# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-13 01:23:14 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:54510: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-12-13 01:23:31 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:35545: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 01:24:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=</p6Bn8ZFzqnD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:25:18 host2 sshd[1068671]: Disconnected from invalid user artem 200.73.135.75 port 45032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 01:26:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<QJDOqMZFLtBo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2025-12-13 01:27:21 dovecot_login authenticator failed for 236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:52811: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-12-13 01:27:36 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:49108: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:28:27 host2 sshd[1070737]: Disconnected from invalid user ftpuser 200.73.135.75 port 41096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.53.141
country_id: 1880251
description:
Dec 13 01:28:31 host2 sshd[1070752]: Disconnected from invalid user nodejs 43.134.53.141 port 48242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:28:57 host2 sshd[1070909]: Disconnected from invalid user ha 54.162.68.141 port 53652 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 01:28:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<XE4YscZFgpMI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:29:32 host2 sshd[1071187]: Disconnected from invalid user nami 54.162.68.141 port 46806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 01:30:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<KGG7tMZFXpSKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:29:09 host2 sshd[1071013]: Disconnected from invalid user postgres 200.73.135.75 port 53596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:30:37 host2 sshd[1071983]: Disconnected from invalid user ubuntu 54.162.68.141 port 40384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:31:12 host2 sshd[1072341]: Disconnected from invalid user r00t 200.73.135.75 port 34662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.53.141
country_id: 1880251
description:
Dec 13 01:31:21 host2 sshd[1072434]: Disconnected from invalid user postgres 43.134.53.141 port 51942 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 01:31:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<K1kHusZFRoSB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 01:31:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<OK8husZFKJiH6yFP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:32:15 host2 sshd[1073348]: Disconnected from invalid user ubuntu 54.162.68.141 port 56840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-13 01:32:19 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:59682: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-13 01:32:30 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:34693: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2025-12-13 01:32:53 dovecot_login authenticator failed for (aes-static-225.77.144.59.airtel.in) [182.95.123.50]:50244: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 01:32:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<A7eEvMZFRr2kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-13 01:32:12 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:33036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.53.141
country_id: 1880251
description:
Dec 13 01:33:10 host2 sshd[1073925]: Disconnected from invalid user julio 43.134.53.141 port 46584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:33:20 host2 sshd[1074037]: Disconnected from invalid user patrol 54.162.68.141 port 41118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-13 01:33:48 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1127: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 01:34:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<zb1yw8ZF3KTCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-13 01:34:10 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:59324: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.53.141
country_id: 1880251
description:
Dec 13 01:35:05 host2 sshd[1075349]: Disconnected from invalid user luis 43.134.53.141 port 35508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:36:04 host2 sshd[1076139]: Disconnected from invalid user julio 200.73.135.75 port 37560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 01:35:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<KO68x8ZFto68putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 01:37:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<kh7TzsZFntcIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.241.64
country_id: 1269750
description:
Dec 13 01:38:13 host2 sshd[1077699]: Disconnected from invalid user peter 143.110.241.64 port 36816 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-13 01:38:22 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:54350: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-13 01:38:42 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:3584: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-13 01:39:10 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:39126: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.185
country_id: 3144096
description:
2025-12-13 01:39:40 dovecot_login authenticator failed for (cm-84.215.111.185.get.no) [84.215.111.185]:35894: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 01:39:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<b9Zb18ZFZrgv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.241.64
country_id: 1269750
description:
Dec 13 01:39:49 host2 sshd[1078534]: Disconnected from invalid user lee 143.110.241.64 port 42560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 01:40:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<GGIR2sZFaqc+PIMp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.241.64
country_id: 1269750
description:
Dec 13 01:40:27 host2 sshd[1079130]: Disconnected from invalid user deployer 143.110.241.64 port 36542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 13 01:40:34 host2 sshd[1079186]: Disconnected from invalid user support 20.12.41.6 port 43560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 13 01:41:10 host2 sshd[1079460]: Disconnected from invalid user ftpuser 20.12.41.6 port 45654 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 13 01:42:28 host2 sshd[1080030]: Disconnected from invalid user kafka 20.12.41.6 port 60734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 13 01:43:43 host2 sshd[1080772]: Disconnected from invalid user test 20.12.41.6 port 46494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 01:44:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<2hI56sZFGL2B4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 01:44:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<6Z8b6MZFaNQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-13 01:44:50 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (undist) [144.64.157.244]:52173: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-13 01:46:32 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (snecoeace) [68.38.201.238]:47222: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-13 01:47:31 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (regasia) [73.176.157.57]:57912: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-13 01:48:01 dovecot_plain authenticator failed for (eluenest) [149.62.239.4]:38612: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 01:48:06 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (obionvoust) [96.230.65.90]:48302: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 01:48:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<EeO798ZFiuQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-13 01:48:48 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:41315: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 01:48:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<I+lz98ZF0oqnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 13 01:49:24 host2 sshd[1084665]: Disconnected from invalid user www-data 103.38.182.49 port 49872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 01:49:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<z0pZ+8ZFbI9ntrtb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 01:51:07 host2 sshd[1085971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 01:50:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<Lm7G/MZFWJ+l6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 13 01:50:18 host2 sshd[1085441]: Disconnected from invalid user test3 186.87.166.141 port 33182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 01:50:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<HIb1/sZF4OUro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.170
country_id: 1643084
description:
Dec 13 01:50:46 host2 sshd[1085721]: Disconnected from invalid user qiyuesuo 103.179.56.170 port 60808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 13 01:51:28 host2 sshd[1086157]: Disconnected from invalid user git 191.185.168.78 port 60246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-13 01:52:01 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:36614: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 13 01:52:01 host2 sshd[1086438]: Disconnected from invalid user ubuntu 103.38.182.49 port 34450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-13 01:52:30 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:41620: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-13 01:52:50 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:56648: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.229
country_id: 192950
description:
Dec 13 01:52:58 host2 sshd[1087144]: Disconnected from invalid user ftp_user 102.220.23.229 port 56066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 13 01:53:19 host2 sshd[1087353]: Disconnected from invalid user proxyuser 103.38.182.49 port 55010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.253.45.10
country_id: 2510769
description:
Dec 13 01:53:28 host2 sshd[1087420]: Disconnected from invalid user ftpuser 46.253.45.10 port 36040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-13 01:53:38 dovecot_login authenticator failed for (201.172.89.74-clientes-izzi.mx) [201.172.89.74]:43754: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.229
country_id: 192950
description:
Dec 13 01:53:41 host2 sshd[1087541]: Disconnected from invalid user qiyuesuo 102.220.23.229 port 36710 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-12-13 01:53:19 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:33836: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 13 01:53:50 host2 sshd[1087623]: Disconnected from invalid user temp 191.185.168.78 port 47224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 13 01:54:38 host2 sshd[1088568]: Disconnected from invalid user mata 191.185.168.78 port 33474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 13 01:54:42 host2 sshd[1088608]: Disconnected from invalid user bpadmin 103.38.182.49 port 52864 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.229
country_id: 192950
description:
Dec 13 01:54:23 host2 sshd[1088308]: Disconnected from invalid user admin 102.220.23.229 port 39668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 13 01:54:32 host2 sshd[1088520]: Disconnected from invalid user ftp-test 37.32.10.237 port 40198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 13 01:55:42 host2 sshd[1089355]: Disconnected from invalid user elk 37.32.10.237 port 51026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 13 01:55:50 host2 sshd[1089449]: Disconnected from invalid user ubuntu 194.233.74.228 port 55092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Dec 13 01:55:16 host2 sshd[1089013]: Disconnected from invalid user mytest 152.32.218.244 port 52672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.229
country_id: 192950
description:
Dec 13 01:56:28 host2 sshd[1089860]: Disconnected from invalid user bpadmin 102.220.23.229 port 33608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 13 01:56:44 host2 sshd[1090035]: Disconnected from invalid user ela 186.87.166.141 port 58820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 01:57:02 host2 sshd[1090190]: Disconnected from invalid user temp 27.112.78.245 port 51910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.244
country_id: 1880251
description:
Dec 13 01:57:08 host2 sshd[1090301]: Disconnected from invalid user sammy 152.32.218.244 port 44446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 13 01:57:13 host2 sshd[1090380]: Disconnected from invalid user ircd 194.233.74.228 port 45516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 13 01:57:29 host2 sshd[1090533]: Disconnected from invalid user xray 37.32.10.237 port 40964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 13 01:57:45 host2 sshd[1090658]: Disconnected from invalid user evan 191.185.168.78 port 34942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-13 01:57:22 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:42856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.217.70
country_id: 1269750
description:
2025-12-13 01:57:32 dovecot_login authenticator failed for ([203.129.217.70]) [203.129.217.70]:58259: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-13 01:57:42 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:46910: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.250
country_id: 6252001
description:
2025-12-13 01:57:43 dovecot_login authenticator failed for ([98.185.121.250]) [98.185.121.250]:42191: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 01:57:57 host2 sshd[1090782]: Disconnected from invalid user builder 27.112.78.245 port 43238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 01:58:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<MSWnGcdF9K/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-13 01:58:17 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:35704: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-13 01:58:29 dovecot_login authenticator failed for (187-163-97-62.cust.smartcall.no) [62.97.163.187]:41895: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 01:58:46 host2 sshd[1091331]: Disconnected from invalid user git 27.112.78.245 port 54908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 01:59:55 host2 sshd[1091889]: Disconnected from invalid user admin 2.57.121.112 port 49717 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 01:59:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<mybsHMdFQMOG0Wp/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 01:59:42 host2 sshd[1091804]: Disconnected from invalid user mata 27.112.78.245 port 37644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 01:59:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<d7ALH8dFuOPCw3NV>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 46.253.45.10
country_id: 2510769
description:
Dec 13 02:00:09 host2 sshd[1092230]: Received disconnect from 46.253.45.10 port 33180:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 02:00:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<xg2WIcdFDNc+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 02:00:45 dovecot_plain authenticator failed for (furate) [64.72.74.162]:55940: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 13 02:00:29 host2 sshd[1092476]: Disconnected from invalid user ircd 37.32.10.237 port 49974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-13 02:00:41 dovecot_plain authenticator failed for (hoosig) [5.11.140.219]:59586: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 13 02:00:42 host2 sshd[1092596]: Disconnected from invalid user elk 194.233.74.228 port 50084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 13 02:00:47 host2 sshd[1092640]: Disconnected from invalid user rajesh 137.59.55.50 port 48870 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 02:01:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<urgNJMdFvpOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 02:01:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<KFbWJMdFjqNnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 02:01:29 host2 sshd[1093006]: Disconnected from invalid user ubuntu 27.112.78.245 port 44708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 13 02:02:03 host2 sshd[1093335]: Disconnected from invalid user ubuntu 137.59.55.50 port 57924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-13 02:03:00 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:45779: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 13 02:03:47 host2 sshd[1094627]: Disconnected from invalid user syncuser 202.51.214.99 port 56660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-13 02:03:44 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:51304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 13 02:03:15 host2 sshd[1094266]: Disconnected from invalid user www-data 137.59.55.50 port 53076 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 02:03:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<d+BELMdFNuBetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.170
country_id: 1643084
description:
Dec 13 02:03:11 host2 sshd[1094208]: Disconnected from invalid user rajesh 103.179.56.170 port 45942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-13 02:03:13 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:56568: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 13 02:04:10 host2 sshd[1094987]: Disconnected from invalid user hadoop 107.150.110.167 port 12956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.170
country_id: 1643084
description:
Dec 13 02:04:37 host2 sshd[1095275]: Disconnected from invalid user es_user 103.179.56.170 port 58214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 02:04:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<xsj0MMdFLCcvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-13 02:04:44 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (oveed) [73.168.136.150]:43260: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 02:04:47 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (vagiver) [96.230.65.90]:56314: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 13 02:05:30 host2 sshd[1096040]: Disconnected from invalid user gautam 202.51.214.99 port 57246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 13 02:05:37 host2 sshd[1096126]: Disconnected from invalid user jy 107.150.110.167 port 41020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 13 02:05:44 host2 sshd[1096162]: Disconnected from invalid user mani 197.158.254.18 port 38916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.77
country_id: 6252001
description:
Dec 13 02:05:47 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.77, lip=66.85.158.91, session=<xZDVNMdFdvnG6xhN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Dec 13 02:06:22 host2 sshd[1096481]: Disconnected from invalid user pepe 103.154.77.48 port 57370 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-13 02:07:03 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:35740: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-13 02:07:58 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:52680: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 13 02:07:14 host2 sshd[1096950]: Disconnected from invalid user test 193.187.148.79 port 39856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 13 02:07:16 host2 sshd[1096982]: Disconnected from invalid user ubuntu 107.150.110.167 port 23272 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-13 02:07:21 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (sularding) [66.177.30.53]:33324: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 13 02:07:25 host2 sshd[1097069]: Disconnected from invalid user niti 202.51.214.99 port 37786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 02:07:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<xrvOO8dFYpE+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Dec 13 02:08:43 host2 sshd[1098091]: Disconnected from invalid user enter 103.154.77.48 port 47530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.150.56
country_id: 6252001
description:
Dec 13 02:08:57 host2 sshd[1098223]: Disconnected from invalid user pepe 198.23.150.56 port 43132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Dec 13 02:09:07 host2 sshd[1098347]: Disconnected from invalid user dbuser 104.248.17.208 port 41664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 13 02:08:34 host2 sshd[1097792]: Disconnected from invalid user june 197.158.254.18 port 53364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 13 02:09:26 host2 sshd[1098571]: Disconnected from invalid user admin 197.158.254.18 port 39346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 02:09:38 host2 sshd[1098704]: Disconnected from invalid user  62.60.131.157 port 62498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 13 02:09:58 host2 sshd[1098906]: Disconnected from invalid user ftp_user 193.187.148.79 port 36650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 13 02:10:16 host2 sshd[1099306]: Disconnected from invalid user willem 197.158.254.18 port 53558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Dec 13 02:10:25 host2 sshd[1099418]: Disconnected from invalid user ubuntu 45.249.245.22 port 37290 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.17.208
country_id: 2921044
description:
Dec 13 02:10:30 host2 sshd[1099511]: Disconnected from invalid user factorio 104.248.17.208 port 47324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 02:10:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<rADCRsdFzKy8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 02:11:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Ctq3ScdFrIxm1bVi>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 13 02:12:05 host2 sshd[1100517]: Received disconnect from 193.187.148.79 port 39866:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 13 02:12:05 host2 sshd[1100517]: Disconnected from invalid user ubuntu 193.187.148.79 port 39866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-13 02:13:33 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:52582: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 13 02:13:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<Fy+LT8dF8K/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2025-12-13 02:13:19 dovecot_login authenticator failed for 180.188.76.219.static.netvigator.com [219.76.188.180]:54791: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 02:13:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<qQ3aT8dF+pbD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 02:16:58 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (domarigo) [96.230.65.90]:40766: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 02:16:25 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (hipomonony) [196.47.172.253]:33112: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 02:16:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<a/8WW8dFxoBAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 02:16:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<quhYXMdFApfAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-12-13 02:18:01 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:52721: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.43
country_id: 3175395
description:
Dec 13 02:18:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=217.26.178.43, lip=66.85.158.91, TLS, session=<6YG9X8dFE4jZGrIr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.107
country_id: 3175395
description:
Dec 13 02:18:24 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.47.136.107, lip=66.85.158.91, TLS, session=<p3fpYMdFPOi5L4hr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.198.29
country_id: 1522867
description:
2025-12-13 02:18:38 dovecot_login authenticator failed for 2.133.198.29.dynamic.telecom.kz [2.133.198.29]:54955: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 02:18:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<5/1/Y8dFbM+LOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-13 02:19:09 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:47408: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-13 02:19:32 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (pyromers) [76.31.164.124]:46124: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 02:19:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<8nr6ZMdF8rTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 02:20:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54582: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 02:21:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<XraJa8dFTs0ImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.51.52.15
country_id: 1605651
description:
2025-12-13 02:22:01 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [101.51.52.15]:42891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-13 02:22:02 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:50879: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.88
country_id: 3996063
description:
2025-12-13 02:22:14 dovecot_login authenticator failed for ([201.173.97.88]) [201.173.97.88]:46083: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-13 02:22:29 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:40752: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-13 02:22:53 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:38480: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2025-12-13 02:23:07 dovecot_login authenticator failed for (164-53-26-103.intechonline.net) [122.169.40.221]:39116: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.61
country_id: 6252001
description:
2025-12-13 02:24:04 dovecot_login authenticator failed for ([98.185.120.61]) [98.185.120.61]:56840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-12-13 02:24:10 dovecot_plain authenticator failed for c-73-55-194-114.hsd1.tx.comcast.net (cambly) [73.55.194.114]:46890: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 13 02:23:40 host2 sshd[1108278]: Disconnected from invalid user git 103.176.79.117 port 60306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 13 02:23:49 host2 sshd[1108355]: Disconnected from invalid user erpnext 152.32.203.205 port 36628 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.70.252
country_id: 2921044
description:
Dec 13 02:24:26 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.70.252, lip=66.85.158.92, session=<C9KCd8dFz2aGekb8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.78.30
country_id: 2921044
description:
Dec 13 02:24:26 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.232.78.30, lip=66.85.158.92, session=<km2Jd8dFBhSl6E4e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-13 02:24:55 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (ancized) [73.137.7.97]:41206: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 13 02:25:10 host2 sshd[1109324]: Disconnected from invalid user frappe 207.154.247.4 port 59840 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 02:26:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=</YhafcdF4NAI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 02:25:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<6k2BesdFxtOKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 13 02:25:23 host2 sshd[1109586]: Disconnected from invalid user joao 152.32.203.205 port 58840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 13 02:25:45 host2 sshd[1109763]: Disconnected from invalid user builduser 103.164.81.65 port 57338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 13 02:25:48 host2 sshd[1109780]: Disconnected from invalid user test 223.17.0.220 port 38512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 13 02:26:17 host2 sshd[1110035]: Disconnected from invalid user temp 152.32.203.205 port 43266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-13 02:28:04 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:58170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-13 02:28:08 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:59786: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 13 02:27:44 host2 sshd[1110775]: Disconnected from invalid user john 103.164.81.65 port 39584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-13 02:27:46 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (gention) [68.193.149.88]:36320: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-13 02:27:54 dovecot_login authenticator failed for ([182.95.178.154]) [182.95.178.154]:53800: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.87.153
country_id: 1880251
description:
Dec 13 02:29:14 host2 sshd[1111799]: Disconnected from invalid user fran 43.128.87.153 port 48334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.160
country_id: 2186224
description:
2025-12-13 02:28:20 dovecot_login authenticator failed for ([121.73.169.160]) [121.73.169.160]:43356: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Dec 13 02:28:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<v88OhsdFoFSnXpI6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 02:28:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<khVuhsdFruGkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-13 02:29:01 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:33963: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 13 02:28:57 host2 sshd[1111483]: Disconnected from invalid user ftpuser 207.154.247.4 port 54278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 13 02:29:12 host2 sshd[1111770]: Disconnected from invalid user www-data 103.103.245.61 port 49068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-13 02:29:08 dovecot_login authenticator failed for (88.255.189.21.static.ttnet.com.tr) [88.255.189.21]:33464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 13 02:28:20 host2 sshd[1111162]: Disconnected from invalid user ftpuser 103.164.81.65 port 51988 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-13 02:29:15 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:35654: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 13 02:29:37 host2 sshd[1112018]: Disconnected from invalid user elena 207.154.247.4 port 33050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 13 02:29:46 host2 sshd[1112078]: Disconnected from invalid user elena 103.103.245.61 port 33746 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-13 02:29:25 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:47867: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 13 02:30:06 host2 sshd[1112431]: Disconnected from invalid user erpnext 223.17.0.220 port 44610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.237.122.43
country_id: 6252001
description:
Dec 13 02:30:31 host2 sshd[1112701]: Disconnected from invalid user builduser 135.237.122.43 port 51158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 02:30:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Sf/QjMdF9ICH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 02:30:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Ekd6jMdFWMaB4kCN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.87.153
country_id: 1880251
description:
Dec 13 02:32:07 host2 sshd[1113580]: Disconnected from invalid user elena 43.128.87.153 port 43958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 13 02:31:28 host2 sshd[1113213]: Disconnected from invalid user elena 72.144.12.31 port 45204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 02:31:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<07KykMdFVJbCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 13 02:32:04 host2 sshd[1113564]: Disconnected from invalid user fran 103.103.245.61 port 58952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-13 02:32:38 dovecot_plain authenticator failed for (intably) [24.187.213.29]:53398: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 13 02:32:49 host2 sshd[1113947]: Disconnected from invalid user ftpuser 103.176.79.117 port 39250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 13 02:32:39 host2 sshd[1113867]: Disconnected from invalid user ftpuser 103.103.245.61 port 36604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 13 02:33:18 host2 sshd[1114270]: Disconnected from invalid user user1 72.144.12.31 port 57846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Dec 13 02:33:35 host2 sshd[1114426]: Disconnected from invalid user esunny 135.237.122.43 port 46912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 02:33:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<1TRWmMdFIOm8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.30
country_id: 798544
description:
Dec 13 02:33:49 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=91.228.33.30, lip=66.85.158.91, TLS, session=<OHMjmMdFFrRb5CEe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.194
country_id: 3865483
description:
Dec 13 02:34:11 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=186.190.167.194, lip=66.85.158.91, TLS, session=<VvVEmcdFwZe6vqfC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 13 02:35:15 host2 sshd[1115705]: Disconnected from invalid user user1 103.176.79.117 port 57398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 02:36:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<7CoGo8dFgqgIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 02:37:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<nvOnp8dF1Okv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-13 02:37:33 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:54125: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 13 02:38:26 host2 sshd[1117292]: Disconnected from invalid user jbernal 103.176.79.117 port 44118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-13 02:38:40 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:58053: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-13 02:39:00 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:60140: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 02:40:12 dovecot_plain authenticator failed for (seling) [12.150.243.22]:17050: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 02:39:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<eAUFrsdFotNntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 02:39:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<dkeQrsdF/OqB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-13 02:41:11 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (pores) [144.64.157.244]:39676: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 02:41:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<+xFPtMdFHNkI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 02:42:56 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:36450: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-13 02:42:41 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:54400: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.235.40.131
country_id: 6252001
description:
Dec 13 02:43:42 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.235.40.131, lip=66.85.158.92, session=<LVRsvMdFNres6yiD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 02:43:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<XU3JusdFeI8+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.144
country_id: 3865483
description:
Dec 13 02:44:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=190.181.109.144, lip=66.85.158.91, TLS, session=<mcWlvcdFksq+tW2Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.166
country_id: 3469034
description:
Dec 13 02:44:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.92.247.166, lip=66.85.158.91, TLS, session=<WWHvvsdFhJqxXPem>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 02:44:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<P9/6v8dFFO0uZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Dec 13 02:45:02 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.92, session=<PfMywcdFKjXAm1rc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.222
country_id: 798544
description:
Dec 13 02:46:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=46.227.39.222, lip=66.85.158.91, TLS, session=<dg2VxcdFe6Eu4yfe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.102
country_id: 3865483
description:
Dec 13 02:46:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=45.238.107.102, lip=66.85.158.91, TLS, session=<ELvExsdFX8Mt7mtm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 02:46:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<XsL0xcdFaqcro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-13 02:47:53 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:59349: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 02:47:54 dovecot_login authenticator failed for ([182.95.181.62]) [182.95.181.62]:39724: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 02:48:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<XEypy8dFguyl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-13 02:47:15 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:39673: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-13 02:47:41 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:42784: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-13 02:48:33 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:23640: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-13 02:49:11 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:49386: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 13 02:52:40 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<aJGG3MdFILm58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-13 02:53:13 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:41644: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-13 02:53:28 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:58821: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-13 02:54:16 dovecot_login authenticator failed for ([65.20.250.93]) [65.20.250.93]:35661: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-12-13 02:54:39 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:37604: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 02:56:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<xcdR6MdFOq/O7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 13 02:58:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Z2je78dFtrO58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 02:58:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<jmML8MdFmJaG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 02:57:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<+QdH7sdF5uhnpBQq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 02:59:13 host2 sshd[1129605]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.111.150
country_id: 2921044
description:
Dec 13 02:59:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=46.101.111.150, lip=66.85.158.92, session=<sK1v9MdF0VEuZW+W>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.159.71
country_id: 2921044
description:
Dec 13 02:59:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.159.71, lip=66.85.158.92, session=<+iB19MdFTOel459H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 03:00:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<mnN398dFWNmWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-13 03:01:27 dovecot_plain authenticator failed for (osing) [46.10.210.68]:59599: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 03:02:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<vSXe/sdF2C4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 03:02:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<yuCE/8dFWHVetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 03:04:04 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:38238: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.233.96.173
country_id: 2802361
description:
Dec 13 03:04:16 host2 pure-ftpd[1132900]: (?@35.233.96.173) [INFO] New connection from 35.233.96.173


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-13 03:04:18 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:41080: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:05:37 host2 sshd[1133755]: Disconnected from invalid user developer 20.193.141.133 port 56124 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:06:52 host2 sshd[1134484]: Disconnected from invalid user tommy 20.193.141.133 port 20130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 03:07:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<MrcLEMhFDLlm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:06:15 host2 sshd[1134179]: Disconnected from invalid user testuser 20.193.141.133 port 39348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:07:29 host2 sshd[1134934]: Disconnected from invalid user eco 20.193.141.133 port 5961 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-13 03:07:38 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:58039: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-13 03:07:56 dovecot_login authenticator failed for ([125.19.110.89]) [182.78.107.6]:57474: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-13 03:07:25 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:55232: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.75.185.190
country_id: 6252001
description:
2025-12-13 03:07:27 dovecot_login authenticator failed for (149-75-185-190.s445.c3-0.elg-e6k1.nape.il.cable.rcncustomer.com) [149.75.185.190]:51740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 03:08:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<mjCsFchFGtzD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 03:09:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<8EqUF8hFVt28pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-13 03:08:22 dovecot_plain authenticator failed for (cringrate) [5.11.143.72]:54318: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-13 03:09:37 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (clace) [73.197.194.98]:34014: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 03:09:41 dovecot_plain authenticator failed for (synon) [12.150.243.22]:6539: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:10:06 host2 sshd[1136482]: Disconnected from invalid user term2 20.193.141.133 port 64704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Dec 13 03:10:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<l6rNG8hFIsGTuYSK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 13 03:10:23 host2 sshd[1136724]: Disconnected from invalid user user 103.179.57.150 port 39144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-13 03:11:24 dovecot_plain authenticator failed for (forearity) [199.192.123.12]:55344: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 03:11:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ZDNJIMhFt0l100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 13 03:11:14 host2 sshd[1137258]: Disconnected from invalid user ammar 103.179.57.150 port 38616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 03:12:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<k+QxJMhFzuVAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 03:12:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<qqJ9JMhFuuNo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-12-13 03:12:55 dovecot_login authenticator failed for ([49.124.151.56]) [49.124.151.56]:52628: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-12-13 03:12:27 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:52888: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 03:12:39 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:37463: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-13 03:12:42 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:58026: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-13 03:14:01 dovecot_login authenticator failed for ([103.186.193.149]) [103.186.193.149]:43452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 13 03:15:05 host2 sshd[1139456]: Disconnected from invalid user pablo 103.179.57.150 port 42822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 03:14:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4f/FKshFlI/D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 03:14:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<hPGCK8hFAqHAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-13 03:18:48 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:51720: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 03:19:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<+s60OshFXM8+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-13 03:19:11 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:59596: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-12-13 03:19:34 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:55868: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-12-13 03:20:24 dovecot_login authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:52473: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 03:20:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ILi9P8hFNp2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 03:21:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<vTpkQshFipAImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 03:23:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<3LJOSchFxL0I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 03:25:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<BLEUUshF/LikXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.198
country_id: 6252001
description:
Dec 13 03:27:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sENaV8hFitTN0h/G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 03:29:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<S7pKXshF+pGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 03:29:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<8g9KXshF4Ntntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-13 03:29:07 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (coromanks) [76.157.219.158]:51422: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 03:29:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<MSoDYMhFzomB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 03:29:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<sQiQYMhF6tHCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-13 03:29:46 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:39054: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 03:31:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<9nRQZshFzIK8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 13 03:31:49 host2 sshd[1150050]: Disconnected from invalid user fox 92.191.96.115 port 4154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-13 03:31:52 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (snanum) [73.208.81.125]:35964: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:32:03 host2 sshd[1150209]: Disconnected from invalid user temp 51.77.137.25 port 51888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 03:32:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<OffQashFZoCH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:32:35 host2 sshd[1150560]: Disconnected from invalid user teamcity 51.77.137.25 port 39820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:33:05 host2 sshd[1150818]: Disconnected from invalid user backend 51.77.137.25 port 35322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-13 03:33:06 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:36162: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:33:35 host2 sshd[1151065]: Disconnected from invalid user fox 51.77.137.25 port 38542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-12-13 03:33:41 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:41383: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:35:07 host2 sshd[1152209]: Disconnected from invalid user sysadmin 51.77.137.25 port 57328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 13 03:35:09 host2 sshd[1152251]: Disconnected from invalid user igor 92.191.96.115 port 64000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 03:35:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<RIdadchF1qgv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 13 03:35:50 host2 sshd[1152840]: Disconnected from invalid user vpn 92.191.96.115 port 35374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 03:37:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<73ASe8hFZoMIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-13 03:38:06 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:41374: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-13 03:38:12 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (hawiss) [174.161.27.82]:55348: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-13 03:37:53 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:34946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-13 03:38:17 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:60838: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-12-13 03:38:27 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:57010: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 03:38:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<3KvLgMhFmKsI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.239
country_id: 6252001
description:
Dec 13 03:38:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.239, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KbeGgchFddPN0h/v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-13 03:39:43 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:37014: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-13 03:39:57 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:46204: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 03:40:14 host2 sshd[1155994]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-13 03:41:09 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:32982: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 03:41:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<52X5ichFctkuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-13 03:40:40 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (sacopher) [67.172.54.29]:58454: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 03:42:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<YzZaj8hFbL8ro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 03:44:00 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:55981: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Dec 13 03:44:03 host2 sshd[1158381]: Disconnected from invalid user test1234 120.62.8.17 port 47643 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-13 03:43:48 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:52583: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 13 03:45:09 host2 sshd[1159550]: Disconnected from invalid user teste 103.84.236.222 port 38226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-13 03:45:12 dovecot_login authenticator failed for (mail3.hurst.co.uk) [77.89.143.122]:39214: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 13 03:44:26 host2 sshd[1158920]: Disconnected from invalid user samuel 122.166.49.42 port 40740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-13 03:45:01 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:41926: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.248.73.162
country_id: 1643084
description:
Dec 13 03:45:23 host2 pure-ftpd[1160057]: (?@178.248.73.162) [INFO] New connection from 178.248.73.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.86.29.123
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 195.86.29.123 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 120.62.8.17
country_id: 1269750
description:
Dec 13 03:45:30 host2 sshd[1160283]: Disconnected from invalid user daniil 120.62.8.17 port 60964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 03:46:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<oi+hm8hFdpCB4gum>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 13 03:45:18 host2 sshd[1159762]: Disconnected from invalid user fmaster 122.166.49.42 port 55936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-13 03:46:52 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:55334: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-13 03:46:32 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:59490: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.10
country_id: 798549
description:
Dec 13 03:48:20 host2 pure-ftpd[1162643]: (?@85.217.140.10) [INFO] New connection from 85.217.140.10


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 03:48:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<Pi0upchFxMal6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 03:48:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<cLCUpchFANE+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 13 03:49:32 host2 sshd[1163437]: Disconnected from invalid user dj 103.84.236.222 port 41338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Dec 13 03:49:47 host2 sshd[1163545]: Disconnected from invalid user samuel 120.62.8.17 port 47447 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 03:49:53 host2 sshd[1163564]: Disconnected from invalid user user 2.57.121.25 port 37692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 13 03:50:44 host2 sshd[1164341]: Disconnected from invalid user hydra 103.84.236.222 port 38190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 03:51:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Qaj5rMhFsM8+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 13 03:53:18 host2 sshd[1165908]: Disconnected from invalid user kafka 45.182.207.45 port 54208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 03:54:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<uKUfuchFsJhnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 03:54:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<AeCNuchFXIHO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 13 03:55:25 host2 sshd[1167682]: Disconnected from invalid user going 45.182.207.45 port 60042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-13 03:56:59 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (polate) [217.215.74.195]:40001: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 13 03:58:08 host2 sshd[1169266]: Disconnected from invalid user jmarquez 45.182.207.45 port 51866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 03:57:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<yyyUxMhFQKOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-12-13 03:57:46 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:45464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-13 03:58:37 dovecot_login authenticator failed for ([182.95.25.234]) [182.95.63.10]:47394: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 04:00:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<rEx2zchF7qKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 04:00:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<O1LhzshFbnwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 04:02:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<WcZJ1shFwitetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 04:02:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<SnKD18hFNrVm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.40
country_id: 1733045
description:
2025-12-13 04:02:55 dovecot_login authenticator failed for ([49.124.146.40]) [49.124.146.40]:54898: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-13 04:02:59 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:54852: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 04:03:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<mxAF2MhF1NWLOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-13 04:02:33 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:38202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-13 04:03:23 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:36909: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-13 04:03:41 dovecot_plain authenticator failed for (unstest) [102.88.10.10]:38202: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-13 04:04:22 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:43267: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-12-13 04:04:34 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:51832: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.248.73.162
country_id: 1643084
description:
Dec 13 04:04:40 host2 pure-ftpd[1173927]: (?@178.248.73.162) [INFO] New connection from 178.248.73.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.86.29.123
country_id: 1643084
description:
[2025-12-13 04:04:42 +0530] info [cpaneld] 195.86.29.123 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 04:04:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<02B+3MhFqNTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 13 04:05:07 host2 sshd[1174285]: Disconnected from invalid user admin 45.121.147.47 port 56850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 04:05:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<AI7n38hFpK28pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 13 04:06:09 host2 sshd[1175002]: Disconnected from invalid user switch 35.237.94.18 port 50754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 13 04:06:23 host2 sshd[1175100]: Disconnected from invalid user admin 45.121.147.47 port 52868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 13 04:07:38 host2 sshd[1175889]: Disconnected from invalid user water 45.121.147.47 port 48876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 13 04:07:53 host2 sshd[1175983]: Disconnected from invalid user water 35.237.94.18 port 36136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-13 04:08:41 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:40528: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 13 04:08:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SWlZ7MhF4olChJmK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-13 04:09:01 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:49920: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 13 04:10:12 host2 sshd[1177448]: Disconnected from invalid user sshuser 35.237.94.18 port 35468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-13 04:09:42 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:29701: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 13 04:09:30 host2 sshd[1176908]: Disconnected from invalid user switch 45.121.147.47 port 57018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-13 04:09:55 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:60722: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 04:10:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<YLaN8chFYqrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 04:09:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<0NN87shFCqhAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:10:33 host2 sshd[1177677]: Disconnected from invalid user xiaoming 102.88.137.213 port 49694 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.93.128.179
country_id: 1269750
description:
Dec 13 04:11:01 host2 sshd[1177909]: Disconnected from invalid user sftpuser 34.93.128.179 port 44110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 04:10:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<xRRo8shFGI5100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec 13 04:11:23 host2 sshd[1178130]: Disconnected from invalid user admin 197.225.146.23 port 47716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-13 04:11:49 dovecot_login authenticator failed for ([84.214.63.110]) [84.214.63.110]:58000: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 13 04:11:53 host2 sshd[1178388]: Disconnected from invalid user ubuntu 35.237.94.18 port 49078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:13:23 host2 sshd[1179720]: Disconnected from invalid user ftpuser 102.88.137.213 port 1387 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 04:13:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<i+bu/chFeq/AqZl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.77.155
country_id: 2921044
description:
Dec 13 04:14:00 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.226.77.155, lip=66.85.158.92, session=<0PVf/8hFmCtA4k2b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec 13 04:14:25 host2 sshd[1180744]: Disconnected from invalid user sshuser 197.225.146.23 port 44648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:14:56 host2 sshd[1181086]: Disconnected from invalid user rocketmq 102.88.137.213 port 1383 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:15:47 host2 sshd[1181768]: Disconnected from invalid user ftpuser 102.88.137.213 port 49624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 04:15:47 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (lariaked) [96.230.65.90]:49226: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-13 04:15:50 dovecot_plain authenticator failed for (sandally) [12.182.125.210]:41102: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-13 04:15:53 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:33969: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-13 04:15:22 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:47558: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 04:16:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hj24B8lFBq6KxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:16:29 host2 sshd[1182272]: Disconnected from invalid user choi 102.88.137.213 port 17658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.3.48
country_id: 690791
description:
Dec 13 04:18:16 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.3.48, lip=66.85.158.91, TLS, session=<ZXWaDclFscOwZwMw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.215
country_id: 3865483
description:
Dec 13 04:17:57 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.249.215, lip=66.85.158.91, TLS, session=<T5FVDMlF2d2zAPnX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-13 04:18:04 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (ingiverms) [76.157.219.158]:55126: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 04:18:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<BqsEDslFYNVntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2025-12-13 04:19:00 dovecot_login authenticator failed for cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:48966: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.107
country_id: 6252001
description:
Dec 13 04:19:05 host2 pure-ftpd[1183849]: (?@198.235.24.107) [INFO] New connection from 198.235.24.107


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 04:20:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<hPpPFslFVscI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.63.18
country_id: 6252001
description:
2025-12-13 04:20:55 dovecot_login authenticator failed for ([98.181.63.18]) [98.181.63.18]:42665: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-13 04:21:19 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (tomifies) [174.166.153.20]:58552: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 04:21:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<6rMuGslF6LEImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 04:22:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<h7mGHMlFJIM+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-13 04:22:24 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:42590: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-13 04:22:40 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:58475: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 04:22:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</vvzHslFUsOkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 13 04:26:25 host2 sshd[1188173]: Disconnected from invalid user jason 103.144.28.85 port 57980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-13 04:28:08 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:36026: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 13 04:27:34 host2 sshd[1188782]: Disconnected from invalid user admin 103.144.28.85 port 55004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-13 04:27:37 dovecot_login authenticator failed for ([89.218.247.234]) [89.218.247.234]:40058: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-13 04:27:41 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:54550: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 04:27:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<BE48MMlFKK3CBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-13 04:28:06 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:40356: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-13 04:28:36 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:50544: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 04:28:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<hafdNMlFgLqB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2025-12-13 04:29:03 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:57075: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 04:29:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Fr8BNclFkIK8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 13 04:29:14 host2 sshd[1189870]: Disconnected from invalid user hadoop 103.144.28.85 port 36424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 04:29:58 host2 sshd[1190218]: Disconnected from invalid user user 2.57.121.25 port 17024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 13 04:30:19 host2 sshd[1190738]: Disconnected from invalid user abdi 103.144.28.85 port 33450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-13 04:31:52 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:33216: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-12-13 04:33:05 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:56016: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 04:32:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<DSPgQMlFpMqH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.27
country_id: 6252001
description:
2025-12-13 04:32:26 dovecot_login authenticator failed for ([70.174.168.27]) [70.174.168.27]:37497: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 04:33:22 host2 sshd[1192339]: Disconnected from invalid user  62.60.131.157 port 39588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.91.229
country_id: 3865483
description:
Dec 13 04:33:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.91.229, lip=66.85.158.91, TLS, session=<xgnnQ8lFb8m+tVvl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-13 04:33:41 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:38850: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.136
country_id: 3175395
description:
Dec 13 04:33:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=185.139.180.136, lip=66.85.158.91, TLS, session=<WVlbRclFFcC5i7SI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-13 04:34:06 dovecot_login authenticator failed for (187.161.198.68-clientes-izzi.mx) [187.161.198.68]:56169: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 04:33:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<uSE6RMlF1tcv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-13 04:34:51 dovecot_plain authenticator failed for (thmisom) [24.104.225.201]:36787: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 04:35:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=</V0xTclFTM0I3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-12-13 04:36:15 dovecot_plain authenticator failed for 5.185.198.73.ipv4.public.orange.pl (ovatite) [5.185.198.73]:46320: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.185.11.240
country_id: 357994
description:
2025-12-13 04:35:38 dovecot_plain authenticator failed for (CEJ5O) [102.185.11.240]:54652: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 04:37:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<WNCuUslFpL8IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 04:37:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<m2RPU8lF1MYuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-13 04:39:04 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (sauxoct) [174.166.153.20]:57614: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 04:38:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<rPCEV8lFPL4ro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 04:41:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<JZ7qYclFBuI+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-13 04:42:14 dovecot_plain authenticator failed for (unctiotree) [65.20.143.159]:41781: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-13 04:43:05 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:37549: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-13 04:43:16 dovecot_login authenticator failed for ([174.75.211.196]) [121.73.162.242]:55676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 04:42:48 dovecot_plain authenticator failed for (matbewels) [154.144.243.93]:51498: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.195.251.43
country_id: 3573591
description:
2025-12-13 04:43:34 dovecot_login authenticator failed for ([174.64.199.88]) [186.195.251.43]:56385: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.152
country_id: 3175395
description:
Dec 13 04:43:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.26.178.152, lip=66.85.158.91, TLS, session=<2uAkaclFCtTZGrKY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.76
country_id: 953987
description:
Dec 13 04:44:13 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.57.76, lip=66.85.158.91, TLS, session=<GL1PaslF+odmgTlM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.194.94
country_id: 1269750
description:
2025-12-13 04:43:21 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:50568: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-13 04:43:31 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (ytive) [73.224.171.101]:59490: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.193
country_id: 6252001
description:
Dec 13 04:45:57 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.193, lip=66.85.158.92, session=<x6qecclFY6hb5qjB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.196
country_id: 6252001
description:
Dec 13 04:46:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.196, lip=66.85.158.92, session=<pb7NcclFU9pb5qjE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.175
country_id: 732800
description:
Dec 13 04:46:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.255.215.175, lip=66.85.158.91, TLS, session=<cnIccclFZOy5/9ev>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-13 04:45:32 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (litaxe) [73.0.235.30]:57616: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.242
country_id: 6252001
description:
Dec 13 04:45:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.242, lip=66.85.158.92, session=<KM02cMlF4ZBb5qjy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.199
country_id: 6252001
description:
Dec 13 04:45:44 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.199, lip=66.85.158.92, session=<wFHgcMlF34lb5qjH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.67
country_id: 3469034
description:
Dec 13 04:46:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<designdpt>, method=PLAIN, rip=186.209.249.67, lip=66.85.158.91, TLS, session=<c8SIcslFn+260flD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-13 04:46:40 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (ferach) [73.195.211.98]:38356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-13 04:46:54 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:54946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 04:47:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<gzmjdclF/rml6L5h>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 04:47:58 host2 sshd[1203902]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-13 04:47:49 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:51184: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 04:49:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<HnWsfMlFaMY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 04:50:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<oxRHgMlF7NZnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-13 04:52:08 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:50504: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-13 04:51:40 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (fators) [174.161.27.82]:33278: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-13 04:51:46 dovecot_plain authenticator failed for (unial) [5.11.221.119]:34972: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.251
country_id: 1733045
description:
2025-12-13 04:51:46 dovecot_login authenticator failed for ([49.124.152.251]) [49.124.152.251]:45304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-13 04:51:56 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:43184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-13 04:52:19 dovecot_login authenticator failed for ([128.185.247.254]) [125.19.158.2]:32916: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 04:52:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<mtVHiclFhoTO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-13 04:53:06 dovecot_login authenticator failed for host-148-170-156-248.public.eastlink.ca [148.170.156.248]:41664: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 04:53:36 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:56290: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 04:56:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Ylwal8lF3MOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-13 04:58:16 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:33782: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.203
country_id: 6252001
description:
2025-12-13 04:57:34 dovecot_login authenticator failed for ([72.214.132.203]) [72.214.132.203]:58464: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 04:57:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pAmhm8lFuHEvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 04:57:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<k/w4nMlFxLxm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-13 04:58:01 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:48051: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-13 04:58:26 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:53202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 04:58:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<QHtKnslFpIdo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 04:59:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<OS44oMlFzOQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-13 04:59:05 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:33956: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 04:59:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ZaBioclFXNvD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 04:59:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Bx6qoclFUN6WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-13 05:01:13 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:59474: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 05:00:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<s8gJpslF6KO8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 05:01:32 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:53234: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 05:02:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<VxOXq8lFdEpetwuC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 13 05:03:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS handshaking: Connection closed, session=</QKfsMlF8gZChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 05:05:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<845ntslFYpfD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 05:05:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<uhH7tslFHqZAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 05:07:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<Qmp0vslFwpJntrtb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.138
country_id: 2635167
description:
Dec 13 05:07:57 host2 dovecot[3988696]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.138, lip=66.85.158.91, TLS, session=<6C1NwMlFtcO594mK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2025-12-13 05:07:58 dovecot_login authenticator failed for ([49.124.153.35]) [49.124.153.35]:46962: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-13 05:08:25 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:56486: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 05:08:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<rj1SwslF3v5100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-13 05:08:39 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (demens) [73.144.27.228]:55620: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-13 05:10:07 dovecot_plain authenticator failed for (ounde) [173.25.186.130]:54323: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-13 05:09:27 dovecot_plain authenticator failed for (fuseudo) [91.73.188.251]:55574: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 05:09:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<QbRex8lFfN2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 05:10:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<spjrx8lFqLnAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 05:10:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hm5CyslFWLKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-13 05:11:54 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:44584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-13 05:12:16 dovecot_login authenticator failed for ([149.54.62.62]) [149.54.62.62]:58854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-13 05:12:39 dovecot_plain authenticator failed for (amimatic) [65.20.143.159]:54764: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-13 05:13:05 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:58507: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-13 05:14:02 dovecot_login authenticator failed for (cm-178.232.126.146.get.no) [178.232.126.146]:49184: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 05:13:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<zSJ408lF/KY+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-13 05:14:00 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (psers) [24.1.200.187]:53846: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-13 05:15:44 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (plosisable) [73.53.254.168]:54550: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-13 05:16:43 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:53368: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.29
country_id: 6252001
description:
2025-12-13 05:16:50 dovecot_login authenticator failed for ([98.181.46.29]) [98.181.46.29]:39215: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-12-13 05:16:57 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:32779: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 05:16:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<WBWF4MlF/KLCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-13 05:17:02 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:57514: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:16:35 host2 sshd[1229361]: Disconnected from invalid user admin 103.39.243.15 port 38240 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 13 05:17:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<+Z2F4clFfqpog7HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 05:17:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<V63Z4clFgrQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-12-13 05:18:09 dovecot_login authenticator failed for (190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:51638: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.100.26.107
country_id: 1269750
description:
2025-12-13 05:18:25 dovecot_login authenticator failed for (as135139-skylinkfibernet.com) [27.100.26.107]:32936: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 05:20:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<I+WV68lFQt6kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-13 05:19:38 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (tereck) [73.183.74.177]:47256: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 05:20:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<YqmM7slF/uoImxNM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:21:08 host2 sshd[1231782]: Disconnected from invalid user nima 103.39.243.15 port 53616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:21:47 host2 sshd[1232036]: Disconnected from invalid user supermaint 103.39.243.15 port 37774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-12-13 05:22:09 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:45343: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-13 05:22:31 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:48150: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-13 05:23:29 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:51585: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-13 05:23:36 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:47338: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 05:25:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<BdN3/8lFKqvCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 05:25:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<lsvA/8lF6My8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 05:26:56 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (dicapped) [73.197.236.163]:35286: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 05:28:54 host2 sshd[1235492]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.40
country_id: 6252001
description:
Dec 13 05:28:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.40, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Cs4tCspFPcOTuYQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 05:28:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<svElCspFHtqB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-13 05:29:11 dovecot_plain authenticator failed for (joidae) [24.105.248.218]:32914: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.184
country_id: 6252001
description:
Dec 13 05:30:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EMhvEcpF9dzG6xi4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 05:30:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<BbtwEcpFOpYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 05:31:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<80wkE8pFqoA+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 05:31:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<P+n0FcpFQIqH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 05:32:24 host2 sshd[1237147]: Disconnected from invalid user user 2.57.121.25 port 6913 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 05:32:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<rY0YGcpFxJMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 05:33:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<VsJ0GspF3qMuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-13 05:33:16 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:54406: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-13 05:33:28 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:60088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.16
country_id: 6252001
description:
2025-12-13 05:33:52 dovecot_login authenticator failed for wsip-184-191-243-16.fv.ks.cox.net [184.191.243.16]:45001: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 05:34:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<x0+uHspF7tsro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-13 05:34:46 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:37642: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 05:35:16 host2 sshd[1238877]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 52780


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 05:37:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<LrcOKMpFco0IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-13 05:37:11 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:33218: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-13 05:37:44 dovecot_login authenticator failed for ([128.185.247.254]) [125.19.158.2]:51044: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-13 05:38:55 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (consicae) [73.213.237.28]:56368: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-13 05:39:16 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (ersheed) [2.135.31.74]:49570: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 05:40:07 host2 sshd[1241211]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 54961


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 05:40:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<j8AnNcpFoJ2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-13 05:41:39 dovecot_plain authenticator failed for (giess) [12.182.125.210]:40895: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-13 05:41:57 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:55100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-13 05:42:09 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:53977: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 05:41:33 host2 sshd[1241914]: Disconnected from invalid user admin 2.57.121.112 port 45591 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-13 05:42:24 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:41588: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-12-13 05:42:54 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:36217: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-13 05:43:24 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:38960: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-13 05:44:04 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:55677: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 05:44:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<3suPRMpFNJCl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 05:45:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<tPLTRMpF6LyLOxGe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:45:06 host2 sshd[1243913]: Disconnected from invalid user user 128.199.155.236 port 50276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 05:45:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<MvecRspFMthnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:47:34 host2 sshd[1245521]: Disconnected from invalid user user 34.58.124.191 port 34738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:47:43 host2 sshd[1245576]: Disconnected from invalid user user 128.199.155.236 port 38292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-13 05:48:37 dovecot_plain authenticator failed for (apping) [92.62.243.175]:54460: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:48:43 host2 sshd[1246019]: Disconnected from invalid user spectrum 34.58.124.191 port 36694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:49:05 host2 sshd[1246285]: Disconnected from invalid user deploy 128.199.155.236 port 59554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-13 05:48:19 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:46062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 05:48:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Rl9dUcpFiJA+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-13 05:48:41 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:51751: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:49:16 host2 sshd[1246473]: Disconnected from invalid user mikrotik 34.58.124.191 port 37394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-13 05:49:21 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:51343: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-13 05:49:35 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:50900: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:51:05 host2 sshd[1247514]: Disconnected from invalid user roots 128.199.155.236 port 39388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-13 05:50:35 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (coffic) [24.127.53.61]:53616: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 05:50:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lkvfWcpF4OrO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:51:29 host2 sshd[1247690]: Disconnected from invalid user kserge 34.58.124.191 port 59504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:52:13 host2 sshd[1248051]: Disconnected from invalid user chrism 101.47.162.24 port 40354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 05:52:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<bYWEYMpFLsxm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:53:19 host2 sshd[1248535]: Disconnected from invalid user testing 101.47.162.24 port 42126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.238.68
country_id: 6252001
description:
2025-12-13 05:54:13 dovecot_login authenticator failed for ([75.110.238.68]) [75.110.238.68]:46292: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.60
country_id: 1880251
description:
Dec 13 05:54:15 host2 sshd[1249098]: Disconnected from invalid user nmr 45.78.201.60 port 49466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 05:54:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<6EJJZspF4O3D+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:54:29 host2 sshd[1249480]: Disconnected from invalid user ubuntu 101.47.162.24 port 45594 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.247.79
country_id: 2921044
description:
Dec 13 05:54:45 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=209.38.247.79, lip=66.85.158.92, session=<aGSvZ8pFKszRJvdP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 05:54:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<V+qoZ8pFEl8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-13 05:54:48 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:33528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 05:55:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<H8lUacpF1NCG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 05:56:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<0hnGbspFWLBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 05:56:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<WNX3bcpFHMi8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-13 05:58:15 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:51828: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.145.35
country_id: 2750405
description:
Dec 13 05:57:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.145.35, lip=66.85.158.92, TLS: Connection closed, session=<wveyccpFHtChI5Ej>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.182.92
country_id: 6252001
description:
Dec 13 05:57:48 host2 dovecot[3988696]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=165.154.182.92, lip=66.85.158.92, TLS, session=<KD2YcspFeuKlmrZc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.92
country_id: 6252001
description:
Dec 13 05:57:48 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.182.92, lip=66.85.158.92, session=<3yqWcspFvOGlmrZc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-13 05:57:58 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (hiactal) [98.40.101.10]:50050: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.57.97.103
country_id: 2510769
description:
2025-12-13 05:58:02 dovecot_login authenticator failed for 103.red-83-57-97.dynamicip.rima-tde.net [83.57.97.103]:38481: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 05:58:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<6CYEdcpFvNs+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 05:58:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<kz1mdspFIr2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:00:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<QBxoe8pF5OXD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.60
country_id: 1880251
description:
Dec 13 06:00:54 host2 sshd[1252212]: Disconnected from invalid user mikrotik 45.78.201.60 port 47002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 06:01:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<5T47gcpFGKlAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 06:01:18 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:43116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-12-13 06:01:44 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:4961: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 06:01:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<hbuIgMpFgGRetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:03:04 host2 sshd[1253004]: Disconnected from invalid user wangjia 152.32.129.236 port 60276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-13 06:02:20 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:55283: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:02:25 host2 sshd[1252760]: Disconnected from invalid user zihan 152.32.129.236 port 40722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-13 06:02:37 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (oueitting) [73.183.74.177]:52230: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-13 06:03:11 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:38388: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-13 06:02:16 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:41987: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-13 06:02:22 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:49223: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-13 06:02:49 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:37872: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:04:16 host2 sshd[1253668]: Disconnected from invalid user kkadmin 152.32.129.236 port 43514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-13 06:04:49 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (hoodism) [24.1.200.187]:60360: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 06:05:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<EQVijspFytOKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-13 06:06:33 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:50387: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-13 06:06:39 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:46078: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 06:07:09 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:43069: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-13 06:06:28 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:52012: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 06:06:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<KCOxkcpF+C9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-13 06:06:46 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:50213: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.3.138
country_id: 1605651
description:
2025-12-13 06:06:56 dovecot_login authenticator failed for ([110.49.3.138]) [110.49.3.138]:51602: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 06:06:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<kuQ3k8pFvr3AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.3
country_id: 1733045
description:
2025-12-13 06:07:45 dovecot_login authenticator failed for ([49.124.153.3]) [49.124.153.3]:49972: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-13 06:12:58 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:60361: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-13 06:12:25 dovecot_login authenticator failed for (cm-178.232.153.184.get.no) [178.232.153.184]:38336: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-13 06:12:46 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:37190: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 06:12:49 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65466: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.50
country_id: 1269750
description:
2025-12-13 06:13:24 dovecot_login authenticator failed for ([128.185.212.50]) [128.185.212.50]:36006: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-13 06:13:58 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (perge) [73.213.237.28]:51720: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-13 06:14:02 dovecot_plain authenticator failed for (tracented) [38.248.111.238]:56686: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 06:14:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<vjF8rspFYO0I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.20
country_id: 690791
description:
Dec 13 06:16:09 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=176.103.7.20, lip=66.85.158.91, TLS, session=<cltBs8pFu5awZwcU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.102
country_id: 953987
description:
Dec 13 06:16:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.47.102, lip=66.85.158.91, TLS, session=<QwNftMpFx4dmQC9m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Dec 13 06:17:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=<mm3CucpFIuGnXpIx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 06:17:47 dovecot_plain authenticator failed for (catirize) [154.144.243.93]:41614: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 06:17:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<6a1cuMpFwqSkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 06:20:21 host2 sshd[1261486]: Disconnected from invalid user  62.60.131.157 port 17986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-13 06:21:09 dovecot_plain authenticator failed for (gless) [5.11.221.119]:58934: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-13 06:22:13 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:45046: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 06:22:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<R5u3y8pFfqwImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 06:23:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ZykuzcpFjoa8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 06:22:26 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:34890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 06:24:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Mt780cpF7urCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 06:25:25 dovecot_plain authenticator failed for (jicaphy) [154.144.243.93]:37716: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-12-13 06:26:15 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:33666: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2025-12-13 06:26:29 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:47282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 06:28:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<zD1T4MpFGMQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 06:28:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<9FQf4MpFyLOB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 06:28:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<PgQq4MpFXLcuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 06:30:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<O/Cd5cpFNIQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 06:30:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<awiU58pF0tYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-13 06:31:14 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:51842: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-13 06:31:25 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:43198: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-13 06:31:29 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:40284: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-13 06:31:48 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:34783: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.35.3
country_id: 1269750
description:
Dec 13 06:32:01 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.118.35.3, lip=66.85.158.91, TLS, session=<QBGj68pFtYgtdiMD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.37
country_id: 3865483
description:
Dec 13 06:32:23 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=186.124.218.37, lip=66.85.158.91, TLS, session=<58oZ7cpFkNW6fNol>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 06:32:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<jOkB8MpFaM0+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-12-13 06:33:36 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:1195: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 06:34:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<yBsr9spFauKH6yFP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.13
country_id: 798549
description:
Dec 13 06:34:46 host2 pure-ftpd[1270323]: (?@85.217.149.13) [INFO] New connection from 85.217.149.13


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 06:36:51 host2 sshd[1271580]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 06:36:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<tWmZ/MpFJIo+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-13 06:37:42 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:55245: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-12-13 06:38:19 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:51728: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 06:38:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<49VIA8tFdMM+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 06:38:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<mjLUA8tFAswIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-13 06:38:32 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:52357: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.87
country_id: 6252001
description:
Dec 13 06:40:40 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.87, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5OXrC8tFJcbN0h9X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 06:41:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<jk1VDstFROlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.40
country_id: 3469034
description:
Dec 13 06:42:17 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.246.40, lip=66.85.158.91, TLS, session=<bnhyEMtFwoa60fYo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.183
country_id: 798544
description:
Dec 13 06:42:34 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.232.165.183, lip=66.85.158.91, TLS, session=<bsy7EctF1bZb6KW3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 06:44:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<k7FTGMtF5plo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 06:44:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<BOJlGMtF+OKl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.35
country_id: 3865483
description:
Dec 13 06:44:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.251.35, lip=66.85.158.91, TLS, session=<su7OF8tFhrSzAPsj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.37
country_id: 933860
description:
Dec 13 06:44:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=41.216.213.37, lip=66.85.158.91, TLS, session=<rMg3GctFUrMp2NUl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 06:44:46 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (crize) [73.197.236.163]:33918: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-13 06:45:49 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (lacon) [73.0.235.30]:39816: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-13 06:47:44 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:33814: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-13 06:47:55 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:53775: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 06:47:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<TSmqJctFjJZm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-13 06:48:00 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:56782: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-13 06:48:07 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:58686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 06:48:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<lG36J8tFEsdntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 06:49:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KJJgK8tF9tSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 06:49:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<4f8pLMtF8MrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:49:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<2KpkLMtFNNvD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.120.212
country_id: 6252001
description:
Dec 13 06:49:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=13.89.120.212, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<BmosLctFqM0NWXjU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 06:52:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<ZuljNMtFLOE+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 06:52:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<f9ClNMtFPC8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-12-13 06:52:41 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:49042: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.226.80.143
country_id: 6252001
description:
2025-12-13 06:54:56 dovecot_login authenticator failed for dhcp-011-143.coonvalley.mwt.net ([91.126.40.196]) [216.226.80.143]:57172: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 06:54:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<xKjZPstFfL68pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 06:55:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<XSeSQMtFOoaG0Wp/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.220.172.154
country_id: 6252001
description:
[2025-12-13 06:55:41 +0530] info [whostmgrd] 24.220.172.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:55:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<MVuVQctFUOXD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 06:56:06 host2 sshd[1283467]: Disconnected from invalid user  62.60.131.157 port 28045 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-13 06:57:12 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:62456: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-13 06:57:59 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:40950: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-13 06:57:34 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:41919: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-13 06:57:42 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:59122: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 13 06:58:31 host2 dovecot[1284827]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 06:58:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<S4h6TMtF/t2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 06:58:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<LgH9TMtFpqtAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 07:01:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<JGzsVMtF4BVetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 07:01:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<stixVctFTLiKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-13 07:03:56 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:47696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 07:04:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<qRSzX8tFqNrAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 07:04:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<huQOYctFLDN100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-13 07:05:06 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (crophioted) [81.225.30.107]:56290: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-13 07:04:17 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:41821: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.1.17
country_id: 6252001
description:
Dec 13 07:06:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.1.17, lip=66.85.158.91, session=<x//eZstF7KAUowER>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.31
country_id: 6252001
description:
Dec 13 07:05:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.125.31, lip=66.85.158.92, session=<phVcZMtFtKENWX0f>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-13 07:07:57 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (matershaus) [81.225.30.107]:35841: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 07:09:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<pJkRdMtFZrykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 07:10:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<obeYdstFsLk+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-13 07:13:32 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:53447: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 07:13:48 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:36362: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-12-13 07:16:11 dovecot_plain authenticator failed for (zierlity) [5.32.61.6]:49317: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-13 07:17:48 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:50686: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-13 07:18:19 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:56524: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.81.222
country_id: 732800
description:
Dec 13 07:20:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=109.107.81.222, lip=66.85.158.91, TLS, session=<7SKimstFCcBta1He>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.44.68
country_id: 2395170
description:
Dec 13 07:20:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=154.127.44.68, lip=66.85.158.91, TLS, session=<t8O7mstFSbyafyxE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.165
country_id: 3865483
description:
Dec 13 07:20:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers>, method=PLAIN, rip=179.0.252.165, lip=66.85.158.91, TLS, session=<CdbCmstFVsOzAPyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.104
country_id: 953987
description:
Dec 13 07:20:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.51.104, lip=66.85.158.91, TLS, session=<Qg9omctFN5dmgTNo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.12.160
country_id: 2300660
description:
Dec 13 07:20:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.139.12.160, lip=66.85.158.91, TLS, session=<uERrmctFg6Apiwyg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.27
country_id: 3865483
description:
Dec 13 07:20:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=181.191.223.27, lip=66.85.158.91, TLS, session=<BJqBmctFOd61v98b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 07:21:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<TeQfnctF0rC8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-13 07:21:48 dovecot_plain authenticator failed for (genaty) [154.146.240.123]:60982: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.200
country_id: 3865483
description:
Dec 13 07:22:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.251.200, lip=66.85.158.91, TLS, session=<hk/lnstFl4KzAPvI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-13 07:22:27 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:44851: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.142.125
country_id: 99237
description:
Dec 13 07:22:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=65.20.142.125, lip=66.85.158.91, TLS, session=<3mRgoMtFyoRBFI59>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-13 07:22:54 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:55028: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-13 07:23:00 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:60188: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-13 07:24:06 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:47460: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-13 07:23:10 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:56464: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 07:23:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<k6q/pMtFALzCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-13 07:23:38 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:38136: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-13 07:24:02 dovecot_login authenticator failed for ([182.95.178.206]) [182.95.178.206]:42324: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2025-12-13 07:24:27 dovecot_login authenticator failed for 236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:55680: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 07:24:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<OStvqMtFYNsuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 07:24:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<lb6HqctFtMSLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 07:25:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<YKjUq8tFqsQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 07:26:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<RWg3r8tFGoYv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-12-13 07:26:33 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:51133: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 07:26:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<r0gfsMtF0pUro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-12-13 07:26:56 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:37192: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-13 07:26:57 dovecot_login authenticator failed for (BUc5y4RL) [178.16.54.97]:62517: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 07:27:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<9PABsstFwrAI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-13 07:27:21 dovecot_login authenticator failed for (T1aLkiKv) [178.16.54.97]:55810: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 07:27:27 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:46818: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 13 07:27:40 host2 sshd[1301764]: Disconnecting authenticating user root 82.67.140.251 port 41969: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 13 07:27:40 host2 sshd[1301764]: error: maximum authentication attempts exceeded for root from 82.67.140.251 port 41969 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 13 07:27:49 host2 sshd[1301845]: Disconnecting invalid user admin 82.67.140.251 port 42897: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 07:28:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<xhwktstFJNY+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-13 07:28:32 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:53504: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 07:28:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<ha0At8tFYIeB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.72
country_id: 6252001
description:
2025-12-13 07:28:47 dovecot_login authenticator failed for ([98.185.120.72]) [98.185.120.72]:34747: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-13 07:28:09 dovecot_login authenticator failed for (MvNgmbW) [178.16.54.97]:65105: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-13 07:29:30 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:32929: 535 Incorrect authentication data (set_id=account@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 07:29:43 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:58495: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 07:31:49 host2 sshd[1303917]: Disconnected from invalid user  62.60.131.157 port 12882 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 07:34:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<iTXIzMtFlt+H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 07:34:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<rvSxzctFGrg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-13 07:36:21 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:61209: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.107
country_id: 6252001
description:
2025-12-13 07:36:44 dovecot_login authenticator failed for ([70.174.168.107]) [70.174.168.107]:46388: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 07:37:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<wZwd18tFeIpnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-13 07:38:29 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:54998: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.47
country_id: 6252001
description:
Dec 13 07:38:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.118.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xzke28tFuOusynYv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-12-13 07:38:44 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:34918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 07:40:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<aqkG4stFhJ0IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-13 07:41:56 dovecot_plain authenticator failed for (pstet) [5.31.15.108]:37766: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.191
country_id: 1733045
description:
2025-12-13 07:42:53 dovecot_login authenticator failed for ([49.124.148.191]) [49.124.148.191]:52830: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 07:42:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<F0hn6MtFHKFm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 07:42:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<fUdk6MtFVoOl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-13 07:42:28 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:42746: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 07:45:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<bdYC8stF0rBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 07:45:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<cPGd8stF9LDD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-13 07:46:12 dovecot_plain authenticator failed for (gered) [24.187.213.29]:33124: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-13 07:48:07 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:18726: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 13 07:47:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<0ETU+ctF9p/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-13 07:47:30 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:58982: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 13 07:47:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nR0z+8tF6A9ChJl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-13 07:47:49 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:60088: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-13 07:48:24 dovecot_login authenticator failed for (nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:33474: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 07:48:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<g5c1/stF/K/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-13 07:48:43 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:47723: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-13 07:48:54 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:43358: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 07:49:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PEkVAcxFpHovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 07:50:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<zl+/BcxFhJm8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 07:51:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<SSa8B8xF2LbD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-13 07:51:29 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (unducks) [73.213.236.66]:59540: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 13 07:51:43 host2 sshd[1315895]: Disconnected from invalid user user 43.155.21.198 port 52436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-12-13 07:53:25 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:50753: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-13 07:54:01 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:38784: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 07:54:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<agU4FcxFRuiG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.248
country_id: 6252001
description:
2025-12-13 07:55:03 dovecot_login authenticator failed for ([98.185.121.248]) [98.185.121.248]:44997: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-13 07:54:21 dovecot_login authenticator failed for ([125.18.210.161]) [182.95.119.118]:41988: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.113
country_id: 6252001
description:
2025-12-13 07:54:46 dovecot_login authenticator failed for wsip-184-191-250-113.fv.ks.cox.net [184.191.250.113]:35823: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2025-12-13 07:55:22 dovecot_login authenticator failed for ([182.95.52.170]) [182.95.52.170]:59752: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-13 07:55:30 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (epted) [73.129.57.71]:40954: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 07:55:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<cymBF8xF7MNAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 13 07:55:54 host2 sshd[1319059]: Disconnected from invalid user ali 43.155.21.198 port 42660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 07:56:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<8ASbG8xFVIeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-13 07:56:47 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (trane) [73.183.74.177]:48892: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 07:57:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Q08gH8xF3ryWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.168
country_id: 6252001
description:
Dec 13 07:59:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.168, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<rrgEJ8xFu86i2JWo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.168
country_id: 6252001
description:
Dec 13 08:00:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.168, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<MMkOKsxFpO+i2JWo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 08:00:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<v9X4KMxFzLNetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 08:01:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<H8DXK8xF0qjAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 08:02:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<elrmMMxFoph100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-13 08:03:33 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:38436: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 08:03:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<OZouM8xFFKSkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-13 08:03:18 dovecot_login authenticator failed for (nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:56882: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.168
country_id: 6252001
description:
Dec 13 08:07:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.168, lip=66.85.158.91, TLS, session=<W+7iQMxFtPyi2JWo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.214
country_id: 1733045
description:
2025-12-13 08:07:10 dovecot_login authenticator failed for ([49.124.149.214]) [49.124.149.214]:56350: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-13 08:07:51 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:42810: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 08:08:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<dAVXR8xFqIgI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-13 08:10:36 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (morroly) [24.1.200.187]:55376: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-13 08:10:51 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (copalo) [98.204.134.124]:51982: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.77.184
country_id: 1269750
description:
2025-12-13 08:12:08 dovecot_login authenticator failed for (static.ftth.bgn.117.211.77.184.bsnl.in) [117.211.77.184]:32908: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-12-13 08:12:10 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:35087: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-12-13 08:12:20 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:60091: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-13 08:12:46 dovecot_login authenticator failed for ([161.8.241.121]) [161.8.241.121]:41758: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 08:13:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<N+12WMxFiKA+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-13 08:13:52 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:54636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-12-13 08:14:12 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:63083: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.33.198
country_id: 226074
description:
Dec 13 08:14:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=196.0.33.198, lip=66.85.158.91, TLS, session=<XWaHWsxFus3EACHG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.93
country_id: 3175395
description:
Dec 13 08:14:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.93, lip=66.85.158.91, TLS, session=<iSvAW8xF7bq5D6td>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-13 08:19:02 dovecot_login authenticator failed for (nsg-static-033.187.72.182.airtel.in) [182.95.228.110]:39674: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-12-13 08:18:32 dovecot_login authenticator failed for (nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:59170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-12-13 08:18:45 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:58009: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 08:19:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<nzeobMxFBIe8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-13 08:19:47 dovecot_plain authenticator failed for (tably) [185.214.169.10]:41493: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 08:20:12 host2 sshd[1335456]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 51329


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 08:20:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Ng12cMxFJpAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 08:21:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<CM4Kc8xFKr3CBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-13 08:21:28 dovecot_plain authenticator failed for (cieste) [12.182.125.210]:60700: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 08:22:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<u0Lcd8xFcKAro2np>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.222.218.187
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.222.218.187] [Remote Port]=[39418] [Authentication Database]=[mail] [Username]=[admin@essenceceylontea.com] (13/10 failures) (blocked until [Sun Dec 14 02:54:16 2025 UTC/Sun Dec 14 08:24:16 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 08:24:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<puhefsxF+pkI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 08:24:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<W5ZHf8xFOLYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 08:27:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<P3PjisxFIJ+B4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-13 08:29:04 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:37671: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-13 08:28:22 dovecot_login authenticator failed for (nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:43870: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 08:28:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<a4wLjcxF2Kxo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.255.38.183
country_id: 6252001
description:
Dec 13 08:28:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=38.255.38.183, lip=66.85.158.91, session=<E4p/jcxFrvgm/ya3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 08:29:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<6hZGkcxFcI4ImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 08:29:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Z8rlj8xFNt6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.48.24
country_id: 2963597
description:
Dec 13 08:30:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.203.48.24, lip=66.85.158.91, TLS, session=<bnZvksxFr5ElyzAY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.168
country_id: 3469034
description:
Dec 13 08:30:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=187.120.72.168, lip=66.85.158.91, TLS, session=<pmGUk8xFtrm7eEio>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-13 08:31:47 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:46618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-13 08:32:12 dovecot_login authenticator failed for (static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:50646: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-13 08:32:35 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:37166: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-13 08:32:57 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:42778: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 08:33:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<ROY+oMxFEI9npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 08:33:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<fqLmoMxFAtaH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 08:35:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<DmcapsxFytaB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-13 08:35:44 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (uppred) [73.129.57.71]:53658: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 08:35:14 host2 sshd[1343654]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 52509


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 08:36:07 host2 sshd[1344086]: Disconnected from invalid user admin 2.57.121.112 port 54279 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-13 08:36:30 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (inexialuta) [71.224.169.28]:43842: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 08:36:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<JFVyq8xFtppm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-13 08:38:05 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:38423: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-13 08:37:20 dovecot_login authenticator failed for ([122.187.168.129]) [125.19.163.58]:36910: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 08:37:37 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:39230: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.170.21.223
country_id: 6252001
description:
2025-12-13 08:38:00 dovecot_login authenticator failed for (75-170-21-223.rcmt.centurylink.net) [75.170.21.223]:43260: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-13 08:38:35 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:51623: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-13 08:38:35 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:40354: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-13 08:38:47 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:54860: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-13 08:38:50 dovecot_login authenticator failed for (nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:50264: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.195
country_id: 3469034
description:
Dec 13 08:40:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=191.240.96.195, lip=66.85.158.91, TLS, session=<H5aruMxFmsm/8GDD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 08:41:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<+sVuusxFdKBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 08:40:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<n51YuMxF7q2l6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.26
country_id: 3469034
description:
Dec 13 08:40:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.247.26, lip=66.85.158.91, TLS, session=<EdV/t8xFGsG60fca>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 08:40:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<UgyGuMxFNJ3D+hnW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 195.250.25.214
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[195.250.25.214] [Remote Port]=[40244] [Authentication Database]=[mail] [Username]=[no-reply@lankaherbalsolutions.com] (12/10 failures) (blocked until [Sun Dec 14 03:10:31 2025 UTC/Sun Dec 14 08:40:31 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 08:43:06 host2 sshd[1347648]: Disconnected from invalid user  62.60.131.157 port 11960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.223.86
country_id: 798544
description:
Dec 13 08:42:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=213.92.223.86, lip=66.85.158.91, TLS, session=<qaxav8xFTLTVXN9W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.79
country_id: 2510769
description:
Dec 13 08:43:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=46.39.212.79, lip=66.85.158.91, TLS, session=<hK5vwMxF3rAuJ9RP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 08:43:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<q0SawsxFhuwIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-13 08:43:32 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:59200: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-13 08:43:50 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:45523: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-13 08:43:56 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:39397: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-13 08:44:14 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:43446: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-13 08:44:28 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:43029: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-13 08:44:39 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:46470: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-13 08:44:46 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (amimatic) [71.41.202.12]:50590: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.108.185
country_id: 3175395
description:
Dec 13 08:44:51 host2 sshd[1349342]: Disconnected from invalid user wy 156.54.108.185 port 37166 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.108.185
country_id: 3175395
description:
Dec 13 08:45:25 host2 sshd[1350768]: Disconnected from invalid user geo 156.54.108.185 port 43393 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 13 08:45:54 host2 sshd[1351295]: Disconnected from invalid user pal 162.223.91.130 port 45530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 08:45:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<4A7fy8xFhqy8pkxr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 13 08:47:00 host2 sshd[1351805]: Disconnected from invalid user admin 162.223.91.130 port 42808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 08:47:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Fs6nz8xFehIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 08:47:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<S/m/z8xFEO7O7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 08:46:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ZLF8zcxFNJfD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 13 08:46:27 host2 sshd[1351589]: Disconnected from invalid user debian 162.223.91.130 port 58232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 13 08:48:05 host2 sshd[1352341]: Disconnected from invalid user elasticsearch 162.223.91.130 port 39754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 13 08:48:13 host2 sshd[1352415]: Disconnected from invalid user gamer 62.219.172.50 port 53760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 08:49:36 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (diores) [98.227.25.115]:60218: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 08:49:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<fPL52cxF+K8+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.219.172.50
country_id: 294640
description:
Dec 13 08:50:25 host2 sshd[1353646]: Disconnected from invalid user dev 62.219.172.50 port 43896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 13 08:51:29 host2 sshd[1354118]: Disconnected from invalid user zxl 62.219.172.50 port 57818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.88.228.7
country_id: 3017382
description:
Dec 13 08:51:33 host2 sshd[1354159]: Disconnected from invalid user john 166.88.228.7 port 49026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 08:52:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<6Vvk4cxFys6KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 08:52:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<nqYk4sxFTuRAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.157
country_id: 6252001
description:
Dec 13 08:53:11 host2 sshd[1354912]: Disconnected from invalid user admin 108.85.73.157 port 51306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-13 08:53:34 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:56598: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 08:54:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<feOl6MxFcuWG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.123.148
country_id: 1819730
description:
2025-12-13 08:54:05 dovecot_login authenticator failed for (161.81.123.148.hk.chinamobile.com) [161.81.123.148]:60624: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:54:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<iGEm68xFXJQDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 08:54:57 host2 sshd[1356349]: Disconnected from invalid user work 81.9.149.44 port 49654 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:55:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EDgQ7sxF4tIDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 08:56:03 host2 sshd[1357028]: Disconnected from invalid user dixi 81.9.149.44 port 45728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 08:57:05 host2 sshd[1357503]: Disconnected from invalid user epadmin 81.9.149.44 port 37896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-12-13 08:56:22 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:57793: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 08:56:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<RjI08sxFEOqWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-12-13 08:56:52 dovecot_login authenticator failed for (190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:52214: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:57:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bdx788xFqp8Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-12-13 08:57:26 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:56385: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-12-13 08:57:49 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:46135: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 08:57:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<mFKp9sxFdOnAqZl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:58:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wGPQ+MxFQJoDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 08:59:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<RrPj+sxF271etwuC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 08:59:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Gh0B/MxF/IADg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 08:59:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Z8Nn/cxFKI6kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 09:01:14 host2 sshd[1359803]: Disconnected from invalid user sms 81.9.149.44 port 34922 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:01:24 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<Q28rA81FMKADg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-13 09:02:07 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (skingful) [73.213.236.66]:41650: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:02:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8yzVBc1FYMEDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-13 09:02:12 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:59362: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 09:02:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<KX8IB81FrJl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-13 09:02:29 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:52613: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-13 09:02:31 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:48006: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-13 09:03:50 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:48202: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:03:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+VrhC81F6IYDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.9.149.44
country_id: 2510769
description:
Dec 13 09:03:16 host2 sshd[1361303]: Disconnected from invalid user vishal 81.9.149.44 port 36264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-13 09:03:21 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:48985: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 09:05:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<1OJJEM1FYLSLOxGe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:05:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<g5npEc1FIuIDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 09:05:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<pDZQE81FSqgI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.95
country_id: 6252001
description:
Dec 13 09:05:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.95, lip=66.85.158.92, session=<dHiVE81Fau7N0h9f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 09:06:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<GE+0E81F8rnCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-13 09:05:09 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (clowed) [67.172.54.29]:57928: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.253
country_id: 2542007
description:
2025-12-13 09:05:13 dovecot_plain authenticator failed for (semed) [105.73.203.253]:46284: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 13 09:06:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<ugXrFM1FmMEDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-13 09:07:59 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:40000: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-13 09:08:11 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:55864: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.184.94.75
country_id: 2328926
description:
2025-12-13 09:08:32 dovecot_login authenticator failed for 41-184-94-75.rv.ipnxtelecoms.com ([102.164.35.116]) [41.184.94.75]:47284: 535 Incorrect authentication data (set_id=sale@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-13 09:08:43 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (hentable) [50.74.136.134]:52034: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 09:08:45 dovecot_plain authenticator failed for (nonra) [12.150.243.22]:42084: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-13 09:08:47 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:36568: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-13 09:08:49 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (hycosphum) [73.195.211.98]:47932: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-13 09:09:01 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:36824: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 09:10:28 host2 sshd[1365504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 09:11:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<snJHKM1FiNM+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 09:15:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<PZ3cNs1FxosuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-13 09:17:14 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:58438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-13 09:17:27 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:58357: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 09:17:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<rUeUPM1FSLq8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 09:17:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<0pNKPc1FALUro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-12-13 09:17:45 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:45163: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-13 09:18:12 dovecot_login authenticator failed for (cm-178.232.194.231.get.no) [178.232.194.231]:51025: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 09:18:35 host2 sshd[1370373]: Disconnected from invalid user  62.60.131.157 port 39863 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 09:18:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<ycfBQc1F4InCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.110.203.174
country_id: 953987
description:
2025-12-13 09:21:16 dovecot_plain authenticator failed for ([31.57.166.48]) [152.110.203.174]:41430: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.42.176.104
country_id: 3895114
description:
2025-12-13 09:21:31 dovecot_plain authenticator failed for ([31.57.166.48]) [181.42.176.104]:33006: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.245.233.188
country_id: 3865483
description:
2025-12-13 09:21:30 dovecot_plain authenticator failed for ([31.57.166.48]) [170.245.233.188]:38464: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-13 09:21:55 dovecot_login authenticator failed for (nsg-corporate-90.179.185.122.airtel.in) [136.232.73.130]:58612: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.226.61.95
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.226.61.95: 629 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 09:21:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<eHj8Sc1F6sUI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.66.152.93
country_id: 3017382
description:
2025-12-13 09:21:17 dovecot_plain authenticator failed for 93.152.66.81.rev.sfr.net ([31.57.166.48]) [81.66.152.93]:43380: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.188.177.50
country_id: 3469034
description:
2025-12-13 09:21:45 dovecot_plain authenticator failed for ([31.57.166.48]) [38.188.177.50]:57735: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 09:22:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<DENpT81F1OUv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-13 09:22:08 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:44900: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 09:26:54 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:60314: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 09:27:56 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:59127: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-13 09:27:11 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:52592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 09:27:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Ov1AX81F/qmB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-13 09:27:27 dovecot_plain authenticator failed for (entoging) [178.250.191.189]:34234: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-13 09:28:22 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:37318: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 09:30:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<W69nac1FmutnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-13 09:30:03 dovecot_plain authenticator failed for (exante) [92.62.243.175]:51618: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 09:30:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<JPUBbM1FppeB4gum>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 13 09:31:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<I3H1bs1FttkD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 09:31:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<GXTPb81FTLtm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-13 09:32:59 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:41752: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 09:33:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<LngndM1FmIcImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-13 09:32:43 dovecot_login authenticator failed for (mail3.hurst.co.uk) [77.89.143.122]:53657: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-12-13 09:33:44 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:50424: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-13 09:34:07 dovecot_login authenticator failed for (dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:39048: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 09:35:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<hv0Qfs1FWsOH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 09:35:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<se2Vfc1FENTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 09:36:18 host2 sshd[1380603]: Disconnected from invalid user user 2.57.121.25 port 20761 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 09:36:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<mvjwgc1FTpBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 09:39:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<tAXkis1FKoel6L5h>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 09:41:47 host2 sshd[1383650]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 09:41:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Ytedks1FGL/D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.92.68.200
country_id: 732800
description:
Dec 13 09:42:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=91.92.68.200, lip=66.85.158.91, TLS, session=<hn/Zls1F6gpbXETI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.40.236.31
country_id: 2510769
description:
2025-12-13 09:43:06 dovecot_login authenticator failed for 31.red-83-40-236.dynamicip.rima-tde.net [83.40.236.31]:58703: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.69.251.106
country_id: 597427
description:
2025-12-13 09:43:44 dovecot_login authenticator failed for (md-188-69-251-106.omni.lt) [188.69.251.106]:36532: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 09:43:52 host2 sshd[1385098]: Disconnected from invalid user admin 2.57.121.112 port 45676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 09:43:29 dovecot_plain authenticator failed for (culimic) [64.72.74.162]:46359: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.241.165.8
country_id: 3469034
description:
Dec 13 09:43:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.241.165.8, lip=66.85.158.91, TLS, session=<FWAHmM1FmNK/8aUI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-13 09:43:26 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (ableas) [188.219.104.210]:57623: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-13 09:43:27 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:54796: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-13 09:43:29 dovecot_plain authenticator failed for (tedist) [178.250.191.189]:43224: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 09:44:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<fNUlns1FVrYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 09:45:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<nPM2n81FRNc+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 09:44:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<C0/RnM1FUNa8pkxr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.130
country_id: 6252001
description:
Dec 13 09:44:36 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.133.130, lip=66.85.158.92, session=<+u2wnc1FJvmTuYWC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 09:45:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<FecToc1FnMgIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.35.153.120
country_id: 6252001
description:
2025-12-13 09:45:40 dovecot_plain authenticator failed for ([31.57.166.48]) [50.35.153.120]:44090: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 09:45:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<4nLRoc1Fbo/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.30.24
country_id: 99237
description:
2025-12-13 09:45:58 dovecot_plain authenticator failed for ([31.57.166.48]) [185.106.30.24]:48722: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-13 09:46:38 +0530] info [cpaneld] 89.249.55.106 - cloudtou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.0.20
country_id: 2750405
description:
Dec 13 09:46:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=159.223.0.20, lip=66.85.158.91, TLS: Connection closed, session=<6MECpc1FyJyf3wAU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 09:47:04 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:41806: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 09:47:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<5e6Fp81FQqiKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 09:47:23 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:60117: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 09:48:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<abavrM1FrtdAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-13 09:48:58 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (adisord) [50.74.136.134]:52938: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.72.153.59
country_id: 6252001
description:
[2025-12-13 09:49:03 +0530] info [cpaneld] 71.72.153.59 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.195.176.86
country_id: 6252001
description:
[2025-12-13 09:49:04 +0530] info [cpaneld] 150.195.176.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.187
country_id: 6252001
description:
[2025-12-13 09:49:06 +0530] info [cpaneld] 172.58.212.187 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 09:48:20 host2 sshd[1388345]: Disconnected from invalid user user 2.57.121.25 port 53633 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.72.153.59
country_id: 6252001
description:
[2025-12-13 09:49:09 +0530] info [cpaneld] 71.72.153.59 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.65.142
country_id: 6252001
description:
[2025-12-13 09:49:10 +0530] info [cpaneld] 67.209.65.142 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.141.155.64
country_id: 6252001
description:
[2025-12-13 09:49:08 +0530] info [cpaneld] 74.141.155.64 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.102.54.243
country_id: 6252001
description:
[2025-12-13 09:49:07 +0530] info [whostmgrd] 76.102.54.243 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-13 09:52:06 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:58030: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-13 09:52:27 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:44699: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.182
country_id: 1733045
description:
2025-12-13 09:52:27 dovecot_login authenticator failed for ([49.124.155.182]) [49.124.155.182]:51036: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 09:52:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Hm/Ruc1FmJ4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.92.147
country_id: 2029969
description:
2025-12-13 09:52:38 dovecot_login authenticator failed for ([202.126.92.147]) [202.126.92.147]:53520: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 09:53:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<HaW5u81FvtaG0Wp/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.20.1.201
country_id: 6252001
description:
[2025-12-13 09:54:28 +0530] info [cpaneld] 67.20.1.201 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.176.251.208
country_id: 6252001
description:
[2025-12-13 09:54:26 +0530] info [cpaneld] 97.176.251.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.130.106.210
country_id: 6252001
description:
[2025-12-13 09:54:30 +0530] info [cpaneld] 76.130.106.210 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.235.82
country_id: 6252001
description:
[2025-12-13 09:54:34 +0530] info [cpaneld] 76.33.235.82 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 09:54:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<Gv9Ywc1F0LjAqZl0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.56.103
country_id: 6252001
description:
[2025-12-13 09:54:25 +0530] info [cpaneld] 73.235.56.103 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.56.157.248
country_id: 6252001
description:
[2025-12-13 09:54:29 +0530] info [whostmgrd] 208.56.157.248 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.23.189.194
country_id: 6252001
description:
[2025-12-13 09:54:32 +0530] info [cpaneld] 75.23.189.194 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 09:55:00 host2 sshd[1393085]: Disconnected from invalid user admin 2.57.121.112 port 40215 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-13 09:54:08 dovecot_login authenticator failed for ([125.16.246.121]) [182.95.63.50]:38048: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 09:56:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xgKdxs1FtNiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 09:56:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<sf0RyM1FSoWkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.159
country_id: 6252001
description:
2025-12-13 09:58:03 dovecot_login authenticator failed for wsip-184-191-250-159.fv.ks.cox.net [184.191.250.159]:39946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 09:58:57 host2 sshd[1396537]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 57102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-12-13 09:59:03 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:33112: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-13 09:59:02 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 09:58:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<h1MHzs1FY+BetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-13 09:58:21 dovecot_login authenticator failed for (cm-84.214.63.110.get.no) [84.214.63.110]:36915: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.142
country_id: 6252001
description:
Dec 13 09:58:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.142, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<HVQqz81F6NCi2JaO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 09:59:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53490: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.142
country_id: 6252001
description:
Dec 13 09:59:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.142, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<6ytr0s1F7OKi2JaO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2025-12-13 09:59:23 dovecot_login authenticator failed for ([87.200.94.102]) [87.200.94.102]:43487: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-13 09:59:36 dovecot_plain authenticator failed for (exechs) [65.20.184.80]:56502: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 10:00:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1KIh1s1FwFR100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.31.145
country_id: 2802361
description:
Dec 13 10:01:27 host2 pure-ftpd[1398721]: (?@35.187.31.145) [INFO] New connection from 35.187.31.145


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 10:02:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<E2Kg3s1FEI4I3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.142
country_id: 6252001
description:
Dec 13 10:04:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.142, lip=66.85.158.92, TLS, session=<pKie481FqPWi2JaO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Dec 13 10:07:20 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<C2QD781FMJQDU5En>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.113
country_id: 6252001
description:
Dec 13 10:09:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.113, lip=66.85.158.91, session=<NVce9c1F29PDuExx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-12-13 10:08:35 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:39485: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-13 10:08:47 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:56680: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.17
country_id: 6252001
description:
Dec 13 10:08:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=195.184.76.17, lip=66.85.158.91, session=<j0Bx9M1FC8fDuEwR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.114
country_id: 6252001
description:
Dec 13 10:09:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.114, lip=66.85.158.91, session=<3yqO9c1FqejDuExy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Dec 13 10:09:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.18, lip=66.85.158.91, session=<pRe+9c1FEcfDuEwS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 10:10:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<vhmk+s1FOuynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 10:11:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<yYul/M1F1tYuZXpm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.114.19.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.114.19.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.2.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.2.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.167.218.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.167.218.57 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.76.247
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.76.247 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.176.151.96
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.176.151.96 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.112.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.112.16 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.212.202.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.212.202.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-13 10:13:52 dovecot_plain authenticator failed for (mograrans) [5.32.99.14]:37278: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 10:13:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<NBA2Bs5F2Loro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 10:14:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<7h4RCs5Fip68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-13 10:15:09 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:40002: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.124.35.65
country_id: 3469034
description:
2025-12-13 10:16:00 dovecot_plain authenticator failed for ([31.57.166.48]) [177.124.35.65]:34161: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 10:16:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<fVlqD85FPsNo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 10:16:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Dj06Ec5FbuXCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.23.92.193
country_id: 6252001
description:
2025-12-13 10:16:12 dovecot_plain authenticator failed for 165-23-92-193-dynamic.midco.net ([31.57.166.48]) [165.23.92.193]:34576: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.139.41.107
country_id: 3865483
description:
2025-12-13 10:16:25 dovecot_plain authenticator failed for host107.190-139-41.telecom.net.ar ([31.57.166.48]) [190.139.41.107]:16937: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-13 10:17:29 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:55812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-12-13 10:17:30 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:59233: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-13 10:17:42 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:57310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-13 10:17:18 dovecot_login authenticator failed for (189.219.138.45-clientes-izzi.mx) [189.219.138.45]:42366: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 10:18:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<uP4sFs5FBNoI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.97
country_id: 6252001
description:
2025-12-13 10:18:54 dovecot_login authenticator failed for ([70.174.168.97]) [70.174.168.97]:33949: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-13 10:19:13 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:46422: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 10:20:06 host2 sshd[1410057]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 63992


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-13 10:20:05 dovecot_plain authenticator failed for (chous) [38.248.111.238]:48824: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 10:21:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<iFQlIc5FAqgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-13 10:22:38 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:39457: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-13 10:22:47 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:41500: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-13 10:22:52 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (pedle) [2.135.31.74]:39795: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-13 10:23:31 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:53950: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-13 10:23:57 dovecot_login authenticator failed for ([182.95.181.22]) [182.95.181.22]:46176: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-13 10:24:19 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:47492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-13 10:24:40 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:47196: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.79.208
country_id: 2661886
description:
2025-12-13 10:24:59 dovecot_plain authenticator failed for c-83-226-79-208.bbcust.telenor.se ([31.57.166.48]) [83.226.79.208]:57520: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 10:25:27 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (depigy) [196.47.172.253]:56579: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.198.13.144
country_id: 3865483
description:
2025-12-13 10:25:26 dovecot_plain authenticator failed for ([31.57.166.48]) [192.198.13.144]:57871: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.66.226.23
country_id: 2635167
description:
2025-12-13 10:25:12 dovecot_plain authenticator failed for ([31.57.166.48]) [84.66.226.23]:55990: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-13 10:25:24 dovecot_plain authenticator failed for (unmenderd) [5.31.15.108]:33376: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 10:26:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<zvhsMs5FXJlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 10:26:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<g+QVNc5FeLNm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.174.162.68
country_id: 3469034
description:
Dec 13 10:28:05 host2 sshd[1414848]: Disconnected from invalid user joe 45.174.162.68 port 58122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 10:27:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<sutENs5FKoaB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec 13 10:27:56 host2 sshd[1414703]: Disconnected from invalid user cad 124.155.125.131 port 60258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:28:29 host2 sshd[1415137]: Disconnected from invalid user ansible 37.32.13.93 port 40476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 10:28:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<K567O85F2L8+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:29:04 host2 sshd[1415781]: Disconnected from invalid user nvr 194.74.196.10 port 48166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 10:29:34 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:60948: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-13 10:29:46 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:39517: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:29:51 host2 sshd[1416182]: Disconnected from invalid user hqadmin 37.32.13.93 port 59780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:29:13 host2 sshd[1415886]: Disconnected from invalid user ubuntu 154.92.109.196 port 24836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:29:25 host2 sshd[1416011]: Disconnected from invalid user ubuntu 107.174.41.51 port 53398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 10:29:32 host2 sshd[1416056]: Disconnected from invalid user  62.60.131.157 port 49220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:30:29 host2 sshd[1416840]: Disconnected from invalid user nvr 68.183.144.238 port 59588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:30:14 host2 sshd[1416667]: Disconnected from invalid user deployer 194.74.196.10 port 56818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:31:55 host2 sshd[1417542]: Disconnected from invalid user sgp 154.92.109.196 port 41732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:31:10 host2 sshd[1417128]: Disconnected from invalid user panel 37.32.13.93 port 55260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 10:31:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<D1N5RM5FMuTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Dec 13 10:31:18 host2 sshd[1417232]: Disconnected from invalid user ubuntu 154.92.109.196 port 53773 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 13 10:32:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<t+/CR85FVKlog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-13 10:32:32 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:16908: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.93
country_id: 130758
description:
Dec 13 10:32:35 host2 sshd[1417942]: Disconnected from invalid user proxyuser 37.32.13.93 port 57832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:32:38 host2 sshd[1417886]: Disconnected from invalid user docker 154.222.24.142 port 33626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 13 10:32:43 host2 sshd[1418012]: Disconnected from invalid user appadmin 202.4.106.201 port 33556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-12-13 10:32:53 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:51854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:32:56 host2 sshd[1418111]: Disconnected from invalid user nick 194.74.196.10 port 53548 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 13 10:33:26 host2 sshd[1418405]: Disconnected from invalid user docker 202.4.106.201 port 45950 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 194.74.196.10
country_id: 2635167
description:
Dec 13 10:33:26 host2 sshd[1418415]: Received disconnect from 194.74.196.10 port 50930:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:33:59 host2 sshd[1418795]: Disconnected from invalid user temp 68.183.144.238 port 46846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 10:33:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<qXQyS85FItdntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 13 10:33:22 host2 sshd[1418387]: Disconnected from invalid user ubuntu 213.6.203.226 port 46172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 13 10:35:03 host2 sshd[1419392]: Disconnected from invalid user admins 213.6.203.226 port 40992 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-13 10:34:09 dovecot_login authenticator failed for ([182.95.20.28]) [182.95.228.10]:39530: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:34:50 host2 sshd[1419242]: Disconnected from invalid user alice 141.227.137.228 port 51092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2025-12-13 10:34:55 dovecot_login authenticator failed for ([122.186.230.25]) [125.19.161.150]:37822: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:35:31 host2 sshd[1419810]: Disconnected from invalid user user123 107.174.41.51 port 53576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 10:35:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Cvw1VM5FfsGH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:36:21 host2 sshd[1420201]: Disconnected from invalid user max 154.222.24.142 port 60972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.145
country_id: 3865483
description:
Dec 13 10:36:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.249.145, lip=66.85.158.91, TLS, session=<l5ioVc5FE6GzAPmR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:36:41 host2 sshd[1420367]: Disconnected from invalid user docker 107.174.41.51 port 53676 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.136
country_id: 3469034
description:
Dec 13 10:36:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=187.120.72.136, lip=66.85.158.91, TLS, session=<fcryVs5F25G7eEiI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.144.238
country_id: 6252001
description:
Dec 13 10:36:50 host2 sshd[1420449]: Disconnected from invalid user vinay 68.183.144.238 port 55970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 13 10:36:06 host2 sshd[1420102]: Disconnected from invalid user appadmin 107.174.41.51 port 53624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:36:29 host2 sshd[1420290]: Disconnected from invalid user user123 141.227.137.228 port 49984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 13 10:36:57 host2 sshd[1420480]: Disconnected from invalid user ubuntu 110.164.228.242 port 55996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:36:12 host2 sshd[1420122]: Disconnected from invalid user issabel 103.186.1.120 port 38816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 10:37:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<YVaiWc5FdIrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 10:37:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<NH33Ws5FALIImxNM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:37:35 host2 sshd[1420956]: Disconnected from invalid user arthur 154.222.24.142 port 57144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.227.137.228
country_id: 3017382
description:
Dec 13 10:37:59 host2 sshd[1421181]: Disconnected from invalid user mpi 141.227.137.228 port 59918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 13 10:38:11 host2 sshd[1421307]: Disconnected from invalid user max 110.164.228.242 port 33164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 10:38:30 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:50688: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:38:47 host2 sshd[1421682]: Disconnected from invalid user issabel 154.222.24.142 port 54016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 10:38:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<C+KSX85FZKel6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-13 10:38:08 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:38432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:39:20 host2 sshd[1422197]: Disconnected from invalid user admin 103.186.1.120 port 47884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 10:40:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<o/70Y85FNJe8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 13 10:40:59 host2 sshd[1423250]: Disconnected from invalid user administrator 154.222.24.142 port 45100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-13 10:40:31 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (nestive) [68.52.119.193]:35306: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 13 10:40:48 host2 sshd[1423151]: Disconnected from invalid user ftptest 103.186.1.120 port 42474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:40:57 host2 sshd[1423227]: Disconnected from invalid user vinay 151.46.198.234 port 39247 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:41:38 host2 sshd[1423630]: Disconnected from invalid user john 151.46.198.234 port 39810 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.166.86.83
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 174.166.86.83 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.73.94.253
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.73.94.253 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.154.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.2.154.34 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 10:42:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<S2CNbc5FxKYvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:42:20 host2 sshd[1424029]: Disconnected from invalid user deployer 151.46.198.234 port 39871 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.208.124.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.208.124.100 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.20.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.147.20.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 10:42:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ncUgbc5FFumKxX03>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.205.34.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.205.34.6 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.86.99.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.86.99.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.232.204.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.232.204.210 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.24.108
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.193.24.108 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.166.222.109
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.166.222.109 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.238.16.128
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.238.16.128 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.99.225.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.99.225.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.186.77.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.186.77.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.130.66.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.130.66.217 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-13 10:43:51 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:57431: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-13 10:43:10 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:49452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2025-12-13 10:43:21 dovecot_login authenticator failed for ([107.85.14.208]) [107.85.14.208]:43676: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-13 10:43:33 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:44386: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-13 10:45:00 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:39807: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 10:44:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lV2Bdc5FTovO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.198.234
country_id: 3175395
description:
Dec 13 10:44:58 host2 sshd[1426230]: Disconnected from invalid user guest 151.46.198.234 port 39220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-13 10:44:58 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:40661: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 10:45:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<uHaReM5FNJ5AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-12-13 10:45:22 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:56088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-13 10:45:40 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:45610: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-13 10:46:50 dovecot_plain authenticator failed for (nintledive) [65.20.164.137]:54013: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-13 10:47:09 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (aking) [73.27.33.174]:56082: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.236
country_id: 6252001
description:
Dec 13 10:47:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</VVefc5F7MvG6xjs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-13 10:47:12 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (subleting) [98.227.25.115]:44236: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.35
country_id: 1733045
description:
2025-12-13 10:49:16 dovecot_login authenticator failed for ([49.124.151.35]) [49.124.151.35]:39630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 10:49:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<w+Mzhc5FQp8IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-13 10:49:43 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:57839: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 10:50:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<onibh85FKOA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-12-13 10:50:09 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:51173: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-13 10:51:21 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:41390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 10:51:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<2TQmjc5F9oHAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 10:51:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<aEHsjc5FxIyG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 10:54:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<B9D2ls5FXr+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 10:55:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<vtb5ms5F6IyWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.151.7.93
country_id: 6252001
description:
2025-12-13 10:55:50 dovecot_plain authenticator failed for ([31.57.166.48]) [35.151.7.93]:31610: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-13 10:56:01 dovecot_plain authenticator failed for (porapers) [5.11.143.72]:46522: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.12.40.68
country_id: 3865483
description:
2025-12-13 10:56:05 dovecot_plain authenticator failed for ([31.57.166.48]) [198.12.40.68]:49238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.114.233.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 69.114.233.176 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.154.51.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.154.51.18 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.90.168.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.90.168.4 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 10:56:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<3PIOoM5F3J5100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.163.12.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.163.12.68 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.60.66.14
country_id: 3895114
description:
2025-12-13 10:56:19 dovecot_plain authenticator failed for ([31.57.166.48]) [179.60.66.14]:56290: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.119.109.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.119.109.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.32.130.42
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.32.130.42 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.205.150.113
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.205.150.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.12.40.68
country_id: 3865483
description:
2025-12-13 10:56:12 dovecot_login authenticator failed for ([31.57.166.48]) [198.12.40.68]:49238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 10:57:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<+zrQos5FZUBetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 10:58:52 host2 sshd[1433994]: Disconnected from invalid user es 41.57.65.25 port 59376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.162
country_id: 3658394
description:
2025-12-13 10:58:59 dovecot_plain authenticator failed for ([31.57.166.48]) [181.199.46.162]:54083: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-13 11:00:02 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:58452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-13 11:00:01 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (spismatii) [73.161.96.107]:46828: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 10:59:10 host2 sshd[1434147]: Disconnected from invalid user umar 102.211.234.150 port 59206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.158.35
country_id: 1733045
description:
2025-12-13 10:59:14 dovecot_plain authenticator failed for ([31.57.166.48]) [161.142.158.35]:5029: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.23.228
country_id: 1282988
description:
2025-12-13 10:59:32 dovecot_plain authenticator failed for ([31.57.166.48]) [103.148.23.228]:12927: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:00:11 host2 sshd[1434808]: Disconnected from invalid user hb 190.111.211.81 port 42520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 11:00:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<vbuOrM5FAtAI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-12-13 11:00:24 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:43678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 11:00:38 host2 sshd[1435062]: Disconnected from invalid user cloud 102.211.234.150 port 33162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.234.150
country_id: 1733045
description:
Dec 13 11:01:23 host2 sshd[1435573]: Disconnected from invalid user opsadmin 102.211.234.150 port 48494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 11:02:46 host2 sshd[1436453]: Disconnected from invalid user oscar 41.57.65.25 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:02:51 host2 sshd[1436496]: Disconnected from invalid user oscar 190.111.211.81 port 43802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-13 11:02:40 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (tigene) [73.88.196.91]:57264: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.57.65.25
country_id: 878675
description:
Dec 13 11:03:37 host2 sshd[1437223]: Disconnected from invalid user dev 41.57.65.25 port 48482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-13 11:03:48 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:56694: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.111.211.81
country_id: 3865483
description:
Dec 13 11:03:53 host2 sshd[1437356]: Disconnected from invalid user user10 190.111.211.81 port 43430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2025-12-13 11:03:59 dovecot_login authenticator failed for adsl-89-217-204-91.adslplus.ch [89.217.204.91]:59354: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-13 11:04:12 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:59614: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-13 11:04:36 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:47124: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.121.114.141
country_id: 3865483
description:
2025-12-13 11:05:54 dovecot_plain authenticator failed for ([31.57.166.48]) [138.121.114.141]:37442: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 13 11:06:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<bDHgwM5F/N42rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.40.161
country_id: 1282988
description:
2025-12-13 11:05:25 dovecot_plain authenticator failed for ([31.57.166.48]) [103.190.40.161]:2548: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.226.153.126
country_id: 3996063
description:
2025-12-13 11:05:38 dovecot_plain authenticator failed for ([31.57.166.48]) [177.226.153.126]:3441: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 11:07:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<6VgNxs5FmrIuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-13 11:09:00 dovecot_login authenticator failed for (aes-static-041.73.22.125.airtel.in) [122.186.201.62]:34916: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-13 11:08:34 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:56188: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-13 11:08:56 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:42440: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-13 11:09:29 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:35628: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 11:10:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<S7hh0M5FiuEro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-13 11:10:36 dovecot_login authenticator failed for (cm-178.232.194.231.get.no) [178.232.194.231]:39220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 11:10:06 host2 sshd[1441453]: Disconnected from invalid user user 2.57.121.25 port 45423 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-13 11:14:07 dovecot_plain authenticator failed for (pling) [65.20.164.137]:46807: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-12-13 11:15:28 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:42148: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 11:15:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Ctre4s5FEtrCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 11:15:38 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:44968: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 11:16:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<xKF75M5FZJsI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-13 11:16:21 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:40704: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-13 11:16:43 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (rheat) [71.62.34.216]:36542: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-13 11:17:01 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (frism) [72.241.202.216]:38170: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 11:20:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<wEhw9M5FHtsv7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 11:21:08 host2 sshd[1448282]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-13 11:21:45 dovecot_plain authenticator failed for (dehyde) [178.250.191.189]:57528: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 11:22:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<yX/u+85F6M1npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-13 11:22:37 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (aultry) [174.58.87.108]:50734: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 11:22:40 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (sedneers) [96.230.65.90]:51372: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 11:22:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<AyW3+85F9qNm1bVi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 11:25:03 host2 sshd[1450712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-13 11:24:45 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (flineal) [69.123.219.82]:51305: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-13 11:25:05 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:48608: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-13 11:25:19 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:58190: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 13 11:25:44 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<r1BfB89FLtkDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.22.225.7
country_id: 3865483
description:
2025-12-13 11:25:47 dovecot_plain authenticator failed for ([31.57.166.48]) [186.22.225.7]:22897: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.61.51.166
country_id: 6252001
description:
2025-12-13 11:25:59 dovecot_plain authenticator failed for c-71-61-51-166.hsd1.pa.comcast.net ([31.57.166.48]) [71.61.51.166]:40262: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 13 11:27:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qvkCDM9FBBdChJl8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 11:27:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<QS8iDM9FLtTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.244.51
country_id: 1733045
description:
2025-12-13 11:26:13 dovecot_plain authenticator failed for ([31.57.166.48]) [180.75.244.51]:63505: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec 13 11:26:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UxumCc9Fp9uTuYRC>


