# incident

plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.234
country_id: 6252001
description:
Dec  7 22:58:03 host2 pure-ftpd[3024697]: (?@147.185.132.234) [INFO] New connection from 147.185.132.234


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  7 22:58:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<Cqr3AGBFONg+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  7 22:58:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<eGqnAmBFRKU+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  7 22:58:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<nVsHA2BFKNAv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 22:58:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<2hxiA2BFCr1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  7 23:01:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<uqV6DGBFSoQ+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  7 23:02:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<DGHFD2BFwuKG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  7 23:03:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<IOT3EWBFF4Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 23:02:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BPT2EGBFRo9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  7 23:04:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<mGyiGGBFxM8v/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  7 23:06:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<L6lLH2BFwrrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  7 23:07:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<aSCFImBFIoGPbtX3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 23:08:47 host2 sshd[3033367]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  7 23:08:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<EGXlJmBFCJQ+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-07 23:09:32 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3704: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  7 23:09:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<J05nKWBFPshnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  7 23:11:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<bRmYLmBFYrQ+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  7 23:12:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<K+bdM2BFpN6iAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 23:15:17 dovecot_plain authenticator failed for (purogy) [154.146.240.123]:36594: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  7 23:16:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<pPPWQGBFW6FScUAC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  7 23:17:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<urSaRmBFfqsv+1Ve>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-07 23:19:19 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:58287: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.27
country_id: 6252001
description:
2025-12-07 23:19:43 dovecot_login authenticator failed for ([98.181.46.27]) [98.181.46.27]:55076: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-07 23:20:36 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:54352: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-07 23:20:51 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:51652: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 23:22:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lWDbV2BF4AdetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 23:24:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<dgU2XmBFEiRetwuC>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 94.183.11.130
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[94.183.11.130] [Remote Port]=[9234] [Authentication Database]=[mail] [Username]=[sales@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Mon Dec  8 17:54:20 2025 UTC/Mon Dec  8 23:24:20 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  7 23:25:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<fdZpYmBFkJSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 23:25:35 dovecot_plain authenticator failed for (broneliter) [154.144.243.93]:43332: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  7 23:25:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<fRzDYmBFWOel6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 23:26:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<in9vZ2BFeKBetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  7 23:28:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<8sUmbWBFWuSkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  7 23:28:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<n6gKbGBFJokv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.34
country_id: 6252001
description:
Dec  7 23:29:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.34, lip=66.85.158.91, TLS handshaking: Connection closed, session=<f3j4cGBFc7dAPsUi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Dec  7 23:29:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.32, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nU4GcmBFrA9APsUg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.220.153.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 18.220.153.6 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2025-12-07 23:32:17 dovecot_login authenticator failed for wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:59974: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  7 23:32:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<tqIAe2BFrue8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-07 23:32:38 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:41069: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 23:33:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<141LfmBFKpI+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 23:34:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<8p/0g2BFoqNnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-07 23:35:38 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:51871: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  7 23:35:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<OC++hmBFkLo+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-07 23:35:51 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:38272: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-07 23:36:00 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:55780: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-07 23:36:28 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:41158: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 23:37:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BB4AjGBFbNZn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 23:37:30 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58110: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 23:39:01 host2 sshd[3055852]: Disconnected from invalid user admin 2.57.121.112 port 24066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-07 23:40:46 dovecot_plain authenticator failed for (cluttes) [178.250.191.189]:39988: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-12-07 23:42:15 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:50174: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.63.161.126
country_id: 2510769
description:
2025-12-07 23:42:24 dovecot_login authenticator failed for static-126-161-63-95.ipcom.comunitel.net [95.63.161.126]:54229: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-07 23:42:37 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:56178: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  7 23:43:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<qaI3o2BFbuQ+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 23:44:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<tL2gpGBFZo8XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 23:44:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pregerm) [87.103.126.54]:40420: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  7 23:45:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<Dbu1qWBFHLw+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  7 23:44:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<H65Dp2BF8uOLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  7 23:45:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<1QxfqmBFioln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 23:47:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<dUtksGBF6Mg+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2025-12-07 23:47:45 dovecot_login authenticator failed for ([122.186.230.25]) [125.19.161.150]:40574: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-07 23:47:46 dovecot_login authenticator failed for ([84.213.190.55]) [84.213.190.55]:44065: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-07 23:47:57 dovecot_login authenticator failed for (aes-static-137.135.17.125.airtel.in) [182.95.228.10]:57854: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-07 23:48:02 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:37670: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-07 23:48:06 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:9591: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-12-07 23:48:18 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:20396: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 23:49:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<G81QuGBFrowXXz9j>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.164.20.42
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.164.20.42] [Remote Port]=[49400] [Authentication Database]=[mail] [Username]=[hr@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Mon Dec  8 18:20:56 2025 UTC/Mon Dec  8 23:50:56 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 23:50:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<ZnNVvWBF+MBnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  7 23:51:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<kZH/vmBFaMY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  7 23:51:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<k1w4v2BF7X5etwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 23:53:18 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (melyous) [87.103.126.54]:12448: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  7 23:53:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ulGlxWBF7tikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  7 23:54:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<hcxeyGBFlOU+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  7 23:54:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<OEFCy2BF/o0+PIdc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  7 23:54:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=134.209.173.54, lip=66.85.158.91, session=<+VVsymBFCq+G0a02>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  7 23:55:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<RAp+zmBFNOxnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  7 23:57:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<InVE02BFqOQP6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  7 23:57:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<gp6Y02BFQsyqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 23:57:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<jrqw1GBFRLc+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 00:00:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<muPd4GBF+OU+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-08 00:01:16 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (zoolic) [96.230.65.90]:38820: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 00:01:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Qpan4mBF6hynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-08 00:02:45 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (metacconon) [81.225.30.107]:41336: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-08 00:03:36 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:52100: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 00:04:06 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:1220: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-08 00:04:19 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:52360: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-08 00:04:29 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:54415: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 00:05:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<yX9i8WBFJJE+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 00:06:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<z1ZZ82BF4Mg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 00:07:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<85MF92BFcu3DhTKl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 00:07:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<FQrJ9mBFqqgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-08 00:08:17 dovecot_plain authenticator failed for (arous) [64.72.74.162]:47971: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-08 00:08:13 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (sprailiker) [81.225.30.107]:54619: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 00:09:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<MvQs/2BFcKeeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 00:09:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<b8MBAWFFOJ0+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 00:10:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<jEZ4AWFFyICuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 00:11:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<1rSMBWFFrubD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-08 00:12:14 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (unmedra) [71.235.225.181]:48820: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 00:12:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<GiqgCWFFuK8+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 00:16:05 host2 sshd[3086490]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 00:16:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<JNSxGWFFNMRnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 00:19:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<YxFqImFF+pw+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 00:20:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Z58sJ2FF6IEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 00:19:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<dewVJWFFzMPANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 00:21:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<mBlEKmFFXsg+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 00:23:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<XQoYM2FFNegz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 00:25:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<24ESOmFFTqcv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-12-08 00:27:58 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:49295: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 00:29:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<KUMzRmFFhNeG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 00:30:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<WRB7SWFFIKAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.135.138.40
country_id: 1269750
description:
Dec  8 00:31:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=148.135.138.40, lip=66.85.158.91, session=<kzpNTWFFmp+Uh4oo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 00:31:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<kBDWTGFFNKWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 00:31:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<NNtvT2FFgLRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 00:32:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<mshXU2FFOoTO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 00:34:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<evwHWWFF5pxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 00:35:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<zLIGW2FFPqyiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 00:35:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<f3AmXmFFpLln9M4G>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.244.206.6
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.244.206.6] [Remote Port]=[47524] [Authentication Database]=[mail] [Username]=[support@dataesite.lk] (10/10 failures) (blocked until [Mon Dec  8 19:05:54 2025 UTC/Tue Dec  9 00:35:54 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 00:37:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<b2wIZGFFYntScUAC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-08 00:38:54 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (solly) [72.241.202.216]:55193: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-08 00:40:18 dovecot_login authenticator failed for ([182.79.136.105]) [122.187.60.126]:43558: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.61.160.114
country_id: 3017382
description:
Dec  8 00:41:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=72.61.160.114, lip=66.85.158.91, session=<NoFpcWFF5rpIPaBy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec  8 00:42:48 host2 sshd[3106463]: Disconnected from invalid user devil 92.207.4.157 port 40632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-08 00:43:21 dovecot_plain authenticator failed for (chmate) [65.20.160.107]:35052: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Dec  8 00:43:44 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.108, lip=66.85.158.92, session=<deQqemFFKvfG6xhs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 00:44:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<8EzpfGFFwNc+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2025-12-08 00:44:38 dovecot_login authenticator failed for ([59.145.84.169]) [182.95.176.122]:35490: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-08 00:43:56 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (domice) [73.208.81.125]:32888: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-08 00:44:54 dovecot_login authenticator failed for (nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:56114: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec  8 00:47:12 host2 sshd[3109875]: Disconnected from invalid user ansible 92.207.4.157 port 34146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 00:47:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<mDEjh2FFHog+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 00:47:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<VIvhhWFFpIRetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 00:48:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<AsAxjGFFkzNetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 00:50:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<72f8kmFFsIKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 00:50:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<oDkXkWFF/JCl6L5h>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Dec  8 00:50:23 host2 sshd[3112345]: Disconnected from invalid user jacob 92.207.4.157 port 57504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-08 00:50:26 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (unaneocin) [73.144.27.228]:48180: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 00:50:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<foPfk2FFmK4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 00:51:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<YkFdlWFFssKkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 00:51:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<dDJ0lWFFY4JetwuC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 00:51:57 host2 sshd[3113257]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.36
country_id: 3996063
description:
2025-12-08 00:52:10 dovecot_login authenticator failed for (189.219.138.36-clientes-izzi.mx) [189.219.138.36]:58888: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-08 00:52:24 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:54882: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 00:54:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<kIsXoWFFxNkv+1Ve>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-08 00:55:27 dovecot_plain authenticator failed for (grally) [65.20.233.110]:48348: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 00:56:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=</r+dp2FFttQ+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-08 00:57:18 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:41356: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-08 00:57:44 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:57226: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 00:58:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<hq5Pr2FFEI8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 00:58:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<znggsGFF1N68putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 01:01:10 host2 sshd[3119772]: Disconnected from invalid user admin 2.57.121.112 port 41895 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec  8 01:01:29 host2 sshd[3119852]: Disconnected from invalid user ansible 92.207.4.157 port 41272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 01:02:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<IB9VvGFFfpRnpBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.38
country_id: 6252001
description:
Dec  8 01:02:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<pDaYvGFF/NPG6xgm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 01:02:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<cANuvWFFhMI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-12-08 01:03:45 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:54148: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-08 01:04:02 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:38328: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-08 01:05:31 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:54276: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 01:05:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<5XfvyGFFXsk+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-12-08 01:05:20 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:53523: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 01:06:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<+bGhzGFFcN4+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 01:08:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<Vrty02FFBJo+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 01:10:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<JoaF2GFFBqqLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 01:10:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Gmw62mFFOuNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 01:12:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<qF9i4GFFzsY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 01:12:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<jG1O4WFFzq4+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-08 01:12:58 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:60526: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec  8 01:13:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.91, session=<aBA75WFFbf4t4/6b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-08 01:14:42 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:56517: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-08 01:14:53 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:41062: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 01:17:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0Yoi82FFoOA+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec  8 01:17:19 host2 sshd[3132393]: Disconnected from invalid user infocare 42.200.66.164 port 45740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.133.4
country_id: 99237
description:
Dec  8 01:18:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=65.20.133.4, lip=66.85.158.91, TLS, session=<Z+bj9mFF6eFBFIUE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.216.81.126
country_id: 49518
description:
Dec  8 01:19:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=196.216.81.126, lip=66.85.158.91, TLS, session=<LuIl+GFFaJ7E2FF+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-08 01:20:04 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (atory) [174.166.153.20]:59000: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 01:21:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<4u2EAmJFysI+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec  8 01:23:18 host2 sshd[3137159]: Disconnected from invalid user username 42.200.66.164 port 37272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 01:23:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Y+q4CGJFGuQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 01:24:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (hincoles) [87.103.126.54]:53261: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 01:23:57 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (farde) [68.60.77.128]:57634: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.45.177.42
country_id: 3865483
description:
Dec  8 01:25:18 host2 sshd[3138951]: Disconnected from invalid user jacob 181.45.177.42 port 62912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-08 01:25:47 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:3894: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 01:26:50 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.45.177.42
country_id: 3865483
description:
Dec  8 01:27:46 host2 sshd[3140692]: Disconnected from invalid user customer 181.45.177.42 port 55226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 01:26:53 host2 sshd[3139968]: Disconnected from invalid user user 2.57.121.25 port 21589 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-08 01:26:57 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (flants) [68.83.181.181]:50236: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.45.177.42
country_id: 3865483
description:
Dec  8 01:27:19 host2 sshd[3140339]: Disconnected from invalid user telegram 181.45.177.42 port 62999 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-08 01:27:22 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (toloped) [73.224.171.101]:55132: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.45
country_id: 953987
description:
Dec  8 01:29:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.129.54.45, lip=66.85.158.91, TLS, session=<obPSG2JFnYVmgTYt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 01:29:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<l8tKHWJF8uM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.111
country_id: 953987
description:
Dec  8 01:28:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=102.129.60.111, lip=66.85.158.91, TLS, session=<MxGFGmJF0dhmgTxv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-08 01:28:55 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (noniongs) [37.150.8.174]:54965: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.108
country_id: 6252001
description:
Dec  8 01:28:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.108, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hZfNG2JFasrN0h9s>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 01:30:39 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec  8 01:31:35 host2 sshd[3144206]: Disconnected from invalid user polkadot 42.200.66.164 port 53662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.45.177.42
country_id: 3865483
description:
Dec  8 01:31:03 host2 sshd[3143927]: Disconnected from invalid user middleware 181.45.177.42 port 53019 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.122.3
country_id: 3175395
description:
Dec  8 01:31:17 host2 sshd[3144036]: Disconnected from invalid user jenkins 151.37.122.3 port 50577 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 01:31:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<fOSxJGJFhpk+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.77
country_id: 3175395
description:
Dec  8 01:33:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.77, lip=66.85.158.91, TLS, session=<yR9QK2JFtYO5D6tN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec  8 01:32:51 host2 sshd[3145193]: Disconnected from invalid user admin 147.50.227.79 port 50884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.178
country_id: 3469034
description:
Dec  8 01:33:14 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=177.44.71.178, lip=66.85.158.91, TLS, session=<giPqKWJFnJCxLEey>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Dec  8 01:34:01 host2 sshd[3146153]: Disconnected from invalid user ubuntu 42.200.66.164 port 50284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec  8 01:34:13 host2 sshd[3146357]: Disconnected from invalid user jenkins 147.50.227.79 port 34854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-08 01:37:19 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:55376: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-08 01:37:36 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (laral) [73.137.7.97]:36644: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec  8 01:37:37 host2 sshd[3149254]: Disconnected from invalid user ubuntu 103.255.147.244 port 58618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.47
country_id: 6252001
description:
2025-12-08 01:37:10 dovecot_login authenticator failed for ([98.181.46.47]) [98.181.46.47]:55365: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 01:37:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<It0BPGJFeqa8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 01:40:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<cqziRGJFgtiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 01:41:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<26bqR2JFQKSl6L5h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec  8 01:41:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nIpxSWJFP//CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec  8 01:41:51 host2 sshd[3152452]: Disconnected from invalid user devops2025 147.50.227.79 port 37634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 01:42:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@rehanseo.online>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<DFvLS2JFUKhnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 01:42:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<duHZS2JFKtIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 01:42:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<NqXvTGJFQmVetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 01:42:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<IA/3TGJFAtxScUAC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec  8 01:44:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<KmtCU2JFa6ZetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-08 01:47:35 dovecot_plain authenticator failed for (tereweed) [94.201.22.158]:48998: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-12-08 01:48:11 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:50928: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-08 01:48:21 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:56804: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 01:49:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<S/yIZWJFhoakXGTY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec  8 01:49:37 host2 sshd[3159915]: Disconnected from invalid user guest 177.85.247.230 port 19522 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.227.79
country_id: 1605651
description:
Dec  8 01:49:40 host2 sshd[3159930]: Disconnected from invalid user ubuntu 147.50.227.79 port 42222 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec  8 01:49:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, session=<WZ6WY2JFhf/CpRCi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 01:49:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<NEbnZGJFRqqqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-08 01:49:28 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (extul) [98.204.134.124]:44556: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 01:50:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<eDb9Z2JFCL0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 01:52:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ExubcWJFUKGLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.122.3
country_id: 3175395
description:
Dec  8 01:54:16 host2 sshd[3164285]: Disconnected from invalid user username 151.37.122.3 port 50819 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 01:55:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<qhJ5e2JFnsI+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec  8 01:55:58 host2 sshd[3166084]: Disconnected from invalid user moodle 188.166.156.169 port 43030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec  8 01:57:02 host2 sshd[3166873]: Disconnected from invalid user star 188.166.156.169 port 54932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec  8 01:57:07 host2 sshd[3166934]: Disconnected from invalid user infocare 59.98.148.5 port 46306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 01:57:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<0WQ4gmJFZqVnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 01:57:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<tmyQg2JFYqhnpBQq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Dec  8 01:58:03 host2 sshd[3167764]: Disconnected from invalid user oracle 188.166.156.169 port 45000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.122.3
country_id: 3175395
description:
Dec  8 01:58:10 host2 sshd[3167850]: Disconnected from invalid user jacob 151.37.122.3 port 50031 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 01:58:55 host2 sshd[3168373]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 01:59:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<cJIoiGJFhI0+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-08 01:59:24 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:51914: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.84
country_id: 6252001
description:
2025-12-08 01:59:33 dovecot_login authenticator failed for ([70.174.168.84]) [70.174.168.84]:50566: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.232
country_id: 6252001
description:
Dec  8 02:00:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.232, lip=66.85.158.91, session=<6sW2jGJFhJ5HBobo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec  8 02:01:39 host2 sshd[3170727]: Disconnected from invalid user username 59.98.148.5 port 52174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec  8 02:01:55 host2 sshd[3170922]: Disconnected from invalid user postgres 177.85.247.230 port 36282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.0.121.245
country_id: 3469034
description:
Dec  8 02:01:58 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=131.0.121.245, lip=66.85.158.91, TLS, session=<F//QkGJF3rGDAHn1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec  8 02:02:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<GN8ikmJFuotnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.17
country_id: 798544
description:
Dec  8 02:02:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<info>, method=PLAIN, rip=91.236.172.17, lip=66.85.158.91, TLS, session=<Za0PkmJFJxBb7KwR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec  8 02:04:44 host2 sshd[3173825]: Disconnected from invalid user postgres 59.98.148.5 port 58914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 02:07:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<pi80pWJFpoA+PIcp>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  8 02:07:37 host2 sshd[3176298]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-12-08 02:07:46 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:57280: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 02:08:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<LsRwp2JFtI0+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.85.247.230
country_id: 3469034
description:
Dec  8 02:08:34 host2 sshd[3176994]: Disconnected from invalid user infocare 177.85.247.230 port 58260 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-08 02:08:53 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:46203: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-08 02:09:18 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:56035: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 02:09:27 host2 sshd[3177690]: Disconnected from invalid user admin 2.57.121.112 port 42465 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-08 02:10:04 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:33405: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-08 02:10:26 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:58000: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 02:09:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<nHh7rmJFNIw+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.240
country_id: 6252001
description:
Dec  8 02:10:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yB68sWJFu8nN0h/w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec  8 02:11:24 host2 sshd[3179479]: Disconnected from invalid user username 177.85.247.230 port 49660 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.248.167.131
country_id: 2750405
description:
Dec  8 02:12:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=89.248.167.131, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<hpuvtmJF7NVZ+KeD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 02:16:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<rdzixGJF0q1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 02:16:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<tW5lxWJFuKY+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-08 02:17:50 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:40248: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.16
country_id: 6252001
description:
2025-12-08 02:17:34 dovecot_login authenticator failed for ([98.181.44.16]) [98.181.44.16]:57805: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-08 02:17:40 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:57627: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2025-12-08 02:17:44 dovecot_login authenticator failed for ([107.85.14.208]) [107.85.14.208]:51138: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 02:17:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<NRK8ymJFMMWkXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 137.184.42.166
country_id: 6252001
description:
Dec  8 02:17:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=137.184.42.166, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<CXbmymJF8oqJuCqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.244
country_id: 2186224
description:
2025-12-08 02:18:10 dovecot_login authenticator failed for ([121.73.168.244]) [121.73.168.244]:54866: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.102
country_id: 6252001
description:
2025-12-08 02:18:22 dovecot_login authenticator failed for ([70.174.168.102]) [70.174.168.102]:56437: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 02:19:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<w27Cz2JFGtg+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 02:19:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<uVbbz2JFppw+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 02:19:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<p6P70GJFRp8P6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 02:19:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<2l5M0mJFhsBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 02:20:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<8ard02JFNM8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 02:20:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<wrMF1WJF+D+nYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.171.144
country_id: 6252001
description:
2025-12-08 02:20:58 dovecot_login authenticator failed for ([70.174.171.144]) [70.174.171.144]:48824: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 02:23:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<E+ja32JFDq5noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 02:23:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<MlL+32JFgLw+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 02:22:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<tz/T3GJF+IUv7PP+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 02:24:09 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-08 02:24:37 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (secons) [96.230.65.90]:41812: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 02:25:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<etBr5mJFfMPDhTKl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Dec  8 02:25:48 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<Lc0052JFXpysaYAL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 02:26:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<G+QL6WJFDNbANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-08 02:28:27 dovecot_plain authenticator failed for (vietic) [75.97.190.237]:54188: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 02:29:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<OPG38mJFWtc+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.212
country_id: 3469034
description:
Dec  8 02:29:15 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.136.212, lip=66.85.158.91, TLS, session=<Tshe8mJF/Zu+WYjU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.155.15.216
country_id: 130758
description:
Dec  8 02:28:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.155.15.216, lip=66.85.158.91, TLS, session=<l2o08WJFaYu5mw/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 02:31:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<87u1+2JFKNrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 02:32:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Oy9l/2JF7oGuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-08 02:31:58 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (unnidigna) [76.97.155.25]:47026: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-12-08 02:32:00 dovecot_login authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:55992: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-08 02:32:07 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:42256: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 02:33:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<z4XbAGNFdNqeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 02:33:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<op/7AmNFitY+PIds>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 02:34:31 host2 sshd[3199904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 02:35:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<z+04C2NFhsg+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 02:36:08 host2 sshd[3201506]: Disconnected from invalid user user 2.57.121.25 port 18460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-08 02:37:19 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:40593: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-12-08 02:37:43 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:46874: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 02:38:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<HSkgE2NF6rfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 02:39:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<aVimGWNF5qU+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-08 02:41:27 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:55766: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 02:41:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<VN5jH2NFmrQv+1Ve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 02:41:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<E37PH2NFOOaG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 02:41:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<K0YsIGNFss8XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.21
country_id: 6252001
description:
2025-12-08 02:41:46 dovecot_login authenticator failed for ([98.181.44.21]) [98.181.44.21]:41615: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 02:42:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<OlyKImNFUrc+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 02:42:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2oGNJGNFes8v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.174
country_id: 1733045
description:
2025-12-08 02:43:38 dovecot_login authenticator failed for ([49.124.154.174]) [49.124.154.174]:51212: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.45
country_id: 6252001
description:
2025-12-08 02:43:54 dovecot_login authenticator failed for ([98.181.46.45]) [98.181.46.45]:38527: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 02:44:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Gt21KWNFzNdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 02:45:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<2G8aLmNFqoIz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-12-08 02:46:44 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:50796: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-08 02:46:53 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:60588: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 02:47:52 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 02:48:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<RIxTN2NFtKIv/VJZ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 02:51:48 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 02:53:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<likTSmNF/JFn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-08 02:54:02 dovecot_plain authenticator failed for (sabstiance) [24.187.213.29]:34538: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 02:55:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<r06xT2NFHqCiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 02:56:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<aW8iVWNFYs6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 03:00:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6LBlZGNFDrVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 03:02:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<FqmwaWNFnfdScUAC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 03:02:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<lENOamNFsL28putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.252
country_id: 6252001
description:
Dec  8 03:03:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.252, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mkARb2NFe8aTuYT8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-08 03:03:02 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (gralatials) [98.222.93.199]:50036: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 03:03:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<0YaZbWNFrtel6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-08 03:04:24 dovecot_login authenticator failed for ([182.95.20.115]) [182.95.229.142]:47442: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.182.210.26
country_id: 2264397
description:
2025-12-08 03:04:10 dovecot_login authenticator failed for ([168.182.210.26]) [168.182.210.26]:59684: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-08 03:05:13 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (shapocy) [73.197.194.98]:59826: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 03:05:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<lHIWdGNF5qqWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-08 03:05:23 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:39038: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 03:05:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<toKNdmNFbKEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 03:07:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<XZize2NFFpQ+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-08 03:08:49 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:49896: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 03:11:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<1078iWNF/IWkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 03:11:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<F5J8imNFwto+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.111.178
country_id: 1733045
description:
Dec  8 03:11:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=72.60.111.178, lip=66.85.158.91, session=<u1SgimNFPtJIPG+y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 03:12:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<izddjGNFVOMv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-08 03:13:20 dovecot_login authenticator failed for ([182.95.63.50]) [182.95.63.50]:34820: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-08 03:13:32 dovecot_login authenticator failed for (nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:46714: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-12-08 03:13:59 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:57250: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-08 03:16:40 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:57164: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 03:17:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<rLLWoGNF6IOqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 03:18:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<zsebo2NFbKk+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 03:19:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<CTp6pWNForGLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec  8 03:18:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1MP/pGNFJP7CpRCm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 03:21:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<i53trWNFuqY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-08 03:24:52 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:33924: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-08 03:24:59 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:58488: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-12-08 03:25:13 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:50876: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-08 03:25:15 dovecot_login authenticator failed for (static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:50666: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 03:25:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<hi7Ju2NFVoY+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.26
country_id: 1269750
description:
2025-12-08 03:25:27 dovecot_login authenticator failed for ([125.21.69.137]) [122.187.220.26]:60530: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-12-08 03:25:29 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:48075: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 03:26:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<lEd6v2NFWL4+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 03:26:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<jwSJv2NFrtcXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-08 03:26:34 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:50124: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 03:27:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<CFeewmNFfr4+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 03:31:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<MkAX0mNFSrk+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 03:30:57 host2 sshd[3254345]: Disconnected from invalid user admin 2.57.121.112 port 34730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-08 03:32:29 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:38448: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2025-12-08 03:32:10 dovecot_login authenticator failed for ([2.196.202.17]) [2.196.202.17]:56478: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 03:33:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<WSyf12NFLsw+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-08 03:33:55 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (mametical) [174.169.224.27]:59920: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 03:35:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<2tK53mNFFoI+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-08 03:36:48 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:57344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-08 03:37:06 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:42493: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 03:38:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<pREH7GNFyrQrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-08 03:37:53 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (atches) [51.195.117.220]:21645: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-08 03:38:56 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:60247: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 03:40:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=</91t8WNF8Jw+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 03:40:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50790: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-08 03:40:23 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:37756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.98.76
country_id: 1880251
description:
2025-12-08 03:40:39 dovecot_login authenticator failed for ([124.246.98.76]) [124.246.98.76]:56552: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 03:39:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<lVc08GNFqO2kXF7M>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 03:41:09 host2 sshd[3262871]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 03:40:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<N6Pn82NFVqYP6yH0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.99
country_id: 6252001
description:
Dec  8 03:40:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Rp8W9GNF6cyTuYRj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Dec  8 03:42:45 host2 sshd[3264162]: Disconnected from invalid user shared 154.219.125.194 port 38982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec  8 03:43:22 host2 sshd[3264702]: Disconnected from invalid user username 40.83.182.122 port 33926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 03:45:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<R6iqA2RFdMI+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.21.59.41
country_id: 6252001
description:
Dec  8 03:45:11 host2 sshd[3267324]: Disconnected from invalid user ansible 34.21.59.41 port 48416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 03:45:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<uModA2RFTNpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Dec  8 03:46:34 host2 sshd[3269104]: Disconnected from invalid user jeff 154.219.125.194 port 53154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-08 03:45:53 dovecot_plain authenticator failed for (stiolosts) [5.31.15.108]:33020: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec  8 03:45:55 host2 sshd[3268217]: Disconnected from invalid user oct 40.83.182.122 port 54208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 03:46:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<9sADB2RFFswv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 03:46:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<yHpQB2RFSHWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 03:47:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ZzEEDGRFPsE+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 03:46:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<XF9ZCWRFMMfDhTKl>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 154.219.125.194
country_id: 1819730
description:
Dec  8 03:47:03 host2 sshd[3269585]: Received disconnect from 154.219.125.194 port 39636:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.125.194
country_id: 1819730
description:
Dec  8 03:47:03 host2 sshd[3269585]: Disconnected from invalid user controll 154.219.125.194 port 39636 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.63.161.126
country_id: 2510769
description:
2025-12-08 03:48:43 dovecot_login authenticator failed for static-126-161-63-95.ipcom.comunitel.net [95.63.161.126]:54542: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 03:48:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<e56jD2RFkM5noNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-08 03:48:54 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:47341: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 03:49:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<GdwUEWRFLO1n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-08 03:50:00 dovecot_plain authenticator failed for (rationd) [209.173.10.75]:46692: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-08 03:50:26 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (ousible) [73.161.96.107]:53750: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 03:50:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<J83bFmRFgJs+PIcs>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 154.219.125.194
country_id: 1819730
description:
Dec  8 03:51:34 host2 sshd[3273877]: Received disconnect from 154.219.125.194 port 32960:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 03:51:49 host2 sshd[3274049]: Disconnected from invalid user user 2.57.121.25 port 36924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 03:52:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<IbAxHGRFypPD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 03:52:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<YxnEHWRFar+eRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  8 03:52:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<CRSuHmRFNpLANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 03:53:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<l3dEIGRFQpA+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 03:54:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<xm9MJGRF7jSuijvy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 03:53:57 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec  8 03:54:55 host2 sshd[3277365]: Disconnected from invalid user username 40.83.182.122 port 59176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.194
country_id: 1269750
description:
Dec  8 03:56:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=103.51.223.194, lip=66.85.158.91, TLS, session=<GOLrK2RFuMVnM9/C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.160.245
country_id: 99237
description:
Dec  8 03:57:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=65.20.160.245, lip=66.85.158.91, TLS, session=<ysItLWRFVZZBFKD1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec  8 04:00:00 host2 sshd[3282828]: Disconnected from invalid user ubuntu 40.83.182.122 port 38558 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.136
country_id: 6252001
description:
Dec  8 04:01:33 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.136, lip=66.85.158.92, TLS: Connection closed, session=<IR2dPWRFisnHLZqI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-08 04:03:22 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:44064: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 04:03:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<y7lLRGRF+rTO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-08 04:03:53 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:49272: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.3
country_id: 3624060
description:
2025-12-08 04:04:34 dovecot_login authenticator failed for ([186.177.88.3]) [186.177.88.3]:54706: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.83.182.122
country_id: 6252001
description:
Dec  8 04:05:14 host2 sshd[3288657]: Disconnected from invalid user middleware 40.83.182.122 port 58300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-08 04:05:19 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:57732: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 04:05:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<4RMVTGRFUqaG0Wp/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.120.73.136
country_id: 3469034
description:
Dec  8 04:06:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 13 secs): user=<>, rip=187.120.73.136, lip=66.85.158.91, session=<C4NSTmRF7Na7eEmI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.130.197.3
country_id: 798544
description:
Dec  8 04:06:30 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=195.130.197.3, lip=66.85.158.91, TLS, session=<K21hTmRFjtHDgsUD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 04:06:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<qPIEUGRFPeUz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 04:07:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<qTw9UWRFjJMv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 04:08:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<6A4pV2RFrsIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.121
country_id: 732800
description:
Dec  8 04:09:14 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.253.159.121, lip=66.85.158.91, TLS, session=<YS8fWGRF69i5/Z95>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 04:09:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<JYZlWWRFzrtnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.6.168.183
country_id: 3469034
description:
Dec  8 04:09:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.6.168.183, lip=66.85.158.91, TLS, session=<FFteWWRF7c0tBqi3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 04:16:34 host2 sshd[3300594]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-08 04:16:23 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (sultrew) [188.219.104.210]:40087: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 04:17:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<l1U5dWRFDtsv+1Ve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 04:17:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<3PO1dWRFmsWiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 04:17:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<bbBQd2RFOuWPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 04:18:34 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 04:19:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<uP5MfGRFDNM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 04:21:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<pRyrhWRF7uZScUAC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 04:22:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sceast) [87.103.126.54]:6815: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 04:22:29 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 04:22:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ydzaiGRFIp9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 04:24:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<t2+4jmRFTqQ+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-08 04:24:18 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:51407: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 04:26:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<8aRElWRFQqWl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 04:26:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<RlvklmRFsr28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 04:29:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<mVIvomRFErRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-08 04:30:31 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:60053: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 04:30:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<ym9Xo2RFIJA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 04:30:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<7YhopGRFsO0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 04:30:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<QjnGpGRFENGWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-08 04:30:52 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:12079: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-08 04:32:02 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (deimakisau) [98.204.134.124]:50352: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 04:33:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=</N7wsGRFaNo+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 04:33:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<GRCQrmRF/ts+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 04:33:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WqDNrmRFdOY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 04:33:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<5mCzsGRF9LykXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 04:34:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<dwHOsWRFIJ0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 04:36:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<y4aru2RFnIU+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-08 04:38:08 dovecot_plain authenticator failed for (table) [24.187.213.29]:36372: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-08 04:38:08 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (hableers) [68.46.148.180]:60700: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-12-08 04:38:11 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (unchang) [71.229.43.123]:51080: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 04:38:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<0zEKwmRFuLM+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-12-08 04:41:21 dovecot_login authenticator failed for (2-74-194-86.kcell.kz) [2.74.194.86]:57329: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.51.177
country_id: 1168579
description:
2025-12-08 04:41:34 dovecot_login authenticator failed for ([182.184.51.177]) [182.184.51.177]:48918: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 04:43:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<jRJI0mRFOIKLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 04:44:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<5II/1mRFnog+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 04:45:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<SK+l2WRFHtSqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 04:46:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<U72t3GRFPNQ+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-08 04:45:59 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:48949: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-08 04:46:55 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:47504: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 04:46:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<2bPl32RFcuk+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-08 04:47:14 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:2485: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-08 04:48:27 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (acidingual) [144.64.157.244]:57117: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.27
country_id: 798544
description:
Dec  8 04:50:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=178.216.30.27, lip=66.85.158.91, TLS, session=<xs8P6mRFDMOy2B4b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-08 04:50:14 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:37544: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.152
country_id: 798544
description:
Dec  8 04:50:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=128.127.94.152, lip=66.85.158.91, TLS, session=<bC8b62RFjumAf16Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-08 04:50:29 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:46426: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 04:52:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<9EOE8mRFFN0+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.234
country_id: 6252001
description:
Dec  8 04:55:35 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.234, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2HTc/mRFidrG6xjq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 04:56:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (kispian) [87.103.126.54]:29550: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-08 04:56:28 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (maceamily) [73.0.235.30]:45776: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-08 04:57:19 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:38878: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-08 04:57:52 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:40988: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 04:57:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<ybM0B2VFaLg+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.54
country_id: 6252001
description:
Dec  8 04:58:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.54, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UnQuCmVFRdvG6xg2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-08 04:59:58 dovecot_plain authenticator failed for (balious) [23.30.11.253]:54410: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 05:01:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<vyRMFGVFJpM+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 05:02:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<s+w2F2VFitQP6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 05:02:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<5EuVF2VF2IU+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 05:02:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<6ye/FWVF9sOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 05:03:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<qssQGmVFJskrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 05:04:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<yUStHmVFbrk+PIcr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.206.49
country_id: 6251999
description:
Dec  8 05:07:40 host2 pure-ftpd[3356637]: (?@148.113.206.49) [INFO] New connection from 148.113.206.49


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.206.49
country_id: 6251999
description:
Dec  8 05:07:54 host2 pure-ftpd[3356785]: (?@148.113.206.49) [INFO] New connection from 148.113.206.49


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.206.49
country_id: 6251999
description:
Dec  8 05:07:58 host2 pure-ftpd[3356829]: (?@148.113.206.49) [INFO] New connection from 148.113.206.49


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 05:09:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<KiIAMWVFTqTDhTKl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-08 05:17:30 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (teness) [73.213.236.66]:35192: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-08 05:18:51 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:36292: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Dec  8 05:19:29 host2 sshd[3367266]: Disconnected from invalid user middleware 107.173.160.152 port 46486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-08 05:20:51 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:58088: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Dec  8 05:20:50 host2 sshd[3368545]: Disconnected from invalid user tempusr 107.173.160.152 port 40606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-12-08 05:22:42 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:51606: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-08 05:22:51 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:50156: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 05:23:05 host2 sshd[3370364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-08 05:23:16 dovecot_login authenticator failed for (cm-84.213.189.159.get.no) [84.213.189.159]:46541: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-08 05:23:30 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:33587: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.23.5
country_id: 2921044
description:
Dec  8 05:25:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.23.5, lip=66.85.158.91, session=<lYw4aGVFBLmd5hcF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.111.21
country_id: 2921044
description:
Dec  8 05:25:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.89.111.21, lip=66.85.158.91, session=<L9QxaGVFbTafWW8V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-08 05:26:50 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:60518: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-08 05:27:21 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:33964: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 05:28:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Kzb2cmVFY9wz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 05:29:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<uDIUeGVFUpGG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-12-08 05:29:47 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:56444: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 05:29:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<7O7veGVFtI/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-08 05:29:59 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:47151: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 05:29:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<XFBpeWVFgNgv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-08 05:31:28 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:45898: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 05:31:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=</gvrfmVF8os+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-12-08 05:31:41 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:57202: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 05:31:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+MMTgGVFoOkv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 05:35:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<wpRQjWVFZqhnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.144
country_id: 6252001
description:
Dec  8 05:35:51 host2 pure-ftpd[3381365]: (?@147.185.132.144) [INFO] New connection from 147.185.132.144


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 05:37:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<M0Vdk2VFaOs+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-08 05:37:13 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:55887: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-12-08 05:37:32 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:52858: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.144.246.132
country_id: 798544
description:
Dec  8 05:37:36 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.144.246.132, lip=66.85.158.91, TLS, session=<A9YtlGVFzLi5kPaE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.55.226.10
country_id: 798544
description:
Dec  8 05:37:54 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=92.55.226.10, lip=66.85.158.91, TLS, session=<YYM7lWVFC4dcN+IK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 05:39:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<4FC0mmVFvuePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 05:40:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<xNjHnmVFGJqiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 05:41:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<5ejNomVFYOs+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 05:42:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<9An1pWVFNTVScUAC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 05:42:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<g8PTpGVFvu0+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 05:44:13 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (phant) [87.103.126.54]:32370: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.90
country_id: 798544
description:
Dec  8 05:45:09 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=91.232.165.90, lip=66.85.158.91, TLS, session=<U4spr2VFWNlb6KVa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.106.155
country_id: 3686110
description:
Dec  8 05:45:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.96.106.155, lip=66.85.158.91, TLS, session=<1x9IsGVF17C6YGqb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 05:45:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<EbRfsmVFhtM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 05:48:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<03PcumVF0q1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 05:48:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<o2WuvGVFPNo+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 141.95.206.110
country_id: 3017382
description:
Dec  8 05:47:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=141.95.206.110, lip=66.85.158.92, TLS: Connection closed, session=<iiYlumVFOLWNX85u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.21
country_id: 3469034
description:
Dec  8 05:49:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=186.209.250.21, lip=66.85.158.91, TLS, session=<Qxebv2VFeoy60foV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.51
country_id: 1643084
description:
Dec  8 05:50:50 host2 sshd[3393451]: Disconnected from invalid user test 103.49.238.51 port 56328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.102.167
country_id: 798544
description:
Dec  8 05:50:05 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.102.167, lip=66.85.158.91, TLS, session=<ff7MwGVFN5yy22an>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec  8 05:50:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<8O3ewWVFFB+nXpI4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.201
country_id: 3469034
description:
Dec  8 05:51:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=186.209.248.201, lip=66.85.158.91, TLS, session=<7QyexmVF89a60fjJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.134.26
country_id: 99237
description:
Dec  8 05:51:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=65.20.134.26, lip=66.85.158.91, TLS, session=<r4hZxWVFBOtBFIYa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 05:51:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<giOBxmVFGN+8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 05:51:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<rVasxmVFHKel6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 05:51:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<J7+Tx2VF0MI+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-08 05:51:46 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:41115: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-12-08 05:52:27 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:36479: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.1.112
country_id: 2077456
description:
2025-12-08 05:52:00 dovecot_login authenticator failed for ([101.168.1.112]) [101.168.1.112]:58382: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-12-08 05:52:07 dovecot_login authenticator failed for ([82.102.149.88]) [82.102.149.88]:33702: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 05:52:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<5HhEyWVFuoAv+1Ve>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-12-08 05:52:16 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:37017: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-08 05:52:15 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:56918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 05:52:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<yDYDymVF3owXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.1.44
country_id: 2077456
description:
2025-12-08 05:52:51 dovecot_login authenticator failed for ([120.157.1.44]) [120.157.1.44]:37848: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-08 05:53:24 dovecot_plain authenticator failed for (hydroaddle) [41.248.243.181]:35406: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-08 05:53:24 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:42942: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-08 05:53:27 dovecot_plain authenticator failed for (untae) [65.20.184.80]:34034: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 05:54:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<NauL0mVFUrIv/lVz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 05:54:32 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.153
country_id: 3469034
description:
Dec  8 05:54:43 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=186.209.248.153, lip=66.85.158.91, TLS, session=<cQ4s0WVFSOa60fiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.192
country_id: 690791
description:
Dec  8 05:55:07 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=37.221.147.192, lip=66.85.158.91, TLS, session=<pnCF0mVFaJUl3ZPA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 05:55:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<wFNH1GVFCOJn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 05:56:39 dovecot_plain authenticator failed for (unchly) [154.144.243.93]:42938: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 05:56:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<J7xr2WVFvrWkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 05:55:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<8cXB1mVF4q2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 05:56:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0bLu2WVFrsov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 05:57:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<MLON22VF+Io+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.241
country_id: 1733045
description:
2025-12-08 05:57:47 dovecot_login authenticator failed for ([49.124.152.241]) [49.124.152.241]:38426: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 05:58:28 host2 sshd[3400015]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 05:59:07 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 05:59:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<PPlC5GVFUpk+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 05:59:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<ZN6E5GVFbqU+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.51
country_id: 1643084
description:
Dec  8 06:01:48 host2 sshd[3402762]: Disconnected from invalid user sales07 103.49.238.51 port 50880 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.51
country_id: 1643084
description:
Dec  8 06:04:18 host2 sshd[3404636]: Disconnected from invalid user moodle 103.49.238.51 port 55662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 06:05:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WINE92VFwOs+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-12-08 06:05:40 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:42251: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-08 06:06:08 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:45207: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 06:08:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<QWegAmZFZIaLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.82
country_id: 3469034
description:
Dec  8 06:09:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.120.72.82, lip=66.85.158.91, TLS, session=<3N5BB2ZFBai7eEhS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.175
country_id: 690791
description:
Dec  8 06:09:18 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=194.44.140.175, lip=66.85.158.91, TLS, session=<StZ5BWZFIb/CLIyv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 06:11:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<8banDWZFAJ4+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-08 06:12:48 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:48702: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.209.9.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 74.209.9.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-08 06:21:49 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (mantimin) [71.62.34.216]:59638: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec  8 06:22:46 host2 sshd[3418164]: Disconnected from invalid user postgres 34.91.0.68 port 48922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-08 06:21:53 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (postal) [76.97.155.25]:43546: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-08 06:21:56 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (brapus) [174.169.224.27]:53916: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 06:24:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<nxtIPGZFzrGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.217
country_id: 3469034
description:
Dec  8 06:26:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=138.255.206.217, lip=66.85.158.91, TLS, session=<DtcOQmZFSMyK/87Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 06:26:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<G4RTRGZFqs8P6yH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.252
country_id: 3077311
description:
Dec  8 06:25:54 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=85.163.38.252, lip=66.85.158.91, TLS, session=<hKfqQGZFYpxVoyb8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 06:28:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<m70MS2ZFPOIrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 06:29:22 host2 sshd[3422898]: Disconnected from invalid user user 2.57.121.25 port 49791 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.127.192
country_id: 2921044
description:
Dec  8 06:31:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.65.127.192, lip=66.85.158.91, TLS, session=<PYD2VGZFZP+fQX/A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-08 06:31:42 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:51644: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-12-08 06:31:55 dovecot_login authenticator failed for (syn-097-070-129-101.res.spectrum.com) [97.70.129.101]:36960: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.21
country_id: 6252001
description:
Dec  8 06:33:40 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.21, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<g82uXWZF4NCTuYQV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 06:32:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<K4PvWmZFzJHDhTKl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-08 06:34:27 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:55092: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-08 06:34:49 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:62656: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 06:35:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<SXL1ZGZFwNCeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 06:36:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sgZXZ2ZFlO0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 06:37:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<f1zYaWZFpDenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 06:37:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<oMUiamZFrqfD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 06:37:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BHuKbGZFYqBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec  8 06:39:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<E1atcWZFHLSuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-08 06:39:32 dovecot_plain authenticator failed for (culprear) [102.53.15.56]:51322: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-08 06:39:43 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:57714: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-08 06:40:05 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:50273: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 06:40:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<QE1edGZFdJpnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-08 06:40:56 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:50472: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 06:41:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7bq+eWZFCo1n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Dec  8 06:42:24 host2 sshd[3432670]: Disconnected from invalid user dinahosting 103.154.77.48 port 43508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec  8 06:42:02 host2 sshd[3432459]: Disconnected from invalid user gnats 34.91.0.68 port 46472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.15.139
country_id: 6252001
description:
Dec  8 06:43:03 host2 sshd[3433087]: Disconnected from invalid user postgres 107.172.15.139 port 59586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-08 06:44:08 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:3134: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 06:44:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<BIvNg2ZF9Jc+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 06:44:56 host2 sshd[3434360]: Disconnected from invalid user admin 2.57.121.112 port 24321 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-08 06:45:49 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:56752: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-08 06:48:53 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:60406: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 06:49:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<jawdlmZFkK0+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec  8 06:49:33 host2 sshd[3437577]: Disconnected from invalid user infocare 34.91.0.68 port 56502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-08 06:49:39 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:41275: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-08 06:49:42 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:52116: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.100.195
country_id: 6252001
description:
Dec  8 06:49:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=74.235.100.195, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WyeylGZFEuVK62TD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  8 06:50:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<IYGTmmZFRdoz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Dec  8 06:51:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<RyfJnWZF8Oov/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 06:51:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<hg7om2ZFFow+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.235
country_id: 953987
description:
Dec  8 06:52:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=102.64.41.235, lip=66.85.158.91, TLS, session=<234toWZFcuxmQCnr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.144
country_id: 1269750
description:
Dec  8 06:53:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=103.213.195.144, lip=66.85.158.91, TLS, session=<05GComZFybBn1cOQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Dec  8 06:53:30 host2 sshd[3440288]: Disconnected from invalid user perp 152.32.189.21 port 54404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.81.125
country_id: 597427
description:
Dec  8 06:54:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=69.62.81.125, lip=66.85.158.91, session=<4km0pmZFlL5FPlF9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 06:54:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<Avrfp2ZFXtk+PIcp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.189.21
country_id: 1819730
description:
Dec  8 06:56:01 host2 sshd[3442391]: Disconnected from invalid user airbnb2024 152.32.189.21 port 56534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 06:56:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<gLsjrmZFPoGG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 06:57:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ToBmsWZF5ssv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 06:56:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<bqGKsGZF/NfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 06:58:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<1LBRt2ZFGpI+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-08 07:00:24 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:43984: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.117.94
country_id: 2510769
description:
2025-12-08 07:00:35 dovecot_login authenticator failed for ([46.35.117.94]) [46.35.117.94]:43250: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-08 07:00:12 dovecot_login authenticator failed for ([115.240.6.56]) [49.37.32.248]:33832: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-08 07:00:24 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:51450: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-08 07:00:50 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:43612: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 06:59:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<B/p9u2ZFgMM+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-08 07:00:04 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:51766: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Dec  8 07:01:12 host2 sshd[3445809]: Disconnected from invalid user jenkins 103.154.77.48 port 46144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 07:01:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<wBmOwGZFFo0+PIcl>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[60640] [Authentication Database]=[system] [Username]=[2stravel] (10/10 failures) (blocked until [Tue Dec  9 01:31:35 2025 UTC/Tue Dec  9 07:01:35 2025 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 07:01:35 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 07:01:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<pVuNwmZFhp1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 07:01:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<s1aCwmZFgKqPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Dec  8 07:03:08 host2 sshd[3447079]: Disconnected from invalid user jenkins 152.32.189.21 port 55716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 07:03:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<ukK2yGZFHp4+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 07:04:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<sCmLymZF8NeiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.76
country_id: 1269750
description:
2025-12-08 07:05:20 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.76]:44432: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Dec  8 07:05:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<5QOBz2ZFXqpQUk2L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-08 07:05:41 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:51515: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Dec  8 07:05:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 26 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, TLS: Connection closed, session=<l8D80GZFHqhQUk2L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.113.64.2
country_id: 2635167
description:
Dec  8 07:06:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=82.113.64.2, lip=66.85.158.91, session=<vwBp0WZFHTtScUAC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Dec  8 07:07:49 host2 sshd[3449890]: Disconnected from invalid user operations 152.32.189.21 port 50416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-08 07:08:11 dovecot_login authenticator failed for (nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:60974: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-08 07:09:17 dovecot_login authenticator failed for 14-0-142-131.static.pccw-hkt.com [14.0.142.131]:56151: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-08 07:09:27 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:39730: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 07:10:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<CGor4mZF9sc+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-08 07:10:48 dovecot_login authenticator failed for ([182.95.178.158]) [182.95.178.158]:48948: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.26.164
country_id: 294640
description:
2025-12-08 07:11:01 dovecot_login authenticator failed for ([95.35.26.164]) [95.35.26.164]:34642: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 07:12:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<U/v36GZFmNg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.201.229.165
country_id: 3469034
description:
Dec  8 07:12:49 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=128.201.229.165, lip=66.85.158.91, TLS, session=<ZsqY6GZF8qeAyeWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.171
country_id: 6290252
description:
Dec  8 07:13:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts2>, method=PLAIN, rip=109.207.35.171, lip=66.85.158.91, TLS, session=<OMS66WZF/85tzyOr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.57.26
country_id: 6252001
description:
Dec  8 07:13:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.221.57.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oaWW6mZFousU3Tka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.66
country_id: 933860
description:
Dec  8 07:13:58 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=41.216.209.66, lip=66.85.158.91, TLS, session=<16yg7GZFxegp2NFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 07:14:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<NOz+7WZFWJM+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.251
country_id: 953987
description:
Dec  8 07:14:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=102.64.32.251, lip=66.85.158.91, TLS, session=<4Xf57WZFYc5mQCD7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 07:14:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=</WA072ZF0pVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-08 07:15:49 dovecot_plain authenticator failed for (vagnicary) [149.62.239.4]:40618: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 07:15:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<4O8+9GZFjLWl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 07:16:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<u+vK9mZFtOm8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-08 07:17:44 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:50774: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.241.107
country_id: 3144096
description:
2025-12-08 07:18:10 dovecot_login authenticator failed for (cm-178.232.241.107.get.no) [178.232.241.107]:38422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 07:17:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Idnb+2ZF7M8+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-08 07:19:25 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:42161: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-08 07:19:44 dovecot_login authenticator failed for ([128.185.13.33]) [122.184.123.118]:37332: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 07:20:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2O6YBGdFDokv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 07:19:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<nUXqAmdFJrekXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 07:20:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yCpLBGdFtocv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 07:21:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<j9yeCGdFRJpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 07:22:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<6n9fCmdFsJGWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 07:22:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57458: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 07:23:42 host2 sshd[3461483]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 07:24:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<Z29cE2dF4rA+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 07:24:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<xDu3E2dFqpkv+1Ve>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 07:25:06 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 07:26:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<PBpYG2dFyKU+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 07:27:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<9BAAH2dFFIY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 07:28:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<WEi4IWdFlJ0+PIcs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 07:28:40 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 07:32:27 host2 sshd[3467596]: Disconnected from invalid user user 2.57.121.25 port 18844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-08 07:31:59 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (bitra) [71.235.225.181]:38790: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 07:34:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<7eTONWdFVumLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-08 07:34:16 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (hoidice) [174.161.27.82]:58270: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.29
country_id: 6252001
description:
Dec  8 07:34:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.29, lip=66.85.158.92, session=<pSyINmdFGzJAPsUd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec  8 07:34:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, TLS: Connection closed, session=<bQNAN2dFrt9APsUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 07:39:42 dovecot_plain authenticator failed for (pactoriane) [154.144.243.93]:56860: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-12-08 07:40:59 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:15776: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-08 07:41:08 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:60471: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec  8 07:41:19 host2 sshd[3473361]: Disconnected from invalid user tempusr 107.150.110.167 port 23496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.87.127
country_id: 3469034
description:
Dec  8 07:41:26 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.106.87.127, lip=66.85.158.91, TLS, session=<lhrxTmdF1o+zald/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.47
country_id: 1269750
description:
Dec  8 07:41:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=202.136.85.47, lip=66.85.158.91, TLS, session=<lbslUGdFE8PKiFUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-08 07:42:20 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (varte) [96.230.65.90]:60296: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 07:42:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<wW7AVGdFeN2qQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-08 07:42:55 dovecot_login authenticator failed for ([77.89.143.122]) [77.89.143.122]:44066: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.240.154
country_id: 1269750
description:
2025-12-08 07:43:15 dovecot_login authenticator failed for (static-154.240.195.14-tataidc.co.in) [14.195.240.154]:57096: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-08 07:43:47 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (aukine) [144.64.157.244]:33885: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.110.167
country_id: 6252001
description:
Dec  8 07:44:34 host2 sshd[3475509]: Disconnected from invalid user moodle 107.150.110.167 port 49058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-08 07:45:53 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:58339: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec  8 07:46:46 host2 sshd[3477469]: Disconnected from invalid user ftp2025 107.150.110.167 port 47770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-08 07:46:17 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:44796: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-08 07:46:22 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:53981: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-12-08 07:46:38 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:39939: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 07:46:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<45aMY2dFIN6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 07:47:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<YBdZZWdFBucXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 07:48:39 host2 sshd[3478842]: Disconnected from invalid user user 2.57.121.25 port 52965 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-08 07:48:58 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (crous) [68.83.181.181]:49458: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-08 07:49:02 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:42660: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-08 07:49:09 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:34058: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-08 07:50:36 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:57038: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-12-08 07:50:38 dovecot_login authenticator failed for h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:47698: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.208
country_id: 1733045
description:
2025-12-08 07:50:14 dovecot_login authenticator failed for ([49.124.149.208]) [49.124.149.208]:37554: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 15.235.33.244
country_id: 6251999
description:
Dec  8 07:50:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=15.235.33.244, lip=66.85.158.91, session=<E+cmcGdF6KAP6yH0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.65.97.67
country_id: 3469034
description:
Dec  8 07:51:51 host2 sshd[3481331]: Disconnected from invalid user jacob 177.65.97.67 port 46122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.247
country_id: 6252001
description:
2025-12-08 07:54:05 dovecot_login authenticator failed for wsip-184-191-242-247.fv.ks.cox.net [184.191.242.247]:58483: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-08 07:54:24 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:58099: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 07:54:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<DI6ofmdFdpIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.133.50.165
country_id: 2017370
description:
Dec  8 07:56:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=195.133.50.165, lip=66.85.158.91, session=<gLNRhmdF7OjDhTKl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 07:57:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<W/kMiGdFArM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 07:57:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<ZjD9h2dFFIU+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-08 07:57:10 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:52354: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-08 07:57:15 dovecot_plain authenticator failed for (untron) [88.149.153.106]:47920: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2025-12-08 07:57:25 dovecot_login authenticator failed for ([103.57.224.221]) [103.57.224.221]:41625: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Dec  8 07:58:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<FxuBi2dFZICeRdvj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec  8 07:59:29 host2 pure-ftpd[3486835]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.209.39
country_id: 1819730
description:
Dec  8 08:00:39 host2 pure-ftpd[3487873]: (?@123.58.209.39) [INFO] New connection from 123.58.209.39


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 08:00:47 host2 sshd[3487915]: Disconnected from invalid user admin 2.57.121.112 port 52137 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 08:00:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ZRiEkmdFSMDD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-08 08:00:34 dovecot_plain authenticator failed for (detate) [24.93.140.162]:58588: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 08:01:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<11f7mGdFYMcv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-08 08:02:24 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:36900: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  8 08:02:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<KTEgm2dF7OynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-08 08:02:31 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:34472: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-12-08 08:03:32 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:44938: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 08:03:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<gngEoGdFrttn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.88.152.183
country_id: 3508796
description:
2025-12-08 08:02:53 dovecot_login authenticator failed for tdev152-183.codetel.net.do [200.88.152.183]:45550: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.24
country_id: 6252001
description:
Dec  8 08:04:27 host2 pure-ftpd[3490648]: (?@147.185.132.24) [INFO] New connection from 147.185.132.24


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 08:05:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<jXCspGdFBqE+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-08 08:06:56 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (plove) [24.127.53.61]:45132: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 08:07:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<PKRmrGdFkIw+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 08:07:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<nr2LrGdFRMNnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 08:07:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<uzlFrWdFRLhn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec  8 08:08:09 host2 sshd[3492718]: Disconnected from invalid user infocare 162.240.39.179 port 48102 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-08 08:07:58 dovecot_plain authenticator failed for (unlebe) [92.62.243.174]:54999: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 08:10:11 host2 sshd[3494140]: Disconnected from invalid user admin 2.57.121.112 port 36125 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 08:11:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0Ysyu2dF+Jw+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec  8 08:12:34 host2 sshd[3495532]: Disconnected from invalid user admin 181.212.81.228 port 36336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-12-08 08:12:37 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:39534: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec  8 08:17:55 host2 sshd[3499395]: Disconnected from invalid user user 181.212.81.228 port 59148 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 08:20:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<NuvG3GdFKpqG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.81.125
country_id: 597427
description:
Dec  8 08:21:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=69.62.81.125, lip=66.85.158.91, session=<a+EM32dFJqNFPlF9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.78.29.97
country_id: 2802361
description:
Dec  8 08:22:24 host2 sshd[3502061]: Disconnected from invalid user oracle 34.78.29.97 port 45768 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 08:22:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<9CxO5GdFjI4v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 08:23:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<pn0I6GdFAoHO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 08:24:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<KWjI6GdF9qg+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 08:24:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pAzL6GdFGt6PbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 08:24:37 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 08:25:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<7VuU7GdF3NA+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.65.97.67
country_id: 3469034
description:
Dec  8 08:25:45 host2 sshd[3504703]: Disconnected from invalid user oracle 177.65.97.67 port 41380 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.116
country_id: 6252001
description:
Dec  8 08:26:30 host2 pure-ftpd[3505367]: (?@66.240.236.116) [INFO] New connection from 66.240.236.116


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.116
country_id: 6252001
description:
Dec  8 08:27:52 host2 pure-ftpd[3506635]: (?@66.240.236.116) [INFO] New connection from 66.240.236.116


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 08:28:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<k9N+9mdF0oBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 08:28:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<Wm5G92dFFJGiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 08:28:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<MOfD+WdFSqs+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.19.163.70
country_id: 1269750
description:
Dec  8 08:30:58 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<training@v-deploy.com>, method=PLAIN, rip=125.19.163.70, lip=66.85.158.91, TLS, session=<mLz1AGhFsut9E6NG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 08:30:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ERg9/2dFBIw+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-08 08:33:45 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:42409: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.78.29.97
country_id: 2802361
description:
Dec  8 08:34:15 host2 sshd[3510773]: Disconnected from invalid user user 34.78.29.97 port 33560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.153
country_id: 6252001
description:
2025-12-08 08:34:26 dovecot_login authenticator failed for ([70.174.167.153]) [70.174.167.153]:58224: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-08 08:37:20 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (genting) [68.46.148.180]:58874: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-08 08:37:12 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:45616: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-08 08:37:27 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:34056: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 08:38:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<AmcMG2hF3pI+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-08 08:38:55 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (croater) [98.204.134.124]:49950: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 08:39:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<nqv3HWhF/p0+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 08:38:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=</Gg7HGhFnqA+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 08:40:16 host2 sshd[3515286]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 08:40:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<YGnxIWhF5tel6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 08:40:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<hDynI2hFgqY+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 08:41:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<N6OBJ2hFtsO8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-08 08:41:58 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (extrac) [68.83.181.181]:43220: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 08:42:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<FfTpKmhFXptn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 08:43:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Wn6ILmhFHrkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec  8 08:43:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<us/OLmhFgOekXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.41
country_id: 798544
description:
Dec  8 08:44:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=109.125.248.41, lip=66.85.158.91, TLS, session=<iiR7MWhFjcZtffgp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:44:56 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<UHEcM2hF2q8DlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:44:57 host2 dovecot[2208013]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<dC0jM2hF1IkDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.250.47.39
country_id: 3469034
description:
Dec  8 08:45:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=167.250.47.39, lip=66.85.158.91, TLS, session=<m62UMmhFe7Wn+i8n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:45:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<2ovMNGhFtMMDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:45:24 host2 dovecot[2208013]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<FdzGNGhFpsMDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 08:46:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<aFJ5OGhF2uAv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec  8 08:47:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<+lNyPGhF5tKWXx+e>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 08:48:48 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 08:50:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tKuNRWhFTpxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 08:50:47 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (brocy) [68.60.77.128]:40740: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 08:51:35 host2 sshd[3525472]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 08:52:56 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  8 08:53:24 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<skZlUWhFrqYDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-12-08 08:53:24 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:44754: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.85.94
country_id: 6252001
description:
Dec  8 08:56:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.251.85.94, lip=66.85.158.91, session=<0XxyXGhFvuMv+1Ve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec  8 09:00:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<iXMLbGhFLLyLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-08 09:01:06 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:40070: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.154.211
country_id: 1861060
description:
2025-12-08 09:01:31 dovecot_login authenticator failed for p83212-obmd01.osaka.ocn.ne.jp [180.7.154.211]:55418: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-08 09:01:40 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:50418: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 220.247.223.56
country_id: 1227603
description:
Dec  8 09:03:16 host2 sshd[3533986]: Disconnected from invalid user middleware 220.247.223.56 port 58114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec  8 09:02:33 host2 sshd[3532947]: Disconnected from invalid user aptproxy 190.129.122.12 port 1287 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.25.120
country_id: 933860
description:
Dec  8 09:03:43 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=83.143.25.120, lip=66.85.158.91, TLS, session=<72USdWhFY5NTjxl4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.48
country_id: 933860
description:
Dec  8 09:04:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.213.48, lip=66.85.158.91, TLS, session=<LDtsdmhFLZ0p2NUw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 09:04:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<C34keWhFqtA+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Dec  8 09:06:52 host2 sshd[3536184]: Disconnected from invalid user user 220.247.223.56 port 50588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Dec  8 09:09:20 host2 sshd[3537623]: Disconnected from invalid user aptproxy 220.247.223.56 port 45580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.90.150
country_id: 3469034
description:
Dec  8 09:09:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=177.22.90.150, lip=66.85.158.91, TLS, session=<5xVQi2hFrLKxFlqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.197.253
country_id: 2510769
description:
Dec  8 09:10:14 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.135.197.253, lip=66.85.158.91, TLS, session=<otuDjGhFiMQth8X9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  8 09:09:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<joB3imhFhLCkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 09:09:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<f3RIi2hFbuM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 09:12:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<my47lGhFBteqQMFo>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:13 host2 sshd[3539801]: Disconnecting authenticating user root 185.188.217.121 port 52852: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:13 host2 sshd[3539801]: error: maximum authentication attempts exceeded for root from 185.188.217.121 port 52852 ssh2 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:24 host2 sshd[3539955]: error: maximum authentication attempts exceeded for root from 185.188.217.121 port 58276 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:37 host2 sshd[3540085]: Disconnecting invalid user admin 185.188.217.121 port 36594: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 185.188.217.121
country_id: 783754
description:
Dec  8 09:12:24 host2 sshd[3539955]: Disconnecting authenticating user root 185.188.217.121 port 58276: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.34
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.8.225.34 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-08 09:13:42 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:41423: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-12-08 09:13:57 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:51586: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-08 09:13:24 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:48500: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.34
country_id: 1643084
description:
Dec  8 09:13:31 host2 sshd[3540624]: Invalid user cloudtourssrilan_travel from 182.8.225.34 port 11822


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-08 09:14:34 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:44226: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-08 09:14:49 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:48734: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-08 09:17:07 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:38700: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Dec  8 09:19:05 host2 sshd[3544296]: Disconnected from invalid user user 162.241.127.152 port 38536 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 09:19:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<57zCrWhFDOg+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec  8 09:19:41 host2 sshd[3544652]: Disconnected from invalid user app 190.129.122.12 port 17212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 09:20:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<uhO0sGhFSsQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  8 09:20:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<a7gas2hFfrIrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-08 09:20:48 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (funistwake) [73.161.96.107]:60100: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.68.54.105
country_id: 3017382
description:
Dec  8 09:22:40 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.68.54.105, lip=66.85.158.91, session=<DVgJumhFuZEzRDZp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 09:22:55 host2 sshd[3546723]: Disconnected from invalid user admin 2.57.121.112 port 45599 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.242
country_id: 6252001
description:
Dec  8 09:23:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.242, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wdcWvGhFpsaTuYTy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  8 09:23:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<M2lavWhFioHD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 09:23:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<AIBovmhFgLA+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec  8 09:23:59 host2 sshd[3547504]: Disconnected from invalid user ubuntu 172.191.157.64 port 40892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.242
country_id: 6252001
description:
Dec  8 09:24:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.132.242, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<lBRnv2hFavmTuYTy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 09:26:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<sKjXxWhFduM+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec  8 09:27:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<+jdnymhF8qIv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-08 09:28:17 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (unnerribia) [174.169.224.27]:51646: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 09:27:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<HamXy2hFmLc+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 09:27:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<m20tzGhFppY+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.242
country_id: 6252001
description:
Dec  8 09:28:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.242, lip=66.85.158.92, TLS, session=<lWuV0GhFAv2TuYTy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.234
country_id: 6252001
description:
2025-12-08 09:30:08 dovecot_login authenticator failed for wsip-184-191-242-234.fv.ks.cox.net [184.191.242.234]:60805: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-08 09:30:14 dovecot_login authenticator failed for ([103.186.193.149]) [103.186.193.149]:57502: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-08 09:30:25 dovecot_login authenticator failed for ([78.156.6.163]) [78.156.6.163]:58632: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-08 09:30:28 dovecot_login authenticator failed for ([182.95.228.110]) [182.95.228.110]:42898: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-08 09:30:35 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:43283: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.192.195.122
country_id: 6252001
description:
2025-12-08 09:30:24 dovecot_login authenticator failed for ([72.192.195.122]) [72.192.195.122]:37883: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.65.144.89
country_id: 6252001
description:
2025-12-08 09:31:57 dovecot_plain authenticator failed for ([89.116.164.85]) [99.65.144.89]:59914: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-08 09:32:21 dovecot_plain authenticator failed for (macts) [65.20.149.93]:40273: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.110.128.117
country_id: 3865483
description:
2025-12-08 09:31:45 dovecot_plain authenticator failed for ([89.116.164.85]) [181.110.128.117]:50376: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-12-08 09:34:24 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:63890: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  8 09:34:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<kf9l5GhFfOdnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-08 09:34:40 dovecot_login authenticator failed for (nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:46558: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 09:34:52 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ztOH5WhFYtJn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.157.64
country_id: 6252001
description:
Dec  8 09:36:22 host2 sshd[3556329]: Disconnected from invalid user moodle 172.191.157.64 port 45442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 09:37:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ICjs7mhFhJg+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 09:37:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<NET472hF4r8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.164.150.218
country_id: 1269750
description:
Dec  8 09:37:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=194.164.150.218, lip=66.85.158.91, session=<UyAU8GhFIrPCpJba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec  8 09:38:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ZPxP82hFtJ1n9M4G>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.183.155.132
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.183.155.132 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.116.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.151.116.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.33.117.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.33.117.80 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.177.116.42
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.177.116.42 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.45.80.159
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.45.80.159 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.6
country_id: 3703430
description:
Dec  8 09:42:09 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.6, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<FAq2/2hFkfot4/4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec  8 09:42:33 host2 sshd[3560080]: Disconnected from invalid user user 172.191.157.64 port 58104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 09:43:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<MubDAmlFApY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 09:44:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<L5RrB2lFWIA+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-08 09:43:36 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (derpal) [68.40.189.43]:49670: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 09:45:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=</iUgDWlFCOCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec  8 09:46:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<JluzDmlFyp2G0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.252
country_id: 3469034
description:
Dec  8 09:47:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.183.92.252, lip=66.85.158.91, TLS, session=<kGZmE2lFhustt1z8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.249.18
country_id: 3469034
description:
Dec  8 09:47:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=170.245.249.18, lip=66.85.158.91, TLS, session=<MHA9EmlFxLaq9fkS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-08 09:49:03 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (fecruroph) [24.23.125.83]:48716: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 09:49:07 dovecot_plain authenticator failed for (pergic) [154.144.243.93]:42122: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 09:48:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<pKCWFmlFGLMv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 09:50:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<hcj8HGlFqK4+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 09:50:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<9ACNHWlFlK4+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  8 09:51:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Ea3kIWlFjIvO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 09:52:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Fi//JGlFhqc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 09:52:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<r1TxJGlFQqo+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  8 09:52:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<TGKxJWlFJsCiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-08 09:53:02 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (chnon) [24.127.53.61]:60730: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 09:53:25 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (semes) [87.103.126.54]:3156: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  8 09:54:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qh5YLGlFUORnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.29
country_id: 3469034
description:
Dec  8 09:55:30 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=191.53.131.29, lip=66.85.158.91, TLS, session=<+2dZLmlFP9+/NYMd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.65.239.60
country_id: 3469034
description:
Dec  8 09:55:50 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.65.239.60, lip=66.85.158.91, TLS, session=<iTieL2lFZ4UtQe88>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.206.192.194
country_id: 6252001
description:
[2025-12-08 09:56:58 +0530] info [whostmgrd] 162.206.192.194 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.14.175.134
country_id: 6252001
description:
[2025-12-08 09:56:59 +0530] info [cpaneld] 24.14.175.134 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-08 09:56:28 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:60464: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.215.229.166
country_id: 6252001
description:
[2025-12-08 09:56:46 +0530] info [cpaneld] 66.215.229.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-12-08 09:56:50 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:37051: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.94.155
country_id: 6252001
description:
[2025-12-08 09:56:53 +0530] info [cpaneld] 76.39.94.155 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.20.76.251
country_id: 6252001
description:
[2025-12-08 09:57:02 +0530] info [cpaneld] 99.20.76.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.176.51
country_id: 6252001
description:
[2025-12-08 09:56:44 +0530] info [cpaneld] 76.33.176.51 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-12-08 09:56:46 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:38670: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-08 09:57:53 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (caccuffes) [73.183.74.177]:53922: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Dec  8 09:59:00 host2 sshd[3573907]: Disconnected from invalid user kubernetes 103.187.147.92 port 39968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-08 10:01:07 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:58652: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-08 10:01:20 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:49294: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-08 10:02:04 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:34508: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-08 10:02:21 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:47934: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.92
country_id: 1643084
description:
Dec  8 10:03:46 host2 sshd[3578096]: Disconnected from invalid user oc 103.187.147.92 port 56760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec  8 10:04:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<zYMoUGlFyIql6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  8 10:06:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<CSTCVWlFPJe8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Dec  8 10:06:17 host2 sshd[3580191]: Disconnected from invalid user tempusr 103.157.25.60 port 45186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec  8 10:07:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VE1QWWlFMOEv+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.131.111.139
country_id: 2750405
description:
[2025-12-08 10:07:21 +0530] info [webmaild] 45.131.111.139 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.13
country_id: 1819730
description:
Dec  8 10:10:05 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.13, lip=66.85.158.91, TLS, session=<9euhY2lFbhEtjpoN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.190.163.64
country_id: 1694008
description:
2025-12-08 10:09:24 dovecot_plain authenticator failed for ([89.116.164.85]) [180.190.163.64]:42434: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.230.57.87
country_id: 6252001
description:
2025-12-08 10:09:36 dovecot_plain authenticator failed for 76-230-57-87.lightspeed.livnmi.sbcglobal.net ([89.116.164.85]) [76.230.57.87]:51267: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec  8 10:09:45 host2 sshd[3582489]: Disconnected from invalid user ansible 103.210.22.105 port 43398 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:11:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hVh+Z2lFnqADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:11:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<p2gJaWlFIOsDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 10:12:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<fj3OamlFJJQ+PIdr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 10:16:38 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:17:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<0u81fmlFDsMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:18:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<O7JwgGlFXo4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-08 10:19:43 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:58204: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-08 10:19:16 dovecot_login authenticator failed for ([88.255.189.21]) [88.255.189.21]:40612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-08 10:19:21 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:54054: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec  8 10:19:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<hysvhWlFBp1ChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-08 10:19:34 dovecot_login authenticator failed for ([102.38.3.109]) [102.38.3.109]:52129: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:20:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hwZRh2lFVuQDg9cm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 10:20:34 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-08 10:21:30 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:46394: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:21:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oBYTjWlFep0Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-08 10:21:12 dovecot_login authenticator failed for ([182.95.58.130]) [182.95.58.130]:32776: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Dec  8 10:22:19 host2 sshd[3592448]: Disconnected from invalid user user 103.157.25.60 port 57704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 10:22:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<2BUGkGlFPJM+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  8 10:22:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<UZ9akGlFDMIDg9cm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 10:22:50 host2 sshd[3592717]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.105
country_id: 1880251
description:
Dec  8 10:23:14 host2 sshd[3592986]: Disconnected from invalid user username 103.210.22.105 port 37690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec  8 10:26:24 host2 sshd[3594884]: Disconnected from invalid user tempusr 36.37.122.175 port 44222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-08 10:27:20 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:40050: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-08 10:27:31 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:52270: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-08 10:27:40 dovecot_login authenticator failed for (nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:45638: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-08 10:26:58 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:54780: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 10:27:54 host2 sshd[3595862]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.98
country_id: 6252001
description:
2025-12-08 10:28:04 dovecot_login authenticator failed for ([70.174.168.98]) [70.174.168.98]:57926: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec  8 10:28:12 host2 sshd[3596084]: Disconnected from invalid user strategy 103.210.22.105 port 49222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 10:33:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<TKxRtmlFPI4+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 10:33:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<JDmit2lF2t8+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec  8 10:35:34 host2 sshd[3601253]: Disconnected from invalid user username 103.210.22.105 port 54664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-08 10:35:39 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:47624: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.9
country_id: 1861060
description:
2025-12-08 10:36:07 dovecot_login authenticator failed for p160010-obmd01.osaka.ocn.ne.jp [61.112.103.9]:56017: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.204.132.188
country_id: 6252001
description:
[2025-12-08 10:37:20 +0530] info [whostmgrd] 71.204.132.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.190.127.74
country_id: 6252001
description:
[2025-12-08 10:37:23 +0530] info [cpaneld] 97.190.127.74 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.91.48.77
country_id: 6252001
description:
[2025-12-08 10:37:36 +0530] info [cpaneld] 50.91.48.77 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.140.51.36
country_id: 6252001
description:
[2025-12-08 10:37:44 +0530] info [cpaneld] 73.140.51.36 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 10:36:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<vqyHw2lFeKo+PIce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.76.239
country_id: 6252001
description:
[2025-12-08 10:37:01 +0530] info [cpaneld] 129.222.76.239 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.6.173.66
country_id: 6252001
description:
[2025-12-08 10:37:17 +0530] info [cpaneld] 67.6.173.66 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 10:38:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<FmQvymlFLNc+PIcl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 10:39:17 host2 sshd[3603562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-08 10:39:34 dovecot_login authenticator failed for ([125.19.156.2]) [125.19.156.2]:53284: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-08 10:39:20 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:56485: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 10:39:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<stUSzmlFcpo+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.178.81.97
country_id: 6252001
description:
2025-12-08 10:40:44 dovecot_plain authenticator failed for ([89.116.164.85]) [72.178.81.97]:42514: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Dec  8 10:41:07 host2 sshd[3604852]: Disconnected from invalid user postgres 36.37.122.175 port 33832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 10:41:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 22 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7yV902lF7dcjy9Nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.188.151.33
country_id: 3573345
description:
2025-12-08 10:40:55 dovecot_plain authenticator failed for ([89.116.164.85]) [206.188.151.33]:37528: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.104.242.58
country_id: 3895114
description:
2025-12-08 10:41:08 dovecot_plain authenticator failed for pc-58-242-104-200.cm.vtr.net ([89.116.164.85]) [200.104.242.58]:51482: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 10:41:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<7CV51WlFuqYXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 10:42:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wafB12lFVvEjy9Nr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec  8 10:43:39 host2 sshd[3606650]: Disconnected from invalid user postgres 142.93.27.16 port 53508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 10:42:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<4vYM2WlFqvkjy9Nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-12-08 10:47:27 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:64458: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec  8 10:47:31 host2 sshd[3609501]: Disconnected from invalid user dogecoin 36.37.122.175 port 57616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-08 10:47:37 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:36452: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.107
country_id: 2635167
description:
Dec  8 10:48:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.107, lip=66.85.158.91, TLS, session=<ydJk7WlFIPgjy9Nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.241.195
country_id: 99237
description:
2025-12-08 10:49:00 dovecot_plain authenticator failed for ([89.116.164.85]) [62.201.241.195]:33359: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.191.207.85
country_id: 1694008
description:
2025-12-08 10:49:15 dovecot_plain authenticator failed for ([89.116.164.85]) [180.191.207.85]:27346: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 10:50:10 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (doctur) [87.103.126.54]:56741: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-08 10:50:52 dovecot_plain authenticator failed for (haugn) [103.51.26.198]:38314: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 10:50:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4pZA9WlFKIY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-08 10:50:55 dovecot_plain authenticator failed for (otiole) [81.0.54.119]:38614: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 10:51:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ztkG9mlF5Lw+PIcd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.189.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.189.56 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.178.104.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.178.104.12 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.231.224.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.231.224.217 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.26.106
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.30.26.106 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.217.78.74
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 107.217.78.74 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.47.77.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.47.77.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 10:56:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<TAYXCGpFooY+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.203
country_id: 6252001
description:
Dec  8 10:59:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.203, lip=66.85.158.92, TLS: Connection closed, session=<T4KYFGpFs7tb5qjL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 10:59:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<XKmSFGpFgs0+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 10:59:37 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (supettoph) [87.103.126.54]:54820: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.106
country_id: 6252001
description:
Dec  8 10:59:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.106, lip=66.85.158.92, TLS handshaking: Connection closed, session=</5YLE2pF/5Bb5qhq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.201
country_id: 6252001
description:
Dec  8 10:59:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.201, lip=66.85.158.92, TLS: Connection closed, session=<Ke+xE2pFl+Nb5qjJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.105
country_id: 6252001
description:
Dec  8 10:59:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.105, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rxhqFGpFI+Zb5qhp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-08 11:00:00 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:38177: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-12-08 11:00:27 dovecot_login authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:53826: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.62.248.21
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 194.62.248.21 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 11:01:38 host2 sshd[3619039]: Disconnected from invalid user user 2.57.121.25 port 35306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 11:01:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<d1eKHGpFeJM+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-08 11:02:01 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (rentlevoid) [73.183.74.177]:42604: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 11:02:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<oewRH2pFDsg+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-08 11:02:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49631: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec  8 11:03:22 host2 sshd[3620418]: Disconnected from invalid user oracle 182.253.156.184 port 52930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 11:05:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<rugnKGpFqsw+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-08 11:05:34 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:36162: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-12-08 11:05:53 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:59507: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 11:07:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<SMSNMGpFNMg+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.62
country_id: 3175395
description:
Dec  8 11:08:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.197.9.62, lip=66.85.158.91, TLS, session=<679CNWpF+tS5xQk+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.204
country_id: 3469034
description:
Dec  8 11:09:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.250.204, lip=66.85.158.91, TLS, session=<1B5tNmpF/Zm60frM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.25.233
country_id: 6252001
description:
[2025-12-08 11:11:06 +0530] info [cpaneld] 98.97.25.233 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.58.47
country_id: 6252001
description:
[2025-12-08 11:11:08 +0530] info [cpaneld] 47.157.58.47 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.126.205.7
country_id: 6252001
description:
[2025-12-08 11:11:21 +0530] info [cpaneld] 172.126.205.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.128.246
country_id: 99237
description:
Dec  8 11:11:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=65.20.128.246, lip=66.85.158.91, TLS, session=<lQxKPmpFnNhBFID2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.24.202.154
country_id: 798544
description:
Dec  8 11:11:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=193.24.202.154, lip=66.85.158.91, TLS, session=<6udeP2pFK9PBGMqa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Dec  8 11:11:00 host2 sshd[3627124]: Disconnected from invalid user moodle 182.253.156.184 port 43520 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.154.231
country_id: 6252001
description:
[2025-12-08 11:11:18 +0530] info [whostmgrd] 76.175.154.231 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.18.129
country_id: 6252001
description:
[2025-12-08 11:11:20 +0530] info [cpaneld] 47.141.18.129 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.88.81.204
country_id: 6252001
description:
[2025-12-08 11:10:53 +0530] info [cpaneld] 75.88.81.204 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  8 11:11:00 host2 sshd[3627130]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:12:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<niK/QmpFIL4DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec  8 11:12:18 host2 sshd[3627813]: Disconnected from invalid user jacob 182.253.156.184 port 41952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:13:16 host2 sshd[3628402]: Disconnected from invalid user aws 103.76.120.90 port 50908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-08 11:13:33 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:40656: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:13:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<69avR2pFfskDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-08 11:14:04 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:47478: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 11:14:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<neGeSGpFEuYv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-08 11:14:35 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:39722: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec  8 11:14:51 host2 sshd[3629335]: Disconnected from invalid user spring2024 182.253.156.184 port 38812 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:15:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<H0DcTmpFnIcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:17:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<jn68U2pFcO0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:18:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<LX08V2pFaKcDjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 11:17:57 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:19:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cW/gXGpFCI8DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:20:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<w13jXWpF7swDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 11:20:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<jGXrXmpFFqo+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:21:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lLH9YWpFJtoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  8 11:22:34 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<3dPcZmpFGMcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-08 11:23:10 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:50208: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.244.245.134
country_id: 6252001
description:
[2025-12-08 11:24:42 +0530] info [webmaild] 207.244.245.134 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-08 11:25:51 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:45111: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.26.151.98
country_id: 3865483
description:
2025-12-08 11:26:31 dovecot_plain authenticator failed for ([89.116.164.85]) [181.26.151.98]:59779: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.122.219.227
country_id: 3625428
description:
2025-12-08 11:26:49 dovecot_plain authenticator failed for ([89.116.164.85]) [190.122.219.227]:34932: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-08 11:26:06 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:49248: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-08 11:26:24 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:46938: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.122.219.227
country_id: 3625428
description:
2025-12-08 11:26:55 dovecot_login authenticator failed for ([89.116.164.85]) [190.122.219.227]:34932: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-08 11:27:47 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:58918: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-08 11:28:00 dovecot_plain authenticator failed for (oboxis) [92.62.243.175]:45383: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-08 11:27:59 dovecot_login authenticator failed for (246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:56814: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:28:37 host2 sshd[3640473]: Disconnected from invalid user jacob 103.76.120.90 port 39772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.172.11.186
country_id: 1269750
description:
Dec  8 11:29:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.172.11.186, lip=66.85.158.91, TLS, session=<QtZ8fWpFo+RnrAu6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec  8 11:29:25 host2 sshd[3641004]: Disconnected from invalid user infocare 190.181.27.22 port 59640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.160
country_id: 798544
description:
Dec  8 11:29:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.160, lip=66.85.158.91, TLS, session=<S0CyfmpF/a0u4yeg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.214.95.31
country_id: 3469034
description:
2025-12-08 11:30:16 dovecot_plain authenticator failed for ([89.116.164.85]) [186.214.95.31]:53612: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.21.144.230
country_id: 3895114
description:
2025-12-08 11:30:29 dovecot_plain authenticator failed for ([89.116.164.85]) [190.21.144.230]:49890: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.255.186.21
country_id: 3469034
description:
2025-12-08 11:30:02 dovecot_plain authenticator failed for ([89.116.164.85]) [143.255.186.21]:55448: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-08 11:31:32 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (evermulf) [67.173.58.47]:45644: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec  8 11:32:06 host2 sshd[3643509]: Disconnected from invalid user infocare 190.181.27.22 port 36112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.30
country_id: 2635167
description:
Dec  8 11:32:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.30, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XpzliWpF1a1X7LAe>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.120
country_id: 2635167
description:
Dec  8 11:32:21 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.120, lip=66.85.158.91, TLS, session=<c8zQiWpFwY2594l4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.19
country_id: 2635167
description:
Dec  8 11:32:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.19, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<k+bgi2pFLaVX7LAT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Dec  8 11:33:29 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kEHcjWpFq5m594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.37
country_id: 2635167
description:
Dec  8 11:34:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.37, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<06vXj2pF9ZpX7LAl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.4
country_id: 2635167
description:
Dec  8 11:34:35 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.4, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<nAzTkWpFG42594kE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.133.4
country_id: 99237
description:
Dec  8 11:34:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=65.20.133.4, lip=66.85.158.91, TLS, session=<zBzGkWpFarNBFIUE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.31
country_id: 2635167
description:
Dec  8 11:35:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.31, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<TIXMk2pFn96594kf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.16
country_id: 2635167
description:
Dec  8 11:35:42 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.16, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<oarJlWpF18m594kQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 11:35:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<AIvalWpFQJU+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.30.161.197
country_id: 690791
description:
Dec  8 11:35:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=46.30.161.197, lip=66.85.158.91, TLS, session=<8vvpkmpFr78uHqHF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 11:36:04 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.33
country_id: 2635167
description:
Dec  8 11:36:15 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.33, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<uy3Fl2pFX8C594kh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.18
country_id: 2635167
description:
Dec  8 11:36:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.18, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<4Ze+mWpFj8S594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.33
country_id: 2635167
description:
Dec  8 11:37:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.33, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<A9m5m2pFN7S594kh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.102
country_id: 6252001
description:
2025-12-08 11:37:36 dovecot_login authenticator failed for ([98.185.120.102]) [98.185.120.102]:52983: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.6
country_id: 3703430
description:
Dec  8 11:38:41 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.6, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<M+97oGpFzfot4/4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.193.134
country_id: 1269750
description:
2025-12-08 11:37:53 dovecot_login authenticator failed for ([122.175.193.134]) [122.175.193.134]:50098: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 11:38:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+LYcn2pFgokv/lVz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 11:38:54 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-08 11:39:32 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:32861: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-08 11:40:09 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:34380: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-08 11:40:12 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:55768: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:40:42 host2 sshd[3649219]: Disconnected from invalid user jenkins 103.76.120.90 port 53710 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-08 11:41:25 dovecot_plain authenticator failed for (ationo) [154.144.243.93]:33088: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.171.38.111
country_id: 3469034
description:
2025-12-08 11:43:06 dovecot_plain authenticator failed for ([89.116.164.85]) [177.171.38.111]:55321: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.27.33
country_id: 3865483
description:
2025-12-08 11:43:22 dovecot_plain authenticator failed for ([89.116.164.85]) [168.196.27.33]:45334: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  8 11:46:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<7DrQvWpFnIk+PIcp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec  8 11:47:00 host2 pure-ftpd[3654199]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 11:47:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<ZeuCwGpFjJk+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 11:50:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<v7dhyWpF8J8+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:51:34 host2 sshd[3657209]: Disconnected from invalid user oracle 103.76.120.90 port 52226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  8 11:51:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<xHWtzGpFHrc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-08 11:52:51 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:51872: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-08 11:51:56 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:50822: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.34.34.142
country_id: 6252001
description:
[2025-12-08 11:52:02 +0530] info [cpaneld] 136.34.34.142 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec  8 11:52:41 host2 sshd[3658130]: Disconnected from invalid user dell 190.181.27.22 port 40804 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.197.25.119
country_id: 6252001
description:
[2025-12-08 11:52:11 +0530] info [cpaneld] 107.197.25.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.115.234
country_id: 6252001
description:
[2025-12-08 11:52:19 +0530] info [cpaneld] 73.199.115.234 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.207.225.217
country_id: 6252001
description:
[2025-12-08 11:52:17 +0530] info [cpaneld] 107.207.225.217 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  8 11:52:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<xtkr0WpFPqM+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-08 11:51:56 dovecot_plain authenticator failed for (grapopyrs) [24.93.140.162]:59744: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.79.122.75
country_id: 6252001
description:
[2025-12-08 11:52:00 +0530] info [cpaneld] 173.79.122.75 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.253.203.214
country_id: 6252001
description:
[2025-12-08 11:52:06 +0530] info [cpaneld] 98.253.203.214 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.52.150.61
country_id: 6252001
description:
[2025-12-08 11:52:07 +0530] info [whostmgrd] 98.52.150.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-08 11:53:32 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:59728: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-08 11:53:37 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:64097: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec  8 11:53:09 host2 sshd[3658464]: Disconnected from invalid user jacob 103.76.120.90 port 34126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-08 11:53:13 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:37416: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.32
country_id: 6252001
description:
2025-12-08 11:53:16 dovecot_login authenticator failed for ([98.181.46.32]) [98.181.46.32]:54517: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.159.209.200
country_id: 6252001
description:
[2025-12-08 11:54:02 +0530] info [cpaneld] 50.159.209.200 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.142.161.81
country_id: 6252001
description:
[2025-12-08 11:54:11 +0530] info [whostmgrd] 69.142.161.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.222.79.143
country_id: 6252001
description:
[2025-12-08 11:54:18 +0530] info [cpaneld] 73.222.79.143 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.133.196.68
country_id: 6252001
description:
[2025-12-08 11:53:58 +0530] info [cpaneld] 75.133.196.68 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.41.61.33
country_id: 6252001
description:
[2025-12-08 11:54:25 +0530] info [cpaneld] 38.41.61.33 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.203.112.182
country_id: 6252001
description:
[2025-12-08 11:54:38 +0530] info [cpaneld] 170.203.112.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.168.50
country_id: 6252001
description:
[2025-12-08 11:54:05 +0530] info [cpaneld] 98.97.168.50 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-08 11:56:08 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:55599: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.146
country_id: 3996063
description:
2025-12-08 11:56:19 dovecot_login authenticator failed for (187.161.222.146-clientes-izzi.mx) [187.161.222.146]:35787: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-08 11:56:35 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:59584: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  8 11:56:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<faYZ4WpFLp0+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.95
country_id: 6252001
description:
Dec  8 11:57:36 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.95, lip=66.85.158.92, TLS, session=<g+Yj5GpF6PLG6xhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-08 11:56:55 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:43800: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.6.216
country_id: 3144096
description:
2025-12-08 12:01:56 dovecot_login authenticator failed for ([178.232.6.216]) [178.232.6.216]:52654: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-08 12:03:29 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:33236: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 12:03:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0Onl+WpFGO4+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  8 12:04:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Pe7X/GpFjLg+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-08 12:03:58 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:42470: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-08 12:07:56 dovecot_plain authenticator failed for (raphewhing) [102.53.15.180]:47955: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-08 12:08:06 dovecot_plain authenticator failed for (ineating) [65.20.143.159]:47409: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  8 12:08:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<OMmWDGtFOtM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 12:12:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<RJ1UGmtFers+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 12:13:04 host2 sshd[3674646]: Disconnected from invalid user admin 2.57.121.112 port 31254 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  8 12:13:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<RRW2G2tFaL0+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 12:13:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<IJyAHmtFRqA+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 12:15:50 host2 sshd[3676885]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.161.218.35
country_id: 290291
description:
2025-12-08 12:14:56 dovecot_plain authenticator failed for 109-161-218-35.rev.bb.zain.com ([89.116.164.85]) [109.161.218.35]:56690: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.52.219.236
country_id: 1694008
description:
2025-12-08 12:15:13 dovecot_plain authenticator failed for ([89.116.164.85]) [122.52.219.236]:58952: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.21.78.198
country_id: 1269750
description:
2025-12-08 12:15:28 dovecot_plain authenticator failed for ([89.116.164.85]) [103.21.78.198]:13710: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 12:17:30 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (noneemeeze) [87.103.126.54]:46552: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  8 12:18:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<WFDtLWtFlpk+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 12:20:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (delige) [87.103.126.54]:60653: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.51
country_id: 1269750
description:
Dec  8 12:20:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.109.178.51, lip=66.85.158.91, TLS, session=<1AGZM2tFDrVnbbIz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.222.40
country_id: 798544
description:
Dec  8 12:20:26 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=213.92.222.40, lip=66.85.158.91, TLS, session=<0BHQNGtFZMzVXN4o>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-08 12:20:58 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 12:21:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<UK5sOGtFgLw+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-08 12:23:20 dovecot_plain authenticator failed for (yewingstne) [41.248.243.181]:47342: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.197.82
country_id: 2186224
description:
2025-12-08 12:22:52 dovecot_login authenticator failed for 219-89-197-82.adsl.xtra.co.nz [219.89.197.82]:57706: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-08 12:23:05 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:33398: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-08 12:24:04 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:50695: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-08 12:24:23 dovecot_login authenticator failed for ([182.78.241.30]) [182.78.241.30]:55814: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-12-08 12:26:36 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:51872: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-08 12:26:45 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:34870: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.226
country_id: 3469034
description:
Dec  8 12:26:49 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=186.209.251.226, lip=66.85.158.91, TLS, session=<hd+MS2tFu6a60fvi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 12:27:13 host2 sshd[3685574]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.250
country_id: 3469034
description:
Dec  8 12:27:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.248.250, lip=66.85.158.91, TLS, session=<ZWH6TGtFmK260fj6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  8 12:28:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<6GvuUWtFhIQ+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.47
country_id: 6252001
description:
2025-12-08 12:28:26 dovecot_login authenticator failed for ([98.181.46.47]) [98.181.46.47]:55006: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-12-08 12:28:41 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:38920: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-08 12:28:59 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:38638: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-08 12:29:21 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:33152: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-08 12:30:53 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:53339: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-08 12:31:03 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:56135: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  8 12:33:44 host2 sshd[3689512]: Disconnected from invalid user user 2.57.121.25 port 6084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-08 12:37:46 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:49534: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-08 12:37:56 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:41394: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 12:39:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<CPsxeGtFJugv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 12:40:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<boF7fGtF3JAXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Dec  8 12:40:16 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<2LG0fGtFaOtHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Dec  8 12:40:18 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<gN7YfGtFkoNHBpK5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.233.246.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.233.246.219 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.162.80.98
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.162.80.98 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.135.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.66.135.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.174.233.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.174.233.54 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.120.106
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.120.106 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.93.54.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.93.54.130 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-08 12:45:56 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:37662: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.90
country_id: 1269750
description:
2025-12-08 12:46:17 dovecot_login authenticator failed for ([182.95.228.90]) [182.95.228.90]:37552: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.113
country_id: 2186224
description:
2025-12-08 12:48:04 dovecot_login authenticator failed for ([121.73.168.113]) [121.73.168.113]:56280: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.185.164.76
country_id: 2077456
description:
2025-12-08 12:48:23 dovecot_login authenticator failed for (cpe-101-185-164-76.wb06.wa.asp.telstra.net) [101.185.164.76]:43482: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-08 12:48:39 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:52362: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-08 12:48:47 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:48028: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.209.110
country_id: 1269750
description:
2025-12-08 12:49:05 dovecot_login authenticator failed for ([182.95.12.209]) [152.52.209.110]:55274: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.148
country_id: 953987
description:
Dec  8 12:49:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=102.129.55.148, lip=66.85.158.91, TLS, session=<g/NEm2tF77FmgTeU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.100
country_id: 3175395
description:
Dec  8 12:49:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.8.100, lip=66.85.158.91, TLS, session=<nnp9nGtFP6m5xQhk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-08 12:51:14 dovecot_plain authenticator failed for ool-457e901e.dyn.optonline.net (whiseepida) [69.126.144.30]:63472: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-08 12:52:55 dovecot_login authenticator failed for (182.239.78.49.hk.chinamobile.com) [182.239.78.49]:21404: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-08 12:54:16 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:39246: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-12-08 12:54:30 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:33196: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.33.101.74
country_id: 3077311
description:
Dec  8 12:58:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=46.33.101.74, lip=66.85.158.91, TLS, session=<QgBbu2tFqQwuIWVK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.44
country_id: 953987
description:
Dec  8 12:58:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.57.44, lip=66.85.158.91, TLS, session=<hexzvGtF96FmgTks>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.82.78.37
country_id: 1269750
description:
2025-12-08 12:58:32 dovecot_plain authenticator failed for (LE7AQH53ZALJ4) [103.82.78.37]:28718: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.216.154.78
country_id: 2635167
description:
2025-12-08 12:59:38 dovecot_login authenticator failed for ([62.216.154.78]) [62.216.154.78]:51983: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-08 13:00:48 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:50796: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-08 13:00:47 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (idisreval) [68.60.77.128]:51272: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-08 12:59:57 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:40202: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.252
country_id: 3469034
description:
Dec  8 13:00:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=200.196.143.252, lip=66.85.158.91, TLS, session=<esmAw2tFiIzIxI/8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  8 13:00:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<QZW+xGtFWoE+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.2
country_id: 226074
description:
Dec  8 13:00:42 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.119.2, lip=66.85.158.91, TLS, session=<nGOoxGtFp4rEAHcC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-08 13:00:58 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:51388: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 13:02:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jFCEzWtFUq4v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-08 13:03:51 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:56342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-08 13:04:08 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:54486: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-08 13:05:04 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:54798: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-08 13:05:10 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:44106: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-08 13:05:21 dovecot_login authenticator failed for a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:48548: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-08 13:05:20 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:59914: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-08 13:05:45 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:49029: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-12-08 13:05:46 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61396: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-08 13:07:28 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (domangneus) [24.61.199.212]:51294: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.164.121.172
country_id: 1643084
description:
2025-12-08 13:06:59 dovecot_plain authenticator failed for (CEJ5O) [125.164.121.172]:54480: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-08 13:09:10 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl (sysciones) [91.202.230.214]:33189: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-08 13:18:07 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:39308: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-08 13:18:17 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (nohen) [24.61.199.212]:51462: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-08 13:18:21 dovecot_plain authenticator failed for (stable) [41.248.243.181]:52628: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-08 13:18:20 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:33836: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  8 13:22:31 host2 sshd[3715569]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.118.202
country_id: 226074
description:
Dec  8 13:23:24 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=196.0.118.202, lip=66.85.158.91, TLS, session=<FFXMFWxFpuzEAHbK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.210.57
country_id: 933860
description:
Dec  8 13:23:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.210.57, lip=66.85.158.91, TLS, session=<qCQmF2xFhcYp2NI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-08 13:24:38 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:55768: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-12-08 13:24:13 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:37786: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.71.7
country_id: 1643084
description:
2025-12-08 13:25:44 dovecot_plain authenticator failed for ([89.116.164.85]) [103.172.71.7]:42568: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  8 13:24:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ydF3HGxFLJQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.194.80.205
country_id: 3865483
description:
2025-12-08 13:25:57 dovecot_plain authenticator failed for ([89.116.164.85]) [190.194.80.205]:49395: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.99.35.165
country_id: 102358
description:
2025-12-08 13:26:10 dovecot_plain authenticator failed for ([89.116.164.85]) [94.99.35.165]:51075: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.71.7
country_id: 1643084
description:
2025-12-08 13:25:51 dovecot_login authenticator failed for ([89.116.164.85]) [103.172.71.7]:42568: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 13:26:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<IJewI2xFGMEXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec  8 13:29:28 host2 sshd[3718685]: Disconnected from invalid user user 125.20.16.22 port 61258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.225.161
country_id: 1210997
description:
2025-12-08 13:31:11 dovecot_plain authenticator failed for (L7V1JJ7) [103.111.225.161]:64105: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.78
country_id: 1269750
description:
2025-12-08 13:31:25 dovecot_login authenticator failed for (nsg-corporate-78.225.187.122.airtel.in) [122.187.225.78]:46775: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-08 13:31:37 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:41186: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.206.160
country_id: 6252001
description:
Dec  8 13:30:54 host2 sshd[3719719]: Disconnected from invalid user postgres 152.32.206.160 port 40500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 13:32:43 host2 sshd[3720518]: Disconnected from invalid user admin 2.57.121.112 port 11776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec  8 13:33:46 host2 sshd[3721028]: Disconnected from invalid user ansible 64.23.180.137 port 52704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  8 13:35:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cySqQmxFYtYXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec  8 13:38:06 host2 sshd[3723134]: Disconnected from invalid user linode 64.23.180.137 port 43676 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.81.90
country_id: 6252001
description:
Dec  8 13:40:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.81.90, lip=66.85.158.91, session=<CTKcU2xF7IYUqVFa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec  8 13:40:59 host2 sshd[3724733]: Disconnected from invalid user admin 152.200.205.179 port 53280 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec  8 13:41:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: Connection closed, session=<uqrwVmxFRmNChJmA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.82.78.37
country_id: 1269750
description:
2025-12-08 13:41:54 dovecot_plain authenticator failed for (E7G74M1Q) [103.82.78.37]:28372: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.18.151
country_id: 2921044
description:
Dec  8 13:41:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.18.151, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<frhEWWxF+W6fWRKX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.60.8
country_id: 2921044
description:
Dec  8 13:42:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=206.189.60.8, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LHRiW2xFHg/OvTwI>


