43:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.59, lip=66.85.158.91, session=<B4Rr9V5F86ZAPsU7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 21:43:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Hbin9V5Frrc+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Dec  7 21:43:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS: Connection closed, session=<ZRUq9l5FmIlAPsUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  7 21:45:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Yyng+15Fyp1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  7 21:44:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<QvHi+F5FnIAv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 21:44:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<5eJt+V5FAs4XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec  7 21:45:21 host2 sshd[2963095]: Disconnected from invalid user bluehost 165.227.3.79 port 41318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.128.77.56
country_id: 1643084
description:
Dec  7 21:45:23 host2 sshd[2963108]: Disconnected from invalid user jenkins 34.128.77.56 port 51102 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.237.73.30
country_id: 6252001
description:
Dec  7 21:45:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=994) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.237.73.30, lip=66.85.158.91, session=<tKbs/F5FDKMj7Uke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.23.245.45
country_id: 6252001
description:
Dec  7 21:46:07 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=34.23.245.45, lip=66.85.158.91, session=<2UT9/l5F7MwiF/Ut>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.26.246.252
country_id: 6252001
description:
Dec  7 21:46:10 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=34.26.246.252, lip=66.85.158.91, session=<Y1Yo/15FEpoiGvb8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  7 21:46:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lhET/15F1J6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  7 21:46:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<qruhAV9FsIc+PIds>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.65.43.136
country_id: 3017382
description:
Dec  7 21:47:33 host2 sshd[2964570]: Disconnected from invalid user guest 82.65.43.136 port 37136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  7 21:50:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<XY2+DF9FTo+iAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  7 21:50:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<NebWDF9FYMA+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-07 21:51:14 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (anters) [174.166.153.20]:39746: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.201
country_id: 6252001
description:
Dec  7 21:52:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.201, lip=66.85.158.92, session=<cmQdFF9F8qyH7X3J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec  7 21:52:07 host2 sshd[2968423]: Disconnected from invalid user ansible 165.227.3.79 port 53317 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  7 21:52:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<m3fbFF9Fxtw+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-07 21:53:14 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (suladested) [96.230.65.90]:45930: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Dec  7 21:54:27 host2 sshd[2970591]: Disconnected from invalid user bluehost 91.92.199.36 port 59156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  7 21:58:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<E8+6LF9F0Mg+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.125
country_id: 798544
description:
Dec  7 21:59:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.246.213.125, lip=66.85.158.91, TLS, session=<RHpJLF9FUMVb9tV9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 22:01:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<pkPYNF9Fs7xetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-07 22:01:22 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:47154: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-07 22:00:56 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:46808: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  7 22:00:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<l2z8M19F4r0+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.56.149.193
country_id: 1269750
description:
Dec  7 22:03:02 host2 sshd[2977802]: Disconnected from invalid user infocare 27.56.149.193 port 41580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Dec  7 22:03:22 host2 sshd[2978437]: Disconnected from invalid user ansible 91.92.199.36 port 47936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.62.50.36
country_id: 298795
description:
2025-12-07 22:03:28 dovecot_login authenticator failed for (dynamic-195-62-50-36.cgnat.wi.hiperonline.com.tr) [195.62.50.36]:57424: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Dec  7 22:02:40 host2 sshd[2977576]: Disconnected from invalid user infocare 165.227.3.79 port 40814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  7 22:02:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<wUWiOl9FLril6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.111
country_id: 3996063
description:
2025-12-07 22:03:43 dovecot_login authenticator failed for (201.173.97.111-clientes-izzi.mx) [201.173.97.111]:38617: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-07 22:04:02 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:36906: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  7 22:05:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<JRPGQl9FmNu8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  7 22:06:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3EccR19FZtEv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  7 22:06:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<MEt7SF9FNqukXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 22:07:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ntE9Sl9FFIVn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.56.149.193
country_id: 1269750
description:
Dec  7 22:08:26 host2 sshd[2982973]: Disconnected from invalid user jacob 27.56.149.193 port 49912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec  7 22:09:17 host2 sshd[2983685]: Disconnected from invalid user ubuntu 165.227.3.79 port 55838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.174.113
country_id: 6252001
description:
Dec  7 22:08:36 host2 sshd[2983073]: Disconnected from invalid user ansible 198.23.174.113 port 34830 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 22:10:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<x+X5VV9FXtpnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-12-07 22:11:40 dovecot_plain authenticator failed for (gaterhiked) [87.121.76.190]:44985: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-12-07 22:11:57 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:51607: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-07 22:12:02 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:64612: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.250.155.76
country_id: 294640
description:
2025-12-07 22:12:23 dovecot_login authenticator failed for ([80.250.155.76]) [80.250.155.76]:44796: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.56.149.193
country_id: 1269750
description:
Dec  7 22:13:34 host2 sshd[2987125]: Disconnected from invalid user jacob 27.56.149.193 port 56968 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 22:14:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<hTlSZF9FJtFn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.174.113
country_id: 6252001
description:
Dec  7 22:15:44 host2 sshd[2988919]: Disconnected from invalid user cart 198.23.174.113 port 35176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-07 22:16:12 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (uncelic) [37.150.8.174]:35691: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Dec  7 22:18:36 host2 sshd[2990918]: Disconnected from invalid user jacob 91.92.199.36 port 44376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.56.149.193
country_id: 1269750
description:
Dec  7 22:20:09 host2 sshd[2992075]: Disconnected from invalid user bluehost 27.56.149.193 port 47872 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.241.154.87
country_id: 6252001
description:
Dec  7 22:21:00 host2 pure-ftpd[2992627]: (?@192.241.154.87) [INFO] New connection from 192.241.154.87


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  7 22:21:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<2gBBfF9FOuaLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-07 22:22:06 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (subagasm) [37.150.8.174]:45212: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 22:22:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<b+QegV9FZLE+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 22:23:09 host2 sshd[2994272]: Disconnected from invalid user admin 2.57.121.112 port 25461 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  7 22:24:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<+0Lph19F2r0+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-07 22:25:32 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (undifical) [73.230.86.50]:33594: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 22:25:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<VCx2i19FY5petwuC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.147.27.212
country_id: 6252001
description:
Dec  7 22:26:14 host2 pure-ftpd[2996567]: (?@54.147.27.212) [INFO] New connection from 54.147.27.212


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  7 22:26:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Jc38jl9FyJ6qQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 22:25:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<mOo2jF9FUuxnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  7 22:30:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<xlTum19F4JakXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 22:30:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<Lfrcm19F9qNnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-07 22:30:50 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (laurize) [96.230.65.90]:55312: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.174.113
country_id: 6252001
description:
Dec  7 22:32:12 host2 sshd[3001828]: Disconnected from invalid user namecheap 198.23.174.113 port 36024 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 22:32:45 host2 sshd[3002207]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-12-07 22:33:48 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:56268: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2025-12-07 22:34:06 dovecot_login authenticator failed for ([203.192.97.23]) [203.192.97.23]:48350: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  7 22:34:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<kguhrV9FnKsP6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  7 22:34:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<gF6YrV9FjN8+PIcp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.132
country_id: 6252001
description:
Dec  7 22:34:49 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZQgjrV9F3ntBMQGE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 22:36:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<peirsl9F+Io+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  7 22:36:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<58WHs19F5KenYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 22:36:57 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (phashed) [87.103.126.54]:43106: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-07 22:36:57 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (mohined) [73.129.57.71]:34962: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-07 22:37:19 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (worimable) [73.137.7.97]:47842: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 22:40:09 dovecot_plain authenticator failed for (seutea) [154.146.240.123]:45476: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.136
country_id: 3469034
description:
Dec  7 22:40:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.92.247.136, lip=66.85.158.91, TLS, session=<sOZDv19F66GxXPeI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.54
country_id: 3865483
description:
Dec  7 22:40:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=186.64.71.54, lip=66.85.158.91, TLS, session=<OkW7v19FIZS6QEc2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  7 22:40:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Pa5EwV9FJMA+PIcl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 22:40:46 host2 sshd[3008753]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  7 22:41:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<QmQrw19FOM8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.211
country_id: 298795
description:
Dec  7 22:40:38 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=45.67.155.211, lip=66.85.158.91, TLS, session=<4yWbwF9Fn6YtQ5vT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.36.21
country_id: 3175395
description:
Dec  7 22:40:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.239.36.21, lip=66.85.158.91, TLS, session=<xX/twF9FTpmy7yQV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  7 22:41:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<880Hxl9FuI8+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  7 22:44:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<dg1ez19FEOI+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  7 22:45:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<Xxhr0V9FwtLDhTKl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 22:46:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<MllP1l9FIME+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 22:46:49 host2 sshd[3014748]: Disconnected from invalid user user 2.57.121.25 port 37119 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-07 22:47:05 dovecot_plain authenticator failed for (coffer) [80.227.147.94]:34387: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  7 22:47:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ut9b219Ftr/D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  7 22:48:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<VQwy3F9FAs6eRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  7 22:48:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<s99G319FGoErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  7 22:48:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Jstw319FsoFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  7 22:49:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Vv0e4V9Fmvyuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 22:49:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<3yrD4l9FuJA+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-07 22:51:14 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:42528: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-07 22:51:13 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:55814: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-07 22:50:40 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:51616: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.22
country_id: 1733045
description:
2025-12-07 22:51:37 dovecot_login authenticator failed for ([49.124.148.22]) [49.124.148.22]:59182: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-12-07 22:51:40 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:51458: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-07 22:52:16 dovecot_login authenticator failed for (nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:42318: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-12-07 22:52:34 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:53810: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  7 22:52:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<ntbo7F9FrqTANXk9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.137
country_id: 6252001
description:
Dec  7 22:53:53 host2 pure-ftpd[3020999]: (?@64.62.197.137) [INFO] New connection from 64.62.197.137


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 22:54:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<XY8Q9V9FJIA+PIce>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.234
country_id: 6252001
description:
Dec  7 22:58:03 host2 pure-ftpd[3024697]: (?@147.185.132.234) [INFO] New connection from 147.185.132.234


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  7 22:58:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<Cqr3AGBFONg+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  7 22:58:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<eGqnAmBFRKU+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  7 22:58:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<nVsHA2BFKNAv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 22:58:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<2hxiA2BFCr1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  7 23:01:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<uqV6DGBFSoQ+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  7 23:02:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<DGHFD2BFwuKG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  7 23:03:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<IOT3EWBFF4Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 23:02:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BPT2EGBFRo9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  7 23:04:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<mGyiGGBFxM8v/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  7 23:06:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<L6lLH2BFwrrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  7 23:07:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<aSCFImBFIoGPbtX3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 23:08:47 host2 sshd[3033367]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  7 23:08:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<EGXlJmBFCJQ+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-07 23:09:32 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3704: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  7 23:09:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<J05nKWBFPshnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  7 23:11:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<bRmYLmBFYrQ+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  7 23:12:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<K+bdM2BFpN6iAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 23:15:17 dovecot_plain authenticator failed for (purogy) [154.146.240.123]:36594: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  7 23:16:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<pPPWQGBFW6FScUAC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  7 23:17:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<urSaRmBFfqsv+1Ve>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-07 23:19:19 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:58287: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.27
country_id: 6252001
description:
2025-12-07 23:19:43 dovecot_login authenticator failed for ([98.181.46.27]) [98.181.46.27]:55076: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-07 23:20:36 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:54352: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-07 23:20:51 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:51652: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 23:22:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lWDbV2BF4AdetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 23:24:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<dgU2XmBFEiRetwuC>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 94.183.11.130
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[94.183.11.130] [Remote Port]=[9234] [Authentication Database]=[mail] [Username]=[sales@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Mon Dec  8 17:54:20 2025 UTC/Mon Dec  8 23:24:20 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  7 23:25:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<fdZpYmBFkJSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 23:25:35 dovecot_plain authenticator failed for (broneliter) [154.144.243.93]:43332: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  7 23:25:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<fRzDYmBFWOel6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 23:26:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<in9vZ2BFeKBetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  7 23:28:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<8sUmbWBFWuSkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  7 23:28:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<n6gKbGBFJokv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.34
country_id: 6252001
description:
Dec  7 23:29:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.34, lip=66.85.158.91, TLS handshaking: Connection closed, session=<f3j4cGBFc7dAPsUi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Dec  7 23:29:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.32, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nU4GcmBFrA9APsUg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.220.153.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 18.220.153.6 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2025-12-07 23:32:17 dovecot_login authenticator failed for wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:59974: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  7 23:32:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<tqIAe2BFrue8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-07 23:32:38 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:41069: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 23:33:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<141LfmBFKpI+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 23:34:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<8p/0g2BFoqNnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-07 23:35:38 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:51871: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  7 23:35:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<OC++hmBFkLo+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-07 23:35:51 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:38272: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-07 23:36:00 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:55780: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-07 23:36:28 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:41158: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 23:37:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BB4AjGBFbNZn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 23:37:30 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58110: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 23:39:01 host2 sshd[3055852]: Disconnected from invalid user admin 2.57.121.112 port 24066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-07 23:40:46 dovecot_plain authenticator failed for (cluttes) [178.250.191.189]:39988: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-12-07 23:42:15 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:50174: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.63.161.126
country_id: 2510769
description:
2025-12-07 23:42:24 dovecot_login authenticator failed for static-126-161-63-95.ipcom.comunitel.net [95.63.161.126]:54229: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-07 23:42:37 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:56178: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  7 23:43:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<qaI3o2BFbuQ+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 23:44:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<tL2gpGBFZo8XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 23:44:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pregerm) [87.103.126.54]:40420: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  7 23:45:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<Dbu1qWBFHLw+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  7 23:44:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<H65Dp2BF8uOLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 23:45:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<1QxfqmBFioln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 23:47:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<dUtksGBF6Mg+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2025-12-07 23:47:45 dovecot_login authenticator failed for ([122.186.230.25]) [125.19.161.150]:40574: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-07 23:47:46 dovecot_login authenticator failed for ([84.213.190.55]) [84.213.190.55]:44065: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-07 23:47:57 dovecot_login authenticator failed for (aes-static-137.135.17.125.airtel.in) [182.95.228.10]:57854: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-07 23:48:02 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:37670: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-07 23:48:06 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:9591: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-12-07 23:48:18 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:20396: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 23:49:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<G81QuGBFrowXXz9j>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.164.20.42
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.164.20.42] [Remote Port]=[49400] [Authentication Database]=[mail] [Username]=[hr@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Mon Dec  8 18:20:56 2025 UTC/Mon Dec  8 23:50:56 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 23:50:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<ZnNVvWBF+MBnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  7 23:51:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<kZH/vmBFaMY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 23:51:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<k1w4v2BF7X5etwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 23:53:18 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (melyous) [87.103.126.54]:12448: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  7 23:53:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ulGlxWBF7tikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  7 23:54:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<hcxeyGBFlOU+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  7 23:54:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<OEFCy2BF/o0+PIdc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  7 23:54:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=134.209.173.54, lip=66.85.158.91, session=<+VVsymBFCq+G0a02>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 23:55:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<RAp+zmBFNOxnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  7 23:57:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<InVE02BFqOQP6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  7 23:57:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<gp6Y02BFQsyqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 23:57:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<jrqw1GBFRLc+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 00:00:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<muPd4GBF+OU+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-08 00:01:16 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (zoolic) [96.230.65.90]:38820: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 00:01:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Qpan4mBF6hynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-08 00:02:45 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (metacconon) [81.225.30.107]:41336: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-08 00:03:36 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:52100: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 00:04:06 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:1220: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-08 00:04:19 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:52360: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-08 00:04:29 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:54415: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 00:05:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<yX9i8WBFJJE+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 00:06:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<z1ZZ82BF4Mg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 00:07:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<85MF92BFcu3DhTKl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 00:07:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<FQrJ9mBFqqgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-08 00:08:17 dovecot_plain authenticator failed for (arous) [64.72.74.162]:47971: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-08 00:08:13 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (sprailiker) [81.225.30.107]:54619: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 00:09:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<MvQs/2BFcKeeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 00:09:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<b8MBAWFFOJ0+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 00:10:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<jEZ4AWFFyICuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 00:11:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<1rSMBWFFrubD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-08 00:12:14 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (unmedra) [71.235.225.181]:48820: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 00:12:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<GiqgCWFFuK8+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 00:16:05 host2 sshd[3086490]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 00:16:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<JNSxGWFFNMRnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 00:19:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<YxFqImFF+pw+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 00:20:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Z58sJ2FF6IEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 00:19:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<dewVJWFFzMPANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 00:21:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<mBlEKmFFXsg+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 00:23:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<XQoYM2FFNegz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 00:25:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<24ESOmFFTqcv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-12-08 00:27:58 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:49295: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 00:29:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<KUMzRmFFhNeG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 00:30:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<WRB7SWFFIKAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.135.138.40
country_id: 1269750
description:
Dec  8 00:31:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=148.135.138.40, lip=66.85.158.91, session=<kzpNTWFFmp+Uh4oo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 00:31:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<kBDWTGFFNKWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 00:31:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<NNtvT2FFgLRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 00:32:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<mshXU2FFOoTO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 00:34:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<evwHWWFF5pxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 00:35:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<zLIGW2FFPqyiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 00:35:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<f3AmXmFFpLln9M4G>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.244.206.6
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.244.206.6] [Remote Port]=[47524] [Authentication Database]=[mail] [Username]=[support@dataesite.lk] (10/10 failures) (blocked until [Mon Dec  8 19:05:54 2025 UTC/Tue Dec  9 00:35:54 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 00:37:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<b2wIZGFFYntScUAC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-08 00:38:54 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (solly) [72.241.202.216]:55193: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-08 00:40:18 dovecot_login authenticator failed for ([182.79.136.105]) [122.187.60.126]:43558: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.61.160.114
country_id: 3017382
description:
Dec  8 00:41:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=72.61.160.114, lip=66.85.158.91, session=<NoFpcWFF5rpIPaBy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec  8 00:42:48 host2 sshd[3106463]: Disconnected from invalid user devil 92.207.4.157 port 40632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-08 00:43:21 dovecot_plain authenticator failed for (chmate) [65.20.160.107]:35052: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Dec  8 00:43:44 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.108, lip=66.85.158.92, session=<deQqemFFKvfG6xhs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 00:44:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<8EzpfGFFwNc+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2025-12-08 00:44:38 dovecot_login authenticator failed for ([59.145.84.169]) [182.95.176.122]:35490: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-08 00:43:56 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (domice) [73.208.81.125]:32888: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-08 00:44:54 dovecot_login authenticator failed for (nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:56114: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec  8 00:47:12 host2 sshd[3109875]: Disconnected from invalid user ansible 92.207.4.157 port 34146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 00:47:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<mDEjh2FFHog+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 00:47:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<VIvhhWFFpIRetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 00:48:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<AsAxjGFFkzNetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 00:50:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<72f8kmFFsIKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 00:50:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<oDkXkWFF/JCl6L5h>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Dec  8 00:50:23 host2 sshd[3112345]: Disconnected from invalid user jacob 92.207.4.157 port 57504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-08 00:50:26 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (unaneocin) [73.144.27.228]:48180: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 00:50:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<foPfk2FFmK4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 00:51:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<YkFdlWFFssKkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 00:51:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<dDJ0lWFFY4JetwuC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 00:51:57 host2 sshd[3113257]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.36
country_id: 3996063
description:
2025-12-08 00:52:10 dovecot_login authenticator failed for (189.219.138.36-clientes-izzi.mx) [189.219.138.36]:58888: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-08 00:52:24 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:54882: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 00:54:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<kIsXoWFFxNkv+1Ve>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-08 00:55:27 dovecot_plain authenticator failed for (grally) [65.20.233.110]:48348: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 00:56:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=</r+dp2FFttQ+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-08 00:57:18 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:41356: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-08 00:57:44 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:57226: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 00:58:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<hq5Pr2FFEI8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 00:58:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<znggsGFF1N68putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 01:01:10 host2 sshd[3119772]: Disconnected from invalid user admin 2.57.121.112 port 41895 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec  8 01:01:29 host2 sshd[3119852]: Disconnected from invalid user ansible 92.207.4.157 port 41272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 01:02:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<IB9VvGFFfpRnpBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.38
country_id: 6252001
description:
Dec  8 01:02:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<pDaYvGFF/NPG6xgm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 01:02:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<cANuvWFFhMI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-12-08 01:03:45 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:54148: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-08 01:04:02 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:38328: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-08 01:05:31 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:54276: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 01:05:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<5XfvyGFFXsk+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-12-08 01:05:20 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:53523: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 01:06:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<+bGhzGFFcN4+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 01:08:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<Vrty02FFBJo+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 01:10:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<JoaF2GFFBqqLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 01:10:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Gmw62mFFOuNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 01:12:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<qF9i4GFFzsY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 01:12:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<jG1O4WFFzq4+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-08 01:12:58 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:60526: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec  8 01:13:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.91, session=<aBA75WFFbf4t4/6b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-08 01:14:42 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:56517: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-08 01:14:53 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:41062: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 01:17:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0Yoi82FFoOA+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec  8 01:17:19 host2 sshd[3132393]: Disconnected from invalid user infocare 42.200.66.164 port 45740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.133.4
country_id: 99237
description:
Dec  8 01:18:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=65.20.133.4, lip=66.85.158.91, TLS, session=<Z+bj9mFF6eFBFIUE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.216.81.126
country_id: 49518
description:
Dec  8 01:19:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=196.216.81.126, lip=66.85.158.91, TLS, session=<LuIl+GFFaJ7E2FF+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-08 01:20:04 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (atory) [174.166.153.20]:59000: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 01:21:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<4u2EAmJFysI+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec  8 01:23:18 host2 sshd[3137159]: Disconnected from invalid user username 42.200.66.164 port 37272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 01:23:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Y+q4CGJFGuQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 01:24:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (hincoles) [87.103.126.54]:53261: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 01:23:57 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (farde) [68.60.77.128]:57634: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.45.177.42
country_id: 3865483
description:
Dec  8 01:25:18 host2 sshd[3138951]: Disconnected from invalid user jacob 181.45.177.42 port 62912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-08 01:25:47 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:3894: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 01:26:50 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.45.177.42
country_id: 3865483
description:
Dec  8 01:27:46 host2 sshd[3140692]: Disconnected from invalid user customer 181.45.177.42 port 55226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 01:26:53 host2 sshd[3139968]: Disconnected from invalid user user 2.57.121.25 port 21589 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-08 01:26:57 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (flants) [68.83.181.181]:50236: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.45.177.42
country_id: 3865483
description:
Dec  8 01:27:19 host2 sshd[3140339]: Disconnected from invalid user telegram 181.45.177.42 port 62999 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-08 01:27:22 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (toloped) [73.224.171.101]:55132: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.45
country_id: 953987
description:
Dec  8 01:29:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.129.54.45, lip=66.85.158.91, TLS, session=<obPSG2JFnYVmgTYt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 01:29:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<l8tKHWJF8uM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.111
country_id: 953987
description:
Dec  8 01:28:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=102.129.60.111, lip=66.85.158.91, TLS, session=<MxGFGmJF0dhmgTxv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-08 01:28:55 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (noniongs) [37.150.8.174]:54965: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.108
country_id: 6252001
description:
Dec  8 01:28:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.108, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hZfNG2JFasrN0h9s>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 01:30:39 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec  8 01:31:35 host2 sshd[3144206]: Disconnected from invalid user polkadot 42.200.66.164 port 53662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.45.177.42
country_id: 3865483
description:
Dec  8 01:31:03 host2 sshd[3143927]: Disconnected from invalid user middleware 181.45.177.42 port 53019 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.122.3
country_id: 3175395
description:
Dec  8 01:31:17 host2 sshd[3144036]: Disconnected from invalid user jenkins 151.37.122.3 port 50577 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 01:31:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<fOSxJGJFhpk+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.77
country_id: 3175395
description:
Dec  8 01:33:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.77, lip=66.85.158.91, TLS, session=<yR9QK2JFtYO5D6tN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec  8 01:32:51 host2 sshd[3145193]: Disconnected from invalid user admin 147.50.227.79 port 50884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.178
country_id: 3469034
description:
Dec  8 01:33:14 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=177.44.71.178, lip=66.85.158.91, TLS, session=<giPqKWJFnJCxLEey>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Dec  8 01:34:01 host2 sshd[3146153]: Disconnected from invalid user ubuntu 42.200.66.164 port 50284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec  8 01:34:13 host2 sshd[3146357]: Disconnected from invalid user jenkins 147.50.227.79 port 34854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-08 01:37:19 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:55376: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-08 01:37:36 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (laral) [73.137.7.97]:36644: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec  8 01:37:37 host2 sshd[3149254]: Disconnected from invalid user ubuntu 103.255.147.244 port 58618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.47
country_id: 6252001
description:
2025-12-08 01:37:10 dovecot_login authenticator failed for ([98.181.46.47]) [98.181.46.47]:55365: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 01:37:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<It0BPGJFeqa8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 01:40:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<cqziRGJFgtiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 01:41:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<26bqR2JFQKSl6L5h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec  8 01:41:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nIpxSWJFP//CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec  8 01:41:51 host2 sshd[3152452]: Disconnected from invalid user devops2025 147.50.227.79 port 37634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 01:42:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@rehanseo.online>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<DFvLS2JFUKhnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 01:42:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<duHZS2JFKtIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 01:42:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<NqXvTGJFQmVetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 01:42:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<IA/3TGJFAtxScUAC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 01:44:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<KmtCU2JFa6ZetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-08 01:47:35 dovecot_plain authenticator failed for (tereweed) [94.201.22.158]:48998: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-12-08 01:48:11 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:50928: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-08 01:48:21 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:56804: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 01:49:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<S/yIZWJFhoakXGTY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec  8 01:49:37 host2 sshd[3159915]: Disconnected from invalid user guest 177.85.247.230 port 19522 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.227.79
country_id: 1605651
description:
Dec  8 01:49:40 host2 sshd[3159930]: Disconnected from invalid user ubuntu 147.50.227.79 port 42222 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec  8 01:49:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, session=<WZ6WY2JFhf/CpRCi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 01:49:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<NEbnZGJFRqqqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-08 01:49:28 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (extul) [98.204.134.124]:44556: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 01:50:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<eDb9Z2JFCL0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 01:52:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ExubcWJFUKGLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.122.3
country_id: 3175395
description:
Dec  8 01:54:16 host2 sshd[3164285]: Disconnected from invalid user username 151.37.122.3 port 50819 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 01:55:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<qhJ5e2JFnsI+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec  8 01:55:58 host2 sshd[3166084]: Disconnected from invalid user moodle 188.166.156.169 port 43030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec  8 01:57:02 host2 sshd[3166873]: Disconnected from invalid user star 188.166.156.169 port 54932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec  8 01:57:07 host2 sshd[3166934]: Disconnected from invalid user infocare 59.98.148.5 port 46306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 01:57:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<0WQ4gmJFZqVnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 01:57:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<tmyQg2JFYqhnpBQq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Dec  8 01:58:03 host2 sshd[3167764]: Disconnected from invalid user oracle 188.166.156.169 port 45000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.122.3
country_id: 3175395
description:
Dec  8 01:58:10 host2 sshd[3167850]: Disconnected from invalid user jacob 151.37.122.3 port 50031 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 01:58:55 host2 sshd[3168373]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 01:59:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<cJIoiGJFhI0+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-08 01:59:24 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:51914: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.84
country_id: 6252001
description:
2025-12-08 01:59:33 dovecot_login authenticator failed for ([70.174.168.84]) [70.174.168.84]:50566: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.232
country_id: 6252001
description:
Dec  8 02:00:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.232, lip=66.85.158.91, session=<6sW2jGJFhJ5HBobo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec  8 02:01:39 host2 sshd[3170727]: Disconnected from invalid user username 59.98.148.5 port 52174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec  8 02:01:55 host2 sshd[3170922]: Disconnected from invalid user postgres 177.85.247.230 port 36282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.0.121.245
country_id: 3469034
description:
Dec  8 02:01:58 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=131.0.121.245, lip=66.85.158.91, TLS, session=<F//QkGJF3rGDAHn1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 02:02:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<GN8ikmJFuotnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.17
country_id: 798544
description:
Dec  8 02:02:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<info>, method=PLAIN, rip=91.236.172.17, lip=66.85.158.91, TLS, session=<Za0PkmJFJxBb7KwR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec  8 02:04:44 host2 sshd[3173825]: Disconnected from invalid user postgres 59.98.148.5 port 58914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 02:07:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<pi80pWJFpoA+PIcp>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  8 02:07:37 host2 sshd[3176298]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-12-08 02:07:46 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:57280: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 02:08:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<LsRwp2JFtI0+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.85.247.230
country_id: 3469034
description:
Dec  8 02:08:34 host2 sshd[3176994]: Disconnected from invalid user infocare 177.85.247.230 port 58260 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-08 02:08:53 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:46203: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-08 02:09:18 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:56035: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 02:09:27 host2 sshd[3177690]: Disconnected from invalid user admin 2.57.121.112 port 42465 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-08 02:10:04 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:33405: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-08 02:10:26 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:58000: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 02:09:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<nHh7rmJFNIw+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.240
country_id: 6252001
description:
Dec  8 02:10:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yB68sWJFu8nN0h/w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec  8 02:11:24 host2 sshd[3179479]: Disconnected from invalid user username 177.85.247.230 port 49660 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.248.167.131
country_id: 2750405
description:
Dec  8 02:12:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=89.248.167.131, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<hpuvtmJF7NVZ+KeD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 02:16:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<rdzixGJF0q1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 02:16:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<tW5lxWJFuKY+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-08 02:17:50 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:40248: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.16
country_id: 6252001
description:
2025-12-08 02:17:34 dovecot_login authenticator failed for ([98.181.44.16]) [98.181.44.16]:57805: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-08 02:17:40 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:57627: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2025-12-08 02:17:44 dovecot_login authenticator failed for ([107.85.14.208]) [107.85.14.208]:51138: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 02:17:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<NRK8ymJFMMWkXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 137.184.42.166
country_id: 6252001
description:
Dec  8 02:17:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=137.184.42.166, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<CXbmymJF8oqJuCqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.244
country_id: 2186224
description:
2025-12-08 02:18:10 dovecot_login authenticator failed for ([121.73.168.244]) [121.73.168.244]:54866: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.102
country_id: 6252001
description:
2025-12-08 02:18:22 dovecot_login authenticator failed for ([70.174.168.102]) [70.174.168.102]:56437: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 02:19:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<w27Cz2JFGtg+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 02:19:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<uVbbz2JFppw+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 02:19:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<p6P70GJFRp8P6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 02:19:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<2l5M0mJFhsBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 02:20:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<8ard02JFNM8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 02:20:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<wrMF1WJF+D+nYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.171.144
country_id: 6252001
description:
2025-12-08 02:20:58 dovecot_login authenticator failed for ([70.174.171.144]) [70.174.171.144]:48824: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 02:23:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<E+ja32JFDq5noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 02:23:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<MlL+32JFgLw+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 02:22:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<tz/T3GJF+IUv7PP+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 02:24:09 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-08 02:24:37 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (secons) [96.230.65.90]:41812: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 02:25:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<etBr5mJFfMPDhTKl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Dec  8 02:25:48 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<Lc0052JFXpysaYAL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 02:26:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<G+QL6WJFDNbANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-08 02:28:27 dovecot_plain authenticator failed for (vietic) [75.97.190.237]:54188: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 02:29:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<OPG38mJFWtc+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.212
country_id: 3469034
description:
Dec  8 02:29:15 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.136.212, lip=66.85.158.91, TLS, session=<Tshe8mJF/Zu+WYjU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.155.15.216
country_id: 130758
description:
Dec  8 02:28:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.155.15.216, lip=66.85.158.91, TLS, session=<l2o08WJFaYu5mw/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 02:31:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<87u1+2JFKNrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 02:32:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Oy9l/2JF7oGuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-08 02:31:58 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (unnidigna) [76.97.155.25]:47026: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-12-08 02:32:00 dovecot_login authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:55992: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-08 02:32:07 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:42256: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 02:33:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<z4XbAGNFdNqeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 02:33:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<op/7AmNFitY+PIds>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 02:34:31 host2 sshd[3199904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 02:35:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<z+04C2NFhsg+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 02:36:08 host2 sshd[3201506]: Disconnected from invalid user user 2.57.121.25 port 18460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-08 02:37:19 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:40593: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-12-08 02:37:43 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:46874: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 02:38:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<HSkgE2NF6rfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 02:39:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<aVimGWNF5qU+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-08 02:41:27 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:55766: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 02:41:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<VN5jH2NFmrQv+1Ve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 02:41:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<E37PH2NFOOaG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 02:41:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<K0YsIGNFss8XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.21
country_id: 6252001
description:
2025-12-08 02:41:46 dovecot_login authenticator failed for ([98.181.44.21]) [98.181.44.21]:41615: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 02:42:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<OlyKImNFUrc+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 02:42:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2oGNJGNFes8v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.174
country_id: 1733045
description:
2025-12-08 02:43:38 dovecot_login authenticator failed for ([49.124.154.174]) [49.124.154.174]:51212: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.45
country_id: 6252001
description:
2025-12-08 02:43:54 dovecot_login authenticator failed for ([98.181.46.45]) [98.181.46.45]:38527: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 02:44:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Gt21KWNFzNdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 02:45:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<2G8aLmNFqoIz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-12-08 02:46:44 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:50796: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-08 02:46:53 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:60588: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 02:47:52 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 02:48:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<RIxTN2NFtKIv/VJZ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 02:51:48 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 02:53:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<likTSmNF/JFn9M4G>


