# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.227.20
country_id: 6252001
description:
Dec 14 17:41:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.118.227.20, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<mTByY+hF0uMUduMU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-14 17:41:04 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:38980: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-12-14 17:41:19 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:50365: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 14 17:45:42 host2 sshd[2771819]: Disconnected from invalid user webmaster 42.200.66.164 port 40866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.251
country_id: 3996063
description:
2025-12-14 17:45:47 dovecot_login authenticator failed for (201.173.216.251-clientes-izzi.mx) [201.173.216.251]:40225: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-12-14 17:46:00 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:35930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 14 17:46:22 host2 sshd[2772549]: Disconnected from invalid user business 42.200.66.164 port 52964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-12-14 17:46:29 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:55280: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-12-14 17:46:44 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:37526: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-14 17:47:09 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (mangar) [24.98.45.238]:48688: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 17:47:50 host2 sshd[2773319]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 14 17:47:39 host2 sshd[2773205]: Disconnected from invalid user narges 42.200.66.164 port 48926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.198.84.44
country_id: 6252001
description:
2025-12-14 17:51:05 dovecot_plain authenticator failed for 67-198-84-44.dyn.grandenetworks.net ([89.116.164.85]) [67.198.84.44]:43805: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.144.186.165
country_id: 1655842
description:
2025-12-14 17:50:43 dovecot_plain authenticator failed for ([89.116.164.85]) [202.144.186.165]:42511: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.188.234.223
country_id: 3469034
description:
2025-12-14 17:50:53 dovecot_plain authenticator failed for ([89.116.164.85]) [200.188.234.223]:54113: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-12-14 17:54:20 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:45522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-12-14 17:54:30 dovecot_plain authenticator failed for (diess) [85.29.149.211]:48670: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-14 17:54:36 dovecot_login authenticator failed for ([84.211.13.69]) [84.211.13.69]:47616: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 17:54:42 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50103: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-14 17:55:56 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:48228: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 14 17:55:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<h7GSl+hF7NWLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.224
country_id: 6252001
description:
2025-12-14 17:56:15 dovecot_login authenticator failed for wsip-184-191-242-224.fv.ks.cox.net [184.191.242.224]:33498: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-14 17:58:25 dovecot_plain authenticator failed for (abilus) [5.11.141.74]:43346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-12-14 17:59:59 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:60738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-14 18:00:14 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:46702: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.116.189.189
country_id: 953987
description:
2025-12-14 18:00:34 dovecot_plain authenticator failed for ([89.116.164.85]) [41.116.189.189]:51348: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-14 18:00:42 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (ottism) [98.193.112.85]:39472: 535 Incorrect authentication data (set_id=help@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.46.8.131
country_id: 1643084
description:
2025-12-14 18:00:49 dovecot_plain authenticator failed for ([89.116.164.85]) [103.46.8.131]:60024: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.91.177.217
country_id: 6254930
description:
2025-12-14 18:01:03 dovecot_plain authenticator failed for ([89.116.164.85]) [77.91.177.217]:49288: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.121.39
country_id: 2264397
description:
2025-12-14 18:02:01 dovecot_plain authenticator failed for a109-51-121-39.cpe.netcabo.pt ([89.116.164.85]) [109.51.121.39]:33577: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.118.133
country_id: 1168579
description:
2025-12-14 18:02:03 dovecot_plain authenticator failed for ([89.116.164.85]) [59.103.118.133]:57006: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.38.84
country_id: 3895114
description:
2025-12-14 18:02:08 dovecot_plain authenticator failed for ([89.116.164.85]) [190.114.38.84]:2309: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-14 18:01:43 dovecot_plain authenticator failed for (sauth) [65.20.184.80]:58471: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.160.142
country_id: 1694008
description:
2025-12-14 18:02:31 dovecot_plain authenticator failed for ([89.116.164.85]) [103.167.160.142]:40056: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.97.252.190
country_id: 3625428
description:
2025-12-14 18:02:33 dovecot_plain authenticator failed for ([89.116.164.85]) [190.97.252.190]:56563: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.41.105.7
country_id: 1327865
description:
2025-12-14 18:02:33 dovecot_plain authenticator failed for ([89.116.164.85]) [45.41.105.7]:19416: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.126.10.254
country_id: 3895114
description:
2025-12-14 18:02:14 dovecot_plain authenticator failed for ([89.116.164.85]) [191.126.10.254]:20109: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.38.84
country_id: 3895114
description:
2025-12-14 18:02:15 dovecot_login authenticator failed for ([89.116.164.85]) [190.114.38.84]:2309: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.33.69.14
country_id: 3469034
description:
2025-12-14 18:02:17 dovecot_plain authenticator failed for ([89.116.164.85]) [177.33.69.14]:35258: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.72.28.142
country_id: 3469034
description:
2025-12-14 18:02:21 dovecot_plain authenticator failed for 189-72-28-142.user3p.v-tal.net.br ([89.116.164.85]) [189.72.28.142]:44924: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 14 18:03:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<Y92Bs+hFQtpog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-14 18:04:35 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:33633: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-14 18:05:03 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:56390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-14 18:05:10 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:51806: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.6.42
country_id: 2542007
description:
2025-12-14 18:06:03 dovecot_plain authenticator failed for ([89.116.164.85]) [105.72.6.42]:46096: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.16
country_id: 6252001
description:
2025-12-14 18:05:34 dovecot_login authenticator failed for ([98.181.44.16]) [98.181.44.16]:48042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.141.72.165
country_id: 3469034
description:
2025-12-14 18:05:50 dovecot_plain authenticator failed for cgnat-165.online.caxias.br ([89.116.164.85]) [192.141.72.165]:15537: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.20.157.14
country_id: 3865483
description:
2025-12-14 18:06:19 dovecot_plain authenticator failed for ([89.116.164.85]) [181.20.157.14]:37810: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.201.224
country_id: 1269750
description:
2025-12-14 18:06:35 dovecot_login authenticator failed for ([103.250.160.76]) [59.96.201.224]:51730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.32.121
country_id: 390903
description:
2025-12-14 18:06:46 dovecot_login authenticator failed for (149-210-32-121.mobile.nym.cosmote.net) [149.210.32.121]:47873: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 14 18:09:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<YvwqyOhFmARChJmL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 14 18:10:50 host2 sshd[2789944]: Disconnected from invalid user develop 185.216.116.13 port 60456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-12-14 18:10:31 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:33171: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-14 18:11:31 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:56242: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-14 18:11:43 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:52790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 14 18:12:08 host2 sshd[2790819]: Disconnected from invalid user scheduler 185.216.116.13 port 55592 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-14 18:11:17 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:52554: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.2.16.39
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.2.16.39 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.181.2.190
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.181.2.190 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.232.22.112
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.232.22.112 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.139.89.152
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.139.89.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.185.15.51
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.185.15.51 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:12:32 host2 sshd[2791092]: Disconnected from invalid user idempiere 152.32.215.203 port 50728 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.135.236.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 207.135.236.151 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.13.52
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.0.13.52 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-14 18:12:48 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:59680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.70
country_id: 1733045
description:
2025-12-14 18:13:13 dovecot_login authenticator failed for ([49.125.201.70]) [49.125.201.70]:33346: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-14 18:13:31 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:52583: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:13:47 host2 sshd[2791861]: Disconnected from invalid user hik 152.32.215.203 port 33376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 18:14:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Y0RQ2uhFro8+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:14:25 host2 sshd[2792211]: Disconnected from invalid user zhy 179.127.26.32 port 42464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:15:11 host2 sshd[2793036]: Disconnected from invalid user ubuntu 179.127.26.32 port 40674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-14 18:15:48 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:43562: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:16:41 host2 sshd[2794132]: Disconnected from invalid user yang 179.127.26.32 port 49168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-14 18:17:14 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:46870: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.130
country_id: 298795
description:
Dec 14 18:17:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@v-deploy.com>, method=PLAIN, rip=149.34.211.130, lip=66.85.158.91, TLS, session=<7m/w5ehFjOaVItOC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:18:15 host2 sshd[2795090]: Disconnected from invalid user sammy 152.32.215.203 port 50568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 14 18:18:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<Wwpb5+hF5IvJqAle>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-14 18:20:55 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:54359: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-14 18:20:44 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:56864: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 18:22:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<9EOq+OhFFNqB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.151
country_id: 1269750
description:
Dec 14 18:24:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=103.164.246.151, lip=66.85.158.91, TLS, session=<zwWa/ehFVeBnpPaX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-14 18:24:36 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:59052: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-14 18:24:47 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:32568: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.93
country_id: 690791
description:
Dec 14 18:24:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=37.221.134.93, lip=66.85.158.91, TLS, session=<HUnd/uhFspgl3YZd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.199.231.110
country_id: 1282988
description:
2025-12-14 18:25:35 dovecot_plain authenticator failed for ([89.116.164.85]) [113.199.231.110]:15598: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.29.201.193
country_id: 3865483
description:
2025-12-14 18:25:49 dovecot_plain authenticator failed for ([89.116.164.85]) [181.29.201.193]:44393: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 16.98.109.97
country_id: 6252001
description:
2025-12-14 18:26:01 dovecot_plain authenticator failed for ([89.116.164.85]) [16.98.109.97]:28024: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-14 18:29:07 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:45461: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-14 18:29:49 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:33550: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-14 18:29:33 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:57132: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.232.162.147
country_id: 3469034
description:
2025-12-14 18:30:51 dovecot_plain authenticator failed for 168-232-162-147.static.sumicity.net.br ([89.116.164.85]) [168.232.162.147]:15186: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.236.62.19
country_id: 3469034
description:
2025-12-14 18:31:04 dovecot_plain authenticator failed for 186-236-62-19.viabol.com.br ([89.116.164.85]) [186.236.62.19]:34597: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.170.21
country_id: 3996063
description:
2025-12-14 18:30:11 dovecot_login authenticator failed for ([177.236.170.21]) [177.236.170.21]:38973: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.191
country_id: 6252001
description:
Dec 14 18:30:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.8.191, lip=66.85.158.91, session=<mtWpE+lFzNsUqwi/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.236.62.19
country_id: 3469034
description:
2025-12-14 18:31:11 dovecot_login authenticator failed for 186-236-62-19.viabol.com.br ([89.116.164.85]) [186.236.62.19]:34597: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.201.154.255
country_id: 3469034
description:
2025-12-14 18:31:17 dovecot_plain authenticator failed for ([89.116.164.85]) [128.201.154.255]:20354: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-14 18:31:18 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:27431: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 18:31:32 host2 sshd[2804623]: Disconnected from invalid user admin 2.57.121.112 port 52701 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.19.227
country_id: 953987
description:
2025-12-14 18:32:54 dovecot_plain authenticator failed for ([89.116.164.85]) [102.32.19.227]:51946: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.227.186
country_id: 3865483
description:
2025-12-14 18:33:07 dovecot_plain authenticator failed for ([89.116.164.85]) [45.65.227.186]:54267: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.227.186
country_id: 3865483
description:
2025-12-14 18:33:14 dovecot_login authenticator failed for ([89.116.164.85]) [45.65.227.186]:54267: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec 14 18:33:17 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, session=<L6k8HulFEhKnXpIy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.67.34.82
country_id: 3469034
description:
2025-12-14 18:33:23 dovecot_plain authenticator failed for ([89.116.164.85]) [177.67.34.82]:52742: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-14 18:35:54 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:57500: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-14 18:36:04 dovecot_plain authenticator failed for (judous) [38.248.111.238]:45731: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-14 18:36:07 dovecot_plain authenticator failed for (unicalle) [50.231.243.28]:52132: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-14 18:36:12 dovecot_plain authenticator failed for (nothagral) [102.53.15.180]:47626: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-14 18:36:14 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:43253: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 129.212.232.248
country_id: 1880251
description:
Dec 14 18:36:51 host2 pure-ftpd[2808217]: (?@129.212.232.248) [INFO] New connection from 129.212.232.248


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.135
country_id: 6252001
description:
Dec 14 18:37:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.154.135, lip=66.85.158.91, TLS: Connection closed, session=<NT7lLOlFcMHHLZqH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:42:13 host2 sshd[2811982]: Disconnected from invalid user User 213.142.151.19 port 41848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-14 18:45:58 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:59764: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-14 18:46:12 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:51614: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:47:02 host2 sshd[2815928]: Disconnected from invalid user valera 213.142.151.19 port 40726 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.134.119.200
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.134.119.200 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:48:16 host2 sshd[2816761]: Disconnected from invalid user connor 213.142.151.19 port 39608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 18:49:20 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57814: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-14 18:49:40 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:40547: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:50:09 host2 sshd[2818252]: Disconnected from invalid user vncuser 213.142.151.19 port 38630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.236.255.16
country_id: 6252001
description:
2025-12-14 18:51:28 dovecot_plain authenticator failed for c-71-236-255-16.hsd1.or.comcast.net ([89.116.164.85]) [71.236.255.16]:52102: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.152.14.222
country_id: 146669
description:
2025-12-14 18:51:40 dovecot_plain authenticator failed for cpe-985163.ip.primehome.com ([89.116.164.85]) [62.152.14.222]:44602: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.21.49.3
country_id: 3865483
description:
2025-12-14 18:51:53 dovecot_plain authenticator failed for ([89.116.164.85]) [181.21.49.3]:56124: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.69.251.106
country_id: 597427
description:
2025-12-14 18:54:47 dovecot_login authenticator failed for (md-188-69-251-106.omni.lt) [188.69.251.106]:41262: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-14 18:54:53 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:50927: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-12-14 18:54:28 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:59057: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-14 18:55:26 dovecot_login authenticator failed for (cm-84.210.149.45.get.no) [84.210.149.45]:46826: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-14 18:56:14 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:44024: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.136.191.244
country_id: 2542007
description:
2025-12-14 18:58:38 dovecot_plain authenticator failed for ([89.116.164.85]) [105.136.191.244]:45123: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.195.22.145
country_id: 1694008
description:
2025-12-14 18:58:54 dovecot_plain authenticator failed for ([89.116.164.85]) [180.195.22.145]:51606: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 18:59:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<0uGKe+lF7tU+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 14 18:59:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.44, lip=66.85.158.91, session=<LJPffOlFLOg+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-14 19:00:45 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:58322: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.138
country_id: 6252001
description:
2025-12-14 19:01:04 dovecot_login authenticator failed for wsip-184-191-250-138.fv.ks.cox.net [184.191.250.138]:55323: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-14 19:01:21 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54193: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-14 19:01:41 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:60854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-14 19:01:56 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:34090: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-14 19:02:08 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:55526: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-14 19:05:47 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:52544: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-12-14 19:06:17 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:38581: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 19:08:22 host2 sshd[2830723]: Disconnected from invalid user violet 62.60.131.157 port 27734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 19:08:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<YcqtnOlF4qA+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:09:17 host2 sshd[2831381]: Disconnected from invalid user ociispth 162.240.39.179 port 59186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-14 19:10:45 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:34282: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:10:53 host2 sshd[2832857]: Disconnected from invalid user admin 162.240.39.179 port 59518 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 19:11:52 host2 sshd[2833495]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.84.186
country_id: 294640
description:
2025-12-14 19:11:12 dovecot_login authenticator failed for (2-54-84-186.orange.net.il) [2.54.84.186]:34930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:11:25 host2 sshd[2833231]: Disconnected from invalid user dev 162.240.39.179 port 43690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 19:12:08 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (ulint) [73.208.81.125]:41374: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.163.186
country_id: 298795
description:
2025-12-14 19:12:11 dovecot_plain authenticator failed for ([89.116.164.85]) [81.214.163.186]:42816: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:13:36 host2 sshd[2834929]: Disconnected from invalid user runner 192.81.208.35 port 43920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-14 19:13:53 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:37102: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-14 19:14:03 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:50296: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-14 19:14:24 dovecot_login authenticator failed for ([196.190.43.139]) [196.190.41.137]:10596: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:14:39 host2 sshd[2835740]: Disconnected from invalid user admin1 162.240.39.179 port 33420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.51
country_id: 1733045
description:
2025-12-14 19:14:49 dovecot_login authenticator failed for ([49.124.153.51]) [49.124.153.51]:41794: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-14 19:15:02 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:35914: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:15:03 host2 sshd[2836151]: Disconnected from invalid user mrodelo 103.56.30.33 port 47816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:15:14 host2 sshd[2836381]: Disconnected from invalid user me 192.81.208.35 port 55748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.155
country_id: 6252001
description:
Dec 14 19:15:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.155, lip=66.85.158.92, session=<Z7ZRtelFYr2H7X2b>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:15:45 host2 sshd[2836787]: Disconnected from invalid user storage 192.81.208.35 port 40276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 19:16:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<d7mDuelFLp2nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-14 19:16:23 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:39840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:16:29 host2 sshd[2837423]: Disconnected from invalid user runner 103.56.30.33 port 21480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-14 19:16:39 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:54686: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:17:57 host2 sshd[2838443]: Disconnected from invalid user me 103.56.30.33 port 41582 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:18:30 host2 sshd[2838833]: Received disconnect from 192.81.208.35 port 52294:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.49.242.200
country_id: 2510769
description:
2025-12-14 19:19:56 dovecot_login authenticator failed for 200.red-83-49-242.dynamicip.rima-tde.net [83.49.242.200]:43158: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-14 19:20:04 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:41873: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:20:11 host2 sshd[2840416]: Disconnected from invalid user test 102.210.149.121 port 47046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:20:13 host2 sshd[2840335]: Disconnected from invalid user mrodelo 45.78.202.90 port 45720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-14 19:20:24 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:54512: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-12-14 19:20:31 dovecot_login authenticator failed for ([195.158.14.232]) [195.158.14.232]:34042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-14 19:20:45 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (monion) [76.106.163.189]:51492: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:21:07 host2 sshd[2841308]: Disconnected from invalid user admin1 192.81.208.35 port 41510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-14 19:22:21 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:49002: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.55
country_id: 1733045
description:
2025-12-14 19:21:22 dovecot_login authenticator failed for ([49.124.151.55]) [49.124.151.55]:40248: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-14 19:21:36 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:57953: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:22:24 host2 sshd[2842396]: Disconnected from invalid user automation 45.78.202.90 port 39000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:22:26 host2 sshd[2842437]: Disconnected from invalid user ubuntu 102.210.149.121 port 47942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:22:51 host2 sshd[2842694]: Disconnected from invalid user mary 43.166.245.172 port 54784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-14 19:23:06 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:42326: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:24:11 host2 sshd[2843824]: Disconnected from invalid user ubuntu 102.210.149.121 port 48138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:23:38 host2 sshd[2843367]: Disconnected from invalid user k 205.185.126.121 port 54172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:24:53 host2 sshd[2844316]: Disconnected from invalid user es 205.185.126.121 port 51028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:25:27 host2 sshd[2844830]: Disconnected from invalid user Test 205.185.126.121 port 35338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-14 19:25:51 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:37474: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:26:06 host2 sshd[2845333]: Disconnected from invalid user daniela 38.77.234.93 port 38640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-14 19:26:13 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:49302: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:26:40 host2 sshd[2845607]: Disconnected from invalid user admin1234 205.185.126.121 port 60422 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.191.182.211
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.191.182.211 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.241.68.24
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 88.241.68.24 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-14 19:26:41 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:38734: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.104.101
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.203.104.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.181.208.155
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.181.208.155 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-14 19:26:53 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:50050: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.39.208
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.4.39.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:27:14 host2 sshd[2845912]: Disconnected from invalid user user1 38.77.234.93 port 56286 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.3.228.182
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.3.228.182 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.89.70.139
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 202.89.70.139 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 19:28:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<TF8q4ulFvr0+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:27:27 host2 sshd[2846063]: Disconnected from invalid user k 43.166.245.172 port 17152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:27:47 host2 sshd[2846243]: Disconnected from invalid user ubuntu 38.77.234.93 port 59500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:29:17 host2 sshd[2846942]: Disconnected from invalid user storage 45.78.202.90 port 46406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.115.165
country_id: 3865483
description:
2025-12-14 19:28:24 dovecot_plain authenticator failed for ([89.116.164.85]) [190.173.115.165]:46625: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.245.208
country_id: 3865483
description:
2025-12-14 19:28:38 dovecot_plain authenticator failed for ([89.116.164.85]) [186.23.245.208]:46496: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:28:43 host2 sshd[2846694]: Disconnected from invalid user admin1234 43.166.245.172 port 11776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.21.189.208
country_id: 3017382
description:
2025-12-14 19:28:51 dovecot_plain authenticator failed for aorleans-652-1-3-208.w90-21.abo.wanadoo.fr ([89.116.164.85]) [90.21.189.208]:45686: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 14 19:29:50 host2 sshd[2847248]: Disconnected from invalid user mohammad 192.76.153.90 port 34616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:29:58 host2 sshd[2847312]: Disconnected from invalid user server 68.183.82.237 port 34182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:30:39 host2 sshd[2847868]: Disconnected from invalid user mcadmin 68.183.82.237 port 50958 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:31:19 host2 sshd[2848216]: Disconnected from invalid user ubuntu 68.183.82.237 port 55282 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-14 19:31:36 dovecot_plain authenticator failed for (dryballs) [109.226.14.93]:46888: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 14 19:32:06 host2 sshd[2848680]: Disconnected from invalid user noreply 192.76.153.90 port 34934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:32:39 host2 sshd[2848906]: Disconnected from invalid user admin1234 68.183.82.237 port 44058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.194.235.86
country_id: 290557
description:
Dec 14 19:32:47 host2 sshd[2848955]: Disconnected from invalid user admin1234 5.194.235.86 port 55944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:32:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AOxr8+lFBt6i2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:33:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<yJkX9+lF/PCi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:34:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<kR5++elFeOGi2JVE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:34:42 host2 sshd[2849795]: Disconnected from invalid user build 45.226.53.7 port 56398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:35:29 host2 sshd[2850390]: Disconnected from invalid user testuser 45.226.53.7 port 44764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.9
country_id: 3469034
description:
Dec 14 19:36:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.71.89.9, lip=66.85.158.91, TLS, session=<Pyys/elF6pOxR1kJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-14 19:36:12 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:48992: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-14 19:36:26 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:46560: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.176
country_id: 1269750
description:
Dec 14 19:36:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts>, method=PLAIN, rip=103.18.166.176, lip=66.85.158.91, TLS, session=<ndnw/ulFK71nEqaw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 19:38:38 host2 sshd[2852551]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 19:39:20 host2 sshd[2852981]: Disconnected from invalid user user 2.57.121.25 port 35908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:38:31 host2 sshd[2852480]: Disconnected from invalid user ubuntu 45.226.53.7 port 55326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.8.125.130
country_id: 3469034
description:
2025-12-14 19:40:18 dovecot_login authenticator failed for ([189.8.125.130]) [189.8.125.130]:47627: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.210.164
country_id: 2921044
description:
Dec 14 19:39:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.154.210.164, lip=66.85.158.91, TLS, session=<K4YzDOpFBo3PmtKk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-12-14 19:40:40 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:45994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:42:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS, session=<oF1EFOpFhPmi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:42:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS, session=<uSVRFupFLvOi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 14 19:44:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<20HCHOpFLKtAPpzU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.38.102.187
country_id: 130758
description:
2025-12-14 19:44:53 dovecot_plain authenticator failed for (doman) [89.38.102.187]:48126: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-14 19:45:13 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:52928: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.0.23.20
country_id: 192950
description:
2025-12-14 19:46:18 dovecot_plain authenticator failed for ([89.116.164.85]) [102.0.23.20]:35220: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-14 19:46:20 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:51214: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-14 19:45:29 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:40160: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.32.123.9
country_id: 3469034
description:
2025-12-14 19:45:35 dovecot_login authenticator failed for (187-032-123-009.static.ctbctelecom.com.br) [187.32.123.9]:3732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-14 19:45:45 dovecot_login authenticator failed for ([182.95.2.9]) [182.78.67.22]:38658: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.168.38
country_id: 3469034
description:
2025-12-14 19:45:52 dovecot_plain authenticator failed for ([89.116.164.85]) [131.255.168.38]:50634: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.92.158.97
country_id: 3017382
description:
2025-12-14 19:46:04 dovecot_plain authenticator failed for 89-92-158-97.hfc.dyn.abo.bbox.fr ([89.116.164.85]) [89.92.158.97]:64094: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.0.23.20
country_id: 192950
description:
2025-12-14 19:46:25 dovecot_login authenticator failed for ([89.116.164.85]) [102.0.23.20]:35220: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.92
country_id: 3469034
description:
Dec 14 19:47:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=170.80.41.92, lip=66.85.158.91, TLS, session=<UkYMJepFTo2qUClc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.226
country_id: 3865483
description:
Dec 14 19:47:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.252.226, lip=66.85.158.91, TLS, session=<ecxLJupF2uezAPzi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-14 19:51:01 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:51976: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-14 19:51:22 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:35067: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-14 19:51:53 dovecot_login authenticator failed for (189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:59629: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-14 19:52:17 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:37075: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 93.123.109.115
country_id: 732800
description:
Dec 14 19:55:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=93.123.109.115, lip=66.85.158.91, TLS: Connection closed, session=<TuluQ+pFDs5de21z>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.31.178.148
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.31.178.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.165.30.251
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.165.30.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.200.33.40
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 87.200.33.40 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:17 host2 sshd[2865719]: error: maximum authentication attempts exceeded for root from 68.58.204.249 port 45268 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.43.129
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.164.43.129 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.155.240.207
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.155.240.207 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.189
country_id: 6252001
description:
Dec 14 19:56:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cGtMRupF1OMUQcG9>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:17 host2 sshd[2865719]: Disconnecting authenticating user root 68.58.204.249 port 45268: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.154.166.17
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.154.166.17 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.152.164
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.244.152.164 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.141.13.45
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 175.141.13.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:22 host2 sshd[2865795]: error: maximum authentication attempts exceeded for invalid user admin from 68.58.204.249 port 46302 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.5.117
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.168.5.117 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.49.16.163
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.49.16.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.118.170.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.118.170.89 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.53.2.142
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.53.2.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:23 host2 sshd[2865805]: Disconnecting invalid user admin 68.58.204.249 port 46310: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.67.230.52
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.67.230.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.178.247.14
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.178.247.14 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.86.164.242
country_id: 3625428
description:
2025-12-14 19:58:25 dovecot_plain authenticator failed for ([89.116.164.85]) [82.86.164.242]:16864: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.152.42.84
country_id: 192950
description:
2025-12-14 19:58:38 dovecot_plain authenticator failed for ([89.116.164.85]) [154.152.42.84]:54372: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.92.143.52
country_id: 1733045
description:
2025-12-14 19:58:54 dovecot_plain authenticator failed for ([89.116.164.85]) [219.92.143.52]:55820: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.225.186.148
country_id: 6252001
description:
2025-12-14 20:00:19 dovecot_plain authenticator failed for 108-225-186-148.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [108.225.186.148]:52080: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.225.186.148
country_id: 6252001
description:
2025-12-14 20:00:25 dovecot_login authenticator failed for 108-225-186-148.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [108.225.186.148]:52080: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.32.33.157
country_id: 6252001
description:
2025-12-14 20:00:30 dovecot_plain authenticator failed for ([89.116.164.85]) [76.32.33.157]:5188: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 20:00:35 host2 sshd[2868800]: Disconnected from invalid user  62.60.131.157 port 28518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.33.138.26
country_id: 3469034
description:
2025-12-14 20:00:44 dovecot_plain authenticator failed for ([89.116.164.85]) [177.33.138.26]:14950: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-14 20:01:22 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:55732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-12-14 20:01:41 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:56394: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.199.115
country_id: 1733045
description:
2025-12-14 20:02:18 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.199.115]:28110: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 20:03:10 host2 sshd[2871042]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.42.141.241
country_id: 3895114
description:
2025-12-14 20:02:52 dovecot_plain authenticator failed for ([89.116.164.85]) [181.42.141.241]:16893: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.199.115
country_id: 1733045
description:
2025-12-14 20:02:25 dovecot_login authenticator failed for ([89.116.164.85]) [115.135.199.115]:28110: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.234.245.49
country_id: 2635167
description:
2025-12-14 20:02:29 dovecot_plain authenticator failed for haye-25-b2-v4wan-169431-cust5424.vm28.cable.virginm.net ([89.116.164.85]) [92.234.245.49]:53716: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.196.1
country_id: 1733045
description:
2025-12-14 20:02:28 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.196.1]:2737: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.166.137.22
country_id: 3508796
description:
2025-12-14 20:02:40 dovecot_plain authenticator failed for ([89.116.164.85]) [190.166.137.22]:54901: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.237.202
country_id: 3865483
description:
2025-12-14 20:02:42 dovecot_plain authenticator failed for ([89.116.164.85]) [186.23.237.202]:57916: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-14 20:04:46 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:36300: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.30.98
country_id: 1733045
description:
2025-12-14 20:04:55 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.30.98]:24219: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-14 20:05:02 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:53316: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.172.73
country_id: 953987
description:
2025-12-14 20:05:07 dovecot_plain authenticator failed for ([89.116.164.85]) [197.184.172.73]:19397: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.24.21
country_id: 3439705
description:
2025-12-14 20:05:20 dovecot_plain authenticator failed for r186-53-24-21.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.24.21]:59630: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.23.198
country_id: 6252001
description:
Dec 14 20:04:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.29.23.198, lip=66.85.158.91, TLS, session=<QN4TZOpFgucUHRfG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.24.21
country_id: 3439705
description:
2025-12-14 20:05:27 dovecot_login authenticator failed for r186-53-24-21.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.24.21]:59630: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-14 20:05:54 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:51430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


