# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 14:25:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<tkkNbb1FANg+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-12 14:26:12 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:51889: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-12 14:26:26 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:44934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 14:26:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<3GyUcL1FIrrCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 14:27:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<7yj3cr1FoNG8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 14:28:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<9Nw4eL1FmKul6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-12 14:29:18 dovecot_plain authenticator failed for (lyctic) [65.20.184.80]:40280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-12 14:30:00 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (prappode) [98.40.101.10]:41922: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-12 14:30:15 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:54678: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.20
country_id: 3175395
description:
Dec 12 14:30:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.26.178.20, lip=66.85.158.91, TLS, session=<WJ2afL1F0MnZGrIU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.174.73.235
country_id: 798544
description:
Dec 12 14:30:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.174.73.235, lip=66.85.158.91, TLS, session=<Bii+fb1Fa+kurknr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.49
country_id: 1733045
description:
2025-12-12 14:29:54 dovecot_login authenticator failed for ([49.124.151.49]) [49.124.151.49]:55976: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 14:31:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<q1v+f71F6MOkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 14:32:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<Vlj8hL1F1LJAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.0
country_id: 3469034
description:
Dec 12 14:32:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.249.0, lip=66.85.158.91, TLS, session=<4U6ehL1FPdy60fkA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.174.40
country_id: 99237
description:
Dec 12 14:32:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=65.20.174.40, lip=66.85.158.91, TLS, session=<R+rshb1FoopBFK4o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 12 14:33:24 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rOWuiL1FOn1ChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-12 14:35:11 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:32946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-12 14:35:14 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:54539: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-12 14:35:23 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:38203: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-12 14:35:38 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:33632: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-12-12 14:34:51 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:44098: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.215
country_id: 3996063
description:
2025-12-12 14:35:41 dovecot_login authenticator failed for ([177.236.145.215]) [177.236.145.215]:53186: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-12 14:36:34 dovecot_login authenticator failed for ([128.185.201.138]) [128.185.201.138]:46188: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-12 14:36:53 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [125.17.124.75]:57392: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.217
country_id: 99237
description:
2025-12-12 14:37:59 dovecot_plain authenticator failed for (reited) [65.20.237.217]:43437: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 14:38:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2N4gm71FD8F100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 14:39:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<sv48nb1FXt0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 14:39:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=</se0nb1F5IMI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.173.36
country_id: 3469034
description:
2025-12-12 14:39:27 dovecot_plain authenticator failed for ([89.116.164.85]) [177.74.173.36]:2063: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 14:39:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<QWW4nr1FzuzO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 14:40:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<SPSAoL1FLNJm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.21.206.145
country_id: 3865483
description:
2025-12-12 14:40:18 dovecot_plain authenticator failed for ([89.116.164.85]) [181.21.206.145]:48922: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.193.212
country_id: 1694008
description:
2025-12-12 14:40:31 dovecot_plain authenticator failed for ([89.116.164.85]) [103.183.193.212]:58398: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 14:40:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<7Gkmor1F3uekXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.17.174.99
country_id: 3437598
description:
2025-12-12 14:39:45 dovecot_plain authenticator failed for ([89.116.164.85]) [186.17.174.99]:42082: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.92.217.41
country_id: 3865483
description:
2025-12-12 14:40:00 dovecot_plain authenticator failed for ([89.116.164.85]) [181.92.217.41]:43208: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.87.91.29
country_id: 3865483
description:
2025-12-12 14:40:04 dovecot_plain authenticator failed for ([89.116.164.85]) [181.87.91.29]:45868: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 14:41:27 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (overilis) [87.103.126.54]:12623: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 14:42:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<YlSlqL1FSr9npBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 14:42:24 host2 sshd[545940]: Disconnected from invalid user user 2.57.121.25 port 21636 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-12 14:42:29 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:58730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 14:42:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<8RlHqb1F35detwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-12 14:41:45 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:40546: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-12 14:42:10 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:34698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 14:43:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<rnxsrL1F8ObD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 14:43:47 dovecot_plain authenticator failed for (multe) [65.20.164.137]:49033: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2025-12-12 14:44:24 dovecot_login authenticator failed for ([49.124.146.34]) [49.124.146.34]:48374: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 14:44:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<knbkr71FBIUuZXpm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-12 14:44:41 +0530] info [cpaneld] 89.249.55.106 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-12 14:45:03 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:57856: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 14:45:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<xL1esr1FtK2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-12 14:45:32 dovecot_login authenticator failed for ([135.13.8.246]) [74.224.215.23]:9783: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-12 14:44:43 +0530] info [cpaneld] 89.249.55.106 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-12 14:46:03 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:38392: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 14:46:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<SrHZuL1FppQ+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 14:47:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<jG/wur1FqtMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 14:48:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=</CzHv71FsK7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 14:50:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<xLZHxb1FtIGH6yFP>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.73
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.73: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-12 14:52:01 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:50453: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-12 14:52:20 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (queuding) [73.88.196.91]:49414: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-12 14:52:26 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:55220: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-12 14:52:30 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (cohently) [93.145.118.40]:36638: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 12 14:54:16 host2 pure-ftpd[555819]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-12-12 14:54:39 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:37546: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-12 14:55:39 dovecot_plain authenticator failed for (berding) [91.73.195.150]:56021: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-12 14:56:09 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:35462: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-12 14:56:52 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57374: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-12 14:57:34 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (muticah) [73.13.220.220]:41134: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 14:57:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<cdmq371Fpp6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 15:00:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<utJA6L1FRtwImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 15:00:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<Cqdi6L1FtJUro2np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.10
country_id: 2921044
description:
Dec 12 15:00:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 7 secs): user=<>, rip=57.129.64.10, lip=66.85.158.91, TLS: Connection closed, session=<h0vK6b1FTY45gUAK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 15:01:05 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:44740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-12 15:01:17 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:49619: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-12 15:01:21 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54095: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-12 15:01:23 dovecot_plain authenticator failed for (spables) [24.93.140.162]:40553: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-12 15:01:34 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:39482: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-12-12 15:02:26 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:46882: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 12 15:02:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<fKe/8L1FkufBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2025-12-12 15:02:34 dovecot_login authenticator failed for ([198.8.94.171]) [181.177.9.119]:38334: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 15:02:55 dovecot_login authenticator failed for ([62.97.161.137]) [178.232.153.27]:50093: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 12 15:03:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<ZgvI8r1F1tPCw3NV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 15:03:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<xdiW871Fnoa8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:05:50 host2 sshd[564518]: Disconnected from invalid user ubuntu 174.136.203.212 port 52366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:07:30 host2 sshd[565734]: Disconnected from invalid user satya 103.13.207.125 port 47028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-12 15:07:37 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12085: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:07:00 host2 sshd[565382]: Disconnected from invalid user ruan 174.136.203.212 port 39844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:07:19 host2 sshd[565624]: Disconnected from invalid user zk 159.223.45.112 port 36702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:07:45 host2 sshd[565862]: Disconnected from invalid user dc 206.238.40.232 port 35490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:07:52 host2 sshd[565938]: Disconnected from invalid user tester 68.218.72.173 port 54642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-12 15:08:04 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:38799: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-12 15:08:26 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:57426: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:09:40 host2 sshd[567203]: Disconnected from invalid user support 174.136.203.212 port 60922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 15:09:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<e8jXB75FOpNntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:09:24 host2 sshd[567067]: Disconnected from invalid user gaurav 68.218.72.173 port 60198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:09:36 host2 sshd[567159]: Disconnected from invalid user testuser 51.178.43.161 port 53928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.166
country_id: 1269750
description:
2025-12-12 15:09:19 dovecot_login authenticator failed for (nsg-corporate-73.182.187.122.airtel.in) [182.95.178.166]:43646: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 12 15:09:30 host2 sshd[567106]: Disconnected from invalid user minerhub 165.154.205.128 port 41096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 15:08:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<KvL0Br5FVrNo1joy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:10:09 host2 sshd[567643]: Disconnected from invalid user test1 51.178.43.161 port 38198 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 12 15:09:58 host2 pure-ftpd[567384]: (?@66.132.153.115) [INFO] New connection from 66.132.153.115


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:10:11 host2 sshd[567692]: Disconnected from invalid user ubuntu 68.218.72.173 port 36106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Dec 12 15:10:38 host2 sshd[567987]: Disconnected from invalid user test 119.246.15.94 port 37868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:09:47 host2 sshd[567270]: Disconnected from invalid user marco 103.13.207.125 port 46002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:09:52 host2 sshd[567327]: Disconnected from invalid user sean 206.238.40.232 port 57552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:09:54 host2 sshd[567352]: Disconnected from invalid user ccorrea 159.223.45.112 port 44192 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:10:49 host2 sshd[568106]: Received disconnect from 174.136.203.212 port 55002:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:10:56 host2 sshd[568172]: Disconnected from invalid user test 68.218.72.173 port 47176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 12 15:11:11 host2 sshd[568444]: Disconnected from invalid user x 51.178.43.161 port 34974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.238.40.232
country_id: 1880251
description:
Dec 12 15:11:22 host2 sshd[568663]: Disconnected from invalid user ubuntu 206.238.40.232 port 37880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.136.203.212
country_id: 6252001
description:
Dec 12 15:10:49 host2 sshd[568106]: Disconnected from invalid user yf 174.136.203.212 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 12 15:11:14 host2 sshd[568525]: Disconnected from invalid user gaurav 159.223.45.112 port 39000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 12 15:12:12 host2 sshd[569484]: Disconnected from invalid user ubuntu 103.13.207.125 port 47712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 12 15:12:24 host2 sshd[569638]: Disconnected from invalid user vlad 165.154.205.128 port 51636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 12 15:12:30 host2 sshd[569705]: Disconnected from invalid user nabi 68.218.72.173 port 56206 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 12 15:12:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.168, lip=66.85.158.91, TLS, session=<RNDAEr5FFv/N0h+o>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 15:13:18 host2 sshd[570516]: Disconnected from invalid user user 2.57.121.25 port 27582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:14:03 host2 sshd[571491]: Disconnected from invalid user user 172.208.24.217 port 18054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:14:39 host2 sshd[572122]: Disconnected from invalid user sdtdserver 172.208.24.217 port 45890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Dec 12 15:15:00 host2 sshd[572399]: Disconnected from invalid user ubuntu 119.246.15.94 port 43535 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-12 15:15:45 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:60720: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 15:15:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<rZsCIL5FkMrAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 12 15:16:04 host2 sshd[573499]: Disconnected from invalid user usuario 197.211.55.20 port 53844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-12 15:16:07 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (breron) [98.204.134.124]:45992: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 12 15:15:15 host2 sshd[572751]: Disconnected from invalid user sysadmin 172.208.24.217 port 18088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 15:16:23 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:34860: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 12 15:17:27 host2 sshd[574821]: Disconnected from invalid user botuser 197.211.55.20 port 41166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-12-12 15:17:53 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:48096: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:17:30 host2 sshd[574872]: Disconnected from invalid user demo1 138.197.123.123 port 40602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:17:42 host2 sshd[574978]: Disconnected from invalid user mas 36.91.81.195 port 35888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 15:18:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<JqEiKL5FKt2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 15:18:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<O4V9KL5FsIgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-12 15:18:38 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:58625: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 15:20:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<R9vnL75F8rsI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:19:15 host2 sshd[576146]: Disconnected from invalid user demo 187.16.96.250 port 45646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.246
country_id: 6252001
description:
Dec 12 15:19:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.169.104.246, lip=66.85.158.92, session=<iQ2bLb5FFs8UqWj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 15:19:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<ZlKwLb5F4uq8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 15:20:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<L6c8L75FAJ0IgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:20:10 host2 sshd[577120]: Disconnected from invalid user nas 36.91.81.195 port 56184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.73
country_id: 6252001
description:
Dec 12 15:21:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.73, lip=66.85.158.91, session=<ThpFM75FK4Fb5qhJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 15:21:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<Znh4M75FSoaB4gum>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:20:16 host2 sshd[577228]: Received disconnect from 138.197.123.123 port 43026:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 12 15:20:49 host2 sshd[577707]: Disconnected from invalid user ubuntu 36.91.81.195 port 40090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 15:20:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<53Y9Mr5FCoXCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-12 15:22:10 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:47789: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.172
country_id: 6252001
description:
Dec 12 15:21:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.172, lip=66.85.158.91, session=<8SbvM75FZ69b5qis>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.175
country_id: 6252001
description:
Dec 12 15:21:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.175, lip=66.85.158.91, session=<fdV7NL5Fb+Zb5qiv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-12 15:21:47 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:47989: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 15:21:53 host2 sshd[578555]: Disconnected from invalid user  62.60.131.157 port 22660 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.168
country_id: 6252001
description:
Dec 12 15:21:23 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.168, lip=66.85.158.91, session=<odlMNL5FB8Vb5qio>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:21:44 host2 sshd[578422]: Disconnected from invalid user forward 187.16.96.250 port 48776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 15:23:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=</p2SOr5FYsyl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:22:21 host2 sshd[578863]: Disconnected from invalid user user 187.16.96.250 port 46940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 12 15:22:23 host2 sshd[578890]: Disconnected from invalid user botuser 138.197.123.123 port 43474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 15:23:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<+w38Ob5F4NSkXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 15:23:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<p3e4Or5FLqI+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:23:32 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Z3/7O75FOJoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:24:28 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BNtTP75FiI4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 15:24:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<hMa/P75F+tlAF6S9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.16.96.250
country_id: 3469034
description:
Dec 12 15:24:19 host2 sshd[580294]: Disconnected from invalid user newroot 187.16.96.250 port 41744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:25:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Qca0Q75FGtIDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-12 15:27:05 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:43076: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 15:27:07 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:6287: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.204.227
country_id: 3469034
description:
Dec 12 15:28:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=177.93.204.227, lip=66.85.158.91, TLS, session=<21t/S75FOsqxXczj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:27:33 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<ZQpXSr5F2NYDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-12 15:27:33 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:59844: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-12 15:27:37 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:37200: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.141
country_id: 3865483
description:
Dec 12 15:27:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.90.141, lip=66.85.158.91, TLS, session=<DRcuSr5FspK+tVqN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-12 15:28:13 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:34891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:28:19 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A0MRTb5F+O0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-12 15:28:25 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:50538: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 12 15:31:06 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<1goMV75FoMYDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 15:31:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mR1XV75FIJlm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-12 15:32:02 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:58006: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 15:32:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<kOAsWr5FIIOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.168
country_id: 3996063
description:
2025-12-12 15:32:20 dovecot_login authenticator failed for ([177.236.146.168]) [177.236.146.168]:32844: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-12 15:32:51 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:35830: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 15:32:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<dbNdXb5FbuA+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-12 15:33:06 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:37616: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-12 15:34:03 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:49382: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 15:34:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4nmFYb5FmM7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 15:33:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<zHmsYL5F5KfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 15:35:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<0asXZr5FWKEI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 15:36:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<VXeJab5FULd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 15:36:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<j8xOar5FEbtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 15:36:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<u5bPar5Fit6KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 15:37:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<FB87br5F+pQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-12 15:37:23 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (hamorksts) [37.150.8.174]:46749: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 15:38:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<c9CJcb5FkIJnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 15:41:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<kyX2e75FCDEvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-12 15:42:27 dovecot_plain authenticator failed for (eambrack) [24.187.213.29]:47600: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-12 15:43:12 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:37572: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-12 15:43:32 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:45099: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 15:46:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<lCuMjL5FhKeH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-12 15:47:11 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:40594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 15:47:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<NdGGkr5FSqanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.150
country_id: 6252001
description:
2025-12-12 15:47:55 dovecot_login authenticator failed for ([70.174.167.150]) [70.174.167.150]:38669: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 15:49:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<EptimL5F3Kk+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-12 15:52:02 dovecot_login authenticator failed for ([203.193.147.41]) [203.193.147.37]:50929: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 15:53:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<z5pBpb5FJsYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-12-12 15:52:17 dovecot_login authenticator failed for ([149.54.51.162]) [149.54.51.162]:53206: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-12 15:52:23 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:50912: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-12 15:52:42 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:34017: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-12 15:53:17 dovecot_login authenticator failed for ([121.73.163.186]) [121.73.163.186]:51492: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 15:53:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Anzspr5FLLCB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-12 15:53:39 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:45310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 15:54:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+AZVqb5FsuQv/lVz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 15:54:38 host2 sshd[606214]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-12-12 15:55:59 dovecot_login authenticator failed for ([2.55.88.51]) [2.55.88.51]:41892: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.6
country_id: 1733045
description:
2025-12-12 15:56:19 dovecot_login authenticator failed for ([49.124.151.6]) [49.124.151.6]:48536: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-12 15:57:59 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:46285: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-12 15:58:20 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:59035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 15:58:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ykZ1ur5F4oa8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-12 15:59:13 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:59330: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-12 15:59:34 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:50781: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.77
country_id: 3175395
description:
Dec 12 15:59:49 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=217.26.179.77, lip=66.85.158.91, TLS, session=<q8KJvL5FFLzZGrNN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 16:01:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<Z1pjwr5FSLsImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.142
country_id: 933860
description:
Dec 12 16:00:15 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=41.216.215.142, lip=66.85.158.91, TLS, session=<IKPovb5FyYwp2NeO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 16:00:39 host2 sshd[624145]: Disconnected from invalid user  62.60.131.157 port 38372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 16:01:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<hm92xL5FmrM+PIMh>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.135
country_id: 6252001
description:
Dec 12 16:02:14 host2 pure-ftpd[625371]: (?@135.237.126.135) [INFO] New connection from 135.237.126.135


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 16:02:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<UmIFyL5FuORntrtb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec 12 16:02:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS: Connection closed, session=<++uRyL5FQDdChJl3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 16:03:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<q5zjyb5F6I6LOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 16:03:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<5p/zyr5FQO4+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 12 16:03:51 host2 sshd[626934]: Disconnected from invalid user test 20.203.42.204 port 47212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.229.200.110
country_id: 298795
description:
2025-12-12 16:04:39 dovecot_plain authenticator failed for (bidess) [5.229.200.110]:54921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 12 16:06:32 host2 sshd[628815]: Disconnected from invalid user nexus 38.47.94.55 port 50670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-12 16:07:02 dovecot_plain authenticator failed for (bilomy) [65.20.129.28]:37437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-12 16:07:13 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:49270: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:07:43 host2 sshd[629697]: Disconnected from invalid user admin 172.188.75.98 port 44150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-12 16:08:01 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:41354: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.202.233
country_id: 6251999
description:
Dec 12 16:08:07 host2 pure-ftpd[629996]: (?@128.203.202.233) [INFO] New connection from 128.203.202.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.250
country_id: 1733045
description:
2025-12-12 16:09:12 dovecot_login authenticator failed for ([49.124.152.250]) [49.124.152.250]:41972: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:08:26 host2 sshd[630161]: Disconnected from invalid user analytics 172.188.75.98 port 50304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 16:08:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<9j33275F9JHAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 16:09:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<u2Ue375F7Ogv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-12 16:08:16 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:47184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 16:10:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<zj3h4r5F4MyG0Wp/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 12 16:10:21 host2 sshd[631510]: Disconnected from invalid user mini 38.47.94.55 port 37806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:10:38 host2 sshd[631655]: Disconnected from invalid user frappe 172.188.75.98 port 33184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 16:11:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<srJ45r5FBoy8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.188.75.98
country_id: 1880251
description:
Dec 12 16:11:19 host2 sshd[632019]: Disconnected from invalid user Oracle 172.188.75.98 port 46698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 16:11:48 host2 sshd[632185]: Disconnected from invalid user admin 2.57.121.112 port 53162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-12 16:12:16 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:42870: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 16:12:23 dovecot_plain authenticator failed for (parpradrus) [65.20.164.137]:37372: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-12 16:12:35 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:46604: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 16:12:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<TqoH7L5F1LEv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 12 16:13:05 host2 sshd[632811]: Disconnected from invalid user zvc 20.203.42.204 port 56660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 16:14:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<0gvD8b5FBteWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 16:14:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Yss/8r5FaN3CBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 16:14:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<uZqQ875FkugI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 16:15:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<MJKA9L5FSNCkXGTY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Dec 12 16:15:06 host2 sshd[634014]: Disconnected from invalid user user 20.203.42.204 port 37574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-12 16:15:10 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (ratom) [67.172.54.29]:54758: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.15.18.19
country_id: 3469034
description:
Dec 12 16:15:29 host2 sshd[634279]: Disconnected from invalid user elemental 200.15.18.19 port 43958 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 16:16:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<FeGt+b5Ffp1AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-12 16:18:07 dovecot_login authenticator failed for ([125.19.218.50]) [125.19.218.50]:35012: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-12 16:17:23 dovecot_login authenticator failed for (aes-static-105.28.22.125.airtel.in) [182.95.228.22]:49864: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-12 16:17:37 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:50664: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-12 16:17:37 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:56285: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.15.18.19
country_id: 3469034
description:
Dec 12 16:17:39 host2 sshd[636304]: Disconnected from invalid user ftpuser 200.15.18.19 port 54232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-12 16:17:50 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:56642: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 16:17:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<G4xY/r5FJJWl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-12 16:19:01 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:58120: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.113
country_id: 6252001
description:
2025-12-12 16:18:24 dovecot_login authenticator failed for wsip-184-191-250-113.fv.ks.cox.net [184.191.250.113]:53773: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.44
country_id: 6252001
description:
2025-12-12 16:18:49 dovecot_login authenticator failed for ([70.174.168.44]) [70.174.168.44]:52844: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.8
country_id: 798549
description:
Dec 12 16:20:07 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.8, lip=66.85.158.92, TLS, session=<MuBWBr9F/c9V2ZUI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 16:19:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<AflABb9FqtkIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 12 16:20:36 host2 sshd[638405]: Disconnected from invalid user kirill 122.160.46.61 port 42770 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 16:21:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<2KA5Cr9Fsps+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:22:37 host2 sshd[639864]: Disconnected from invalid user ubuntu 201.186.40.250 port 37460 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 12 16:22:49 host2 sshd[639987]: Disconnected from invalid user user 122.160.46.61 port 42748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.15.18.19
country_id: 3469034
description:
Dec 12 16:22:52 host2 sshd[640031]: Disconnected from invalid user ubuntu 200.15.18.19 port 43952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2025-12-12 16:23:11 dovecot_login authenticator failed for ([125.21.200.57]) [128.185.219.54]:60694: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 16:22:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ygqSDr9FBN1m1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-12 16:24:12 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:38673: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:23:21 host2 sshd[640378]: Disconnected from invalid user max 201.186.40.250 port 50170 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 16:23:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Lgw9Er9FKuOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-12 16:23:40 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:56459: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-12 16:23:50 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:49417: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.15.18.19
country_id: 3469034
description:
Dec 12 16:24:48 host2 sshd[641181]: Disconnected from invalid user cockpit 200.15.18.19 port 54220 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:26:08 host2 sshd[642091]: Disconnected from invalid user zs 201.186.40.250 port 44518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:25:27 host2 sshd[641650]: Disconnected from invalid user alireza 201.186.40.250 port 60044 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 16:26:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<+MGpG79F2sHD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Dec 12 16:27:09 host2 sshd[642744]: Disconnected from invalid user bitrix 109.205.114.34 port 34432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-12 16:26:40 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (berding) [73.129.57.71]:41760: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 12 16:27:15 host2 sshd[642819]: Disconnected from invalid user testtest 122.160.46.61 port 42710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Dec 12 16:27:51 host2 sshd[643320]: Disconnected from invalid user dockeruser 109.205.114.34 port 38274 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 16:28:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<OmRkIr9F7oOKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 16:28:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<wwj0Ir9FMqnO7iqJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.205.114.34
country_id: 99237
description:
Dec 12 16:28:34 host2 sshd[643672]: Disconnected from invalid user postfix 109.205.114.34 port 47492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 12 16:28:54 host2 sshd[643826]: Disconnected from invalid user ubuntu 201.186.40.250 port 38866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Dec 12 16:29:16 host2 sshd[644148]: Disconnected from invalid user jessica 109.205.114.34 port 35526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 16:29:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<HkBFJ79FmNQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 16:30:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<VCSiLL9F6QVetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 16:30:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<+/KgLL9FPOEuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 16:31:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<mqruLr9FqrXD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.74.188.179
country_id: 3469034
description:
Dec 12 16:31:58 host2 sshd[646078]: Disconnected from invalid user rajesh 177.74.188.179 port 54188 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Dec 12 16:32:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<rgS3Mr9F4qLAm1rc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 16:32:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<CDpWM79Fesl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-12-12 16:33:44 dovecot_login authenticator failed for ([182.95.222.186]) [182.95.222.186]:45574: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.72
country_id: 6252001
description:
2025-12-12 16:33:57 dovecot_login authenticator failed for ([98.185.120.72]) [98.185.120.72]:43729: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-12 16:34:43 dovecot_login authenticator failed for ([125.20.154.97]) [182.95.178.206]:44446: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 16:34:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<mDUcO79FQOFnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-12 16:35:02 dovecot_login authenticator failed for ([125.23.72.129]) [125.20.245.194]:41202: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 16:35:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<LZeEPr9F6CIvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.57
country_id: 1831722
description:
Dec 12 16:36:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.57, lip=66.85.158.91, session=<QwI6Qr9FdoG81+s5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.25
country_id: 3439705
description:
Dec 12 16:36:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.84.102.25, lip=66.85.158.91, session=<p3s1Qr9F5qktVGYZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.200.139
country_id: 1733045
description:
Dec 12 16:36:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.200.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=</PU5Qr9FLJSt78iL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-12 16:37:50 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:39488: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.92.147
country_id: 2029969
description:
2025-12-12 16:37:33 dovecot_login authenticator failed for ([202.126.92.147]) [202.126.92.147]:39072: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-12 16:38:17 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:36355: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 16:39:25 host2 sshd[651000]: Disconnected from invalid user  62.60.131.157 port 34505 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 16:41:43 host2 sshd[652298]: Disconnected from invalid user admin 2.57.121.112 port 25283 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 16:42:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<rQiAVL9FxNGH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 16:42:05 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (getrostha) [71.224.169.28]:41794: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-12 16:42:46 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:44254: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2025-12-12 16:42:54 dovecot_login authenticator failed for (nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:52046: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2025-12-12 16:42:29 dovecot_login authenticator failed for ([117.245.138.2]) [117.245.138.2]:46249: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-12 16:42:31 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:59151: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-12 16:43:50 dovecot_login authenticator failed for (nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:42164: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-12 16:44:02 dovecot_login authenticator failed for ([102.38.3.109]) [102.38.3.109]:58738: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-12 16:43:29 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (iserr) [73.13.220.220]:58118: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 16:45:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<ceYlYr9Fwpkro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-12 16:48:01 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:49858: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-12 16:48:11 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:53990: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-12 16:48:31 dovecot_login authenticator failed for (70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:49920: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-12 16:48:59 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:54977: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 16:49:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<CHa0bb9F5tiB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 16:49:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<vmDhbr9F5MZo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-12-12 16:49:16 dovecot_login authenticator failed for ([182.95.222.186]) [182.95.222.186]:39246: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 16:53:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<OzG8fb9F8ORntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 16:54:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<DU1tgL9FlrW8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 16:55:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<HDvOg79FztY+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-12 16:58:44 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:40451: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 16:58:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<RJV0kL9FiOA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-12 16:58:59 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:36035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 17:01:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<D/Q2mb9FBsTAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 17:01:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<J0Exmr9FUJUImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-12 17:02:52 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:42648: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-12 17:02:52 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:52269: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.88
country_id: 6252001
description:
2025-12-12 17:03:09 dovecot_login authenticator failed for ([70.174.168.88]) [70.174.168.88]:39418: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-12 17:03:11 dovecot_plain authenticator failed for (incys) [199.192.123.12]:47502: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 17:03:48 host2 sshd[669515]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-12 17:03:22 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:52435: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-12-12 17:04:19 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:42642: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 17:04:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<6AOLpL9FBqS8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.201
country_id: 1733045
description:
2025-12-12 17:05:29 dovecot_login authenticator failed for ([49.124.148.201]) [49.124.148.201]:50398: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 17:06:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<nue5rb9FjpukXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 17:07:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<wSoPrr9F+O2G0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-12 17:07:53 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:42219: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 17:08:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<RlcYsr9F8I1AF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 17:07:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<D3ibr79FzNkv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-12 17:07:33 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:52564: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-12 17:07:42 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:37846: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-12 17:07:47 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:43652: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 17:08:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<opi/sr9FcMMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 17:08:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<zQDdsr9FEpLCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.89.22.113
country_id: 3469034
description:
2025-12-12 17:08:54 dovecot_login authenticator failed for (177-89-22-113.cable.cabotelecom.com.br) [177.89.22.113]:52754: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-12 17:09:30 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (grassom) [73.176.157.57]:41374: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 17:10:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<dV4YvL9FqpeWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-12 17:13:28 dovecot_login authenticator failed for ([180.94.75.42]) [180.94.75.42]:42678: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-12 17:13:42 dovecot_login authenticator failed for ([124.246.114.111]) [124.246.114.111]:38465: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.242.2.250
country_id: 298795
description:
2025-12-12 17:15:01 dovecot_login authenticator failed for ([178.242.2.250]) [178.242.2.250]:49004: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-12 17:14:26 dovecot_login authenticator failed for (ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:60060: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 17:14:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Fg7gyL9FEutm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 17:14:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</GL8yb9FfsqkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-12 17:15:28 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (distagy) [73.137.7.97]:45046: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 17:16:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<wSPyz79FKOfD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 17:18:12 host2 sshd[680381]: Disconnected from invalid user admin 62.60.131.157 port 14454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-12-12 17:19:01 dovecot_login authenticator failed for ([68.71.242.113]) [72.239.139.162]:47644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 17:20:04 dovecot_plain authenticator failed for (deazinorhi) [154.144.243.93]:41516: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-12-12 17:19:26 dovecot_login authenticator failed for ([114.99.127.122]) [20.46.45.121]:64258: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 17:20:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (motoryon) [87.103.126.54]:13120: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 17:20:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<PMcE3b9FiMqKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 17:21:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<HMLK4r9FTq4IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 17:21:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<qwQk479FdIXD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 17:22:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<uoQG5r9FkurO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 17:22:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<Ooyh5r9FAOUI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2025-12-12 17:23:41 dovecot_login authenticator failed for (aes-static-097.188.22.125.airtel.in) [122.184.118.126]:40930: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 17:23:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<H9AW6r9FRNYuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 17:24:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Uqa8679FcIqnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 17:24:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<iF3d679FKpIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-12 17:24:27 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:35442: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 17:25:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<v3GQ779FaItetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 17:26:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<5ivF879FzOQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-12 17:27:39 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:33126: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 17:29:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kbmP/b9FyPR100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 17:30:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<8eA/AcBFmOwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 17:31:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<aVpOBcBFWIxnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.108
country_id: 6252001
description:
2025-12-12 17:31:48 dovecot_login authenticator failed for ([70.174.168.108]) [70.174.168.108]:51125: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-12 17:32:19 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:54758: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-12-12 17:32:18 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:47670: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-12 17:32:38 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:57861: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-12 17:33:06 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:41894: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-12 17:33:25 dovecot_login authenticator failed for ([150.129.20.234]) [150.129.20.234]:33096: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-12 17:33:51 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:53566: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 17:33:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63108: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-12 17:34:19 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:41022: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 17:35:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<v6SMFcBFuOmB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.85
country_id: 3865483
description:
Dec 12 17:37:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=181.225.195.85, lip=66.85.158.91, TLS, session=<yJtHGMBF87+14cNV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.24
country_id: 3469034
description:
Dec 12 17:36:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.248.24, lip=66.85.158.91, TLS, session=<47P5FsBF/sy60fgY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.74
country_id: 1269750
description:
Dec 12 17:36:59 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=103.30.83.74, lip=66.85.158.91, TLS, session=<gr/eF8BF+NdnHlNK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.167
country_id: 3175395
description:
Dec 12 17:37:28 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.8.167, lip=66.85.158.91, TLS, session=<Nn31GcBFuqi5xQin>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 17:38:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<YTTrHcBFSNcro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-12 17:38:45 dovecot_login authenticator failed for ([125.23.243.66]) [125.23.41.122]:58282: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.41
country_id: 1733045
description:
2025-12-12 17:39:01 dovecot_login authenticator failed for ([49.124.153.41]) [49.124.153.41]:46502: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 17:39:14 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:57471: 535 Incorrect authentication data (set_id=director@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 17:39:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<K5uRIcBFVqmH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 17:39:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jTPMIcBFLKAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-12 17:39:49 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:65508: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 17:40:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<cy9MJMBFHJVntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 17:44:03 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (forted) [174.169.224.27]:49284: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 17:43:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<AdaoMMBFAos+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.46
country_id: 6252001
description:
Dec 12 17:44:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.228.53.46, lip=66.85.158.91, TLS, session=<ASKmM8BF8upC5DUu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 17:44:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<pNWIM8BFCrOLOxGe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.104
country_id: 6252001
description:
Dec 12 17:44:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.181.104, lip=66.85.158.92, TLS, session=<ZPR7NMBFRD0tT7Vo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 17:44:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<P7yqNMBFGMGB4kCN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 17:45:58 host2 sshd[701767]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 17:48:02 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (caleamas) [96.230.65.90]:48352: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 12 17:48:06 host2 sshd[703112]: Disconnected from invalid user user 2.57.121.25 port 53062 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-12 17:48:07 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:37750: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-12 17:47:59 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (frahings) [98.193.112.85]:42152: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-12 17:48:24 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:34436: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 17:49:40 host2 sshd[704190]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 17:51:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<FieQTMBFjNS8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-12-12 17:52:09 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:57404: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-12 17:52:28 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:41786: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-12 17:54:15 dovecot_plain authenticator failed for (acisly) [102.53.15.18]:51467: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 17:54:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<yaZrV8BF5ODAqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 12 17:55:22 host2 sshd[708905]: Disconnected from invalid user developer 68.183.224.170 port 58730 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 17:55:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<KQh9XMBFSJ+8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.47.135.155
country_id: 2510769
description:
2025-12-12 17:57:03 dovecot_login authenticator failed for 155.red-83-47-135.dynamicip.rima-tde.net [83.47.135.155]:55293: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 12 17:56:15 host2 sshd[709757]: Disconnected from invalid user simone 68.183.224.170 port 52480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.155.88.155
country_id: 2300660
description:
2025-12-12 17:57:20 dovecot_login authenticator failed for (88-155-41-155-dedicatedinternet.vodafone.com.gh) [41.155.88.155]:55242: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2025-12-12 17:57:38 dovecot_login authenticator failed for ([59.94.39.65]) [59.94.39.65]:37982: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2025-12-12 17:57:40 dovecot_login authenticator failed for ([152.52.227.94]) [152.52.227.94]:44174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-12 17:57:42 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:43284: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-12 17:57:11 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:41314: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-12 17:57:14 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:42087: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-12 17:59:04 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:38824: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 12 17:58:34 host2 sshd[711425]: Disconnected from invalid user user 68.183.224.170 port 33670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-12 17:58:41 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:60287: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 17:58:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<KtxQZ8BF+L2kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 17:59:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<mH6uacBFfONAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.184
country_id: 1880251
description:
Dec 12 18:01:55 host2 sshd[714301]: Disconnected from invalid user username 101.47.143.184 port 46636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 12 18:01:56 host2 sshd[714305]: Disconnected from invalid user sajid 103.106.194.74 port 51448 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 18:02:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<qdGNcsBFxI4I3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 12 18:01:32 host2 sshd[714049]: Disconnected from invalid user vncuser 51.89.166.236 port 46560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 18:02:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<w6nec8BFmJQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 18:02:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<27hVdMBFlpzCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 12 18:02:40 host2 sshd[715062]: Disconnected from invalid user admin 177.10.201.7 port 52308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 12 18:02:47 host2 sshd[715199]: Disconnected from invalid user ansible 51.89.166.236 port 57436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-12 18:02:56 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:57306: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 12 18:03:02 host2 sshd[715468]: Disconnected from invalid user zoom 103.144.247.233 port 55962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 12 18:03:20 host2 sshd[715939]: Disconnected from invalid user user6 51.89.166.236 port 60476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-12 18:03:24 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:39184: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Dec 12 18:03:48 host2 sshd[716330]: Disconnected from invalid user zgr 35.244.25.124 port 34660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 18:03:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<xfKOecBFKsYImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-12 18:03:13 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:41961: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-12 18:03:12 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:45850: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 12 18:03:34 host2 sshd[716186]: Disconnected from invalid user yuan 177.10.201.7 port 60886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-12-12 18:03:37 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:38441: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 12 18:03:29 host2 sshd[716122]: Disconnected from invalid user library 103.106.194.74 port 47954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 18:04:47 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (nonin) [24.15.216.41]:52138: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Dec 12 18:04:48 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<8wKwfMBF6LZChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 12 18:04:12 host2 sshd[716759]: Disconnected from invalid user vncuser 103.106.194.74 port 60318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 12 18:04:16 host2 sshd[716853]: Disconnected from invalid user novinhost 103.144.247.233 port 47448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2025-12-12 18:04:18 dovecot_login authenticator failed for ([102.164.35.116]) [102.164.35.116]:40996: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 18:05:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<0rVGfcBFIOSG0Wp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Dec 12 18:05:10 host2 sshd[717588]: Disconnected from invalid user vncuser 35.244.25.124 port 58960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 12 18:05:28 host2 sshd[717822]: Disconnected from invalid user db2inst1 103.144.247.233 port 45764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 18:05:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mkaff8BFisVm1bVi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 12 18:06:01 host2 sshd[718201]: Disconnected from invalid user aj 103.144.247.233 port 59030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.6
country_id: 226074
description:
Dec 12 18:05:14 host2 sshd[717631]: Disconnected from invalid user novinhost 196.0.120.6 port 57514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-12 18:05:24 dovecot_login authenticator failed for ([182.79.87.18]) [182.79.87.18]:33054: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 12 18:05:29 host2 sshd[717829]: Disconnected from invalid user sajid 51.89.166.236 port 47926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.16
country_id: 3996063
description:
2025-12-12 18:05:48 dovecot_login authenticator failed for (201.166.222.16-clientes-izzi.mx) [201.166.222.16]:45041: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 18:06:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<8qSOg8BFhu2kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 18:06:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<rFzdg8BF0tnD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Dec 12 18:06:51 host2 sshd[718907]: Disconnected from invalid user developer 187.62.87.27 port 40630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 12 18:06:18 host2 sshd[718421]: Disconnected from invalid user sajid 177.10.201.7 port 49496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Dec 12 18:06:30 host2 sshd[718505]: Disconnected from invalid user yuan 35.244.25.124 port 55032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 18:07:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<3kWPhsBFmryl6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 12 18:07:38 host2 sshd[719444]: Disconnected from invalid user mini 177.10.201.7 port 36902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 18:07:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<VUI0h8BFjoKWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Dec 12 18:07:09 host2 sshd[719152]: Disconnected from invalid user developer 101.47.48.255 port 34432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.57.170.71
country_id: 3895114
description:
Dec 12 18:07:33 host2 sshd[719401]: Disconnected from invalid user stperez 179.57.170.71 port 56624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.57.170.71
country_id: 3895114
description:
Dec 12 18:08:24 host2 sshd[719982]: Disconnected from invalid user ftpuser 179.57.170.71 port 16258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.62.87.27
country_id: 3469034
description:
Dec 12 18:08:10 host2 sshd[719878]: Disconnected from invalid user ircd 187.62.87.27 port 54656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Dec 12 18:09:42 host2 sshd[720803]: Disconnected from invalid user vivi 101.47.48.255 port 33256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.57.170.71
country_id: 3895114
description:
Dec 12 18:09:50 host2 sshd[720937]: Disconnected from invalid user zomboid 179.57.170.71 port 23254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 12 18:10:04 host2 sshd[721170]: Disconnected from invalid user devops 189.50.142.82 port 51317 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.153.64
country_id: 1880251
description:
2025-12-12 18:10:12 dovecot_login authenticator failed for ([175.156.153.64]) [175.156.153.64]:58241: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-12 18:10:36 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:55746: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 18:12:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<uGHmlsBFJuLD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.6
country_id: 226074
description:
Dec 12 18:12:19 host2 sshd[722851]: Disconnected from invalid user ftpuser 196.0.120.6 port 33398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 18:12:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<qvL2mMBF6M2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-12 18:13:31 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:41294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-12-12 18:13:43 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:39032: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-12 18:14:24 dovecot_plain authenticator failed for (empote) [192.81.229.179]:34014: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 12 18:14:36 host2 sshd[724424]: Disconnected from invalid user developer 189.50.142.82 port 43357 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.184
country_id: 1880251
description:
Dec 12 18:15:04 host2 sshd[724721]: Disconnected from invalid user egarcia 101.47.143.184 port 45784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 18:14:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pircus) [87.103.126.54]:29389: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 12 18:16:09 host2 sshd[725727]: Disconnected from invalid user deploy 189.50.142.82 port 36055 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 18:16:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<QhsopsBFDLkI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.224
country_id: 6252001
description:
2025-12-12 18:17:13 dovecot_login authenticator failed for wsip-184-191-242-224.fv.ks.cox.net [184.191.242.224]:37675: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 18:17:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<mShfqcBFWuAuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-12 18:17:24 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:56576: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 18:17:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<tzwGqsBFMLjO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.108
country_id: 1814991
description:
Dec 12 18:19:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=94.231.206.108, lip=66.85.158.91, session=<Mf3pr8BFQ65e585s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 18:19:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<S2LhssBFUk1etwuC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.108
country_id: 1814991
description:
Dec 12 18:19:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.108, lip=66.85.158.91, session=<hyySsMBFUeVe585s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.110
country_id: 1814991
description:
Dec 12 18:19:29 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.110, lip=66.85.158.91, session=<Cq43scBFxZxe585u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.35
country_id: 1814991
description:
Dec 12 18:19:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.35, lip=66.85.158.91, session=<ZJVvscBF/7Be584j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.149
country_id: 3469034
description:
Dec 12 18:20:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.209.247.149, lip=66.85.158.91, TLS, session=<It3os8BFbd260feV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 18:20:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ytjvtcBFsNo+PIde>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.246.209.88
country_id: 6252001
description:
[2025-12-12 18:20:53 +0530] info [webmaild] 185.246.209.88 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.65
country_id: 798544
description:
Dec 12 18:20:11 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=91.232.165.65, lip=66.85.158.91, TLS, session=<ka68ssBF7epb6KVB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-12 18:22:12 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:39479: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-12 18:22:30 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:39614: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-12 18:22:51 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:54192: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-12 18:23:02 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:35278: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.154.75
country_id: 1880251
description:
Dec 12 18:23:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=15.235.154.75, lip=66.85.158.91, session=<+MsPvsBFScMP65pL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.154.69
country_id: 1880251
description:
Dec 12 18:23:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=15.235.154.69, lip=66.85.158.91, session=<kfqvvsBFhacP65pF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.181
country_id: 3144096
description:
2025-12-12 18:23:21 dovecot_login authenticator failed for (181-162-97-62.cust.smartcall.no) [62.97.162.181]:58826: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.154.79
country_id: 1880251
description:
Dec 12 18:23:29 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=15.235.154.79, lip=66.85.158.91, session=<nkh+v8BFU70P65pP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.154.65
country_id: 1880251
description:
Dec 12 18:23:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=15.235.154.65, lip=66.85.158.91, session=<7zq5v8BF478P65pB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.18
country_id: 1733045
description:
2025-12-12 18:23:38 dovecot_login authenticator failed for ([49.124.151.18]) [49.124.151.18]:50266: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 18:24:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hsfDwcBFE6t100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 18:24:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<+1G7xMBFqoIIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-12 18:25:52 dovecot_plain authenticator failed for (tationders) [199.192.123.12]:39040: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 18:25:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<KuqMxcBFXBwvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-12 18:26:44 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:46346: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-12 18:26:57 dovecot_login authenticator failed for (nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:36200: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 18:27:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<9f0nzMBFVo1ntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 18:28:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<POOS0cBF+oNnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-12 18:28:59 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:46295: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-12-12 18:29:14 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:47160: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 18:30:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=</Ret2cBFDN9o1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-12 18:31:21 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:56657: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-12 18:31:28 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:50481: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 18:31:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<N3Da28BFTJAro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.191.141.128
country_id: 1512440
description:
2025-12-12 18:33:16 dovecot_plain authenticator failed for (cresemen) [185.191.141.128]:59134: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-12 18:34:26 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:51869: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 18:34:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<LZAy6MBFVqQ+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-12 18:34:12 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:57962: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 18:35:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<ipNK6sBF5KuH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 12 18:37:09 host2 sshd[741936]: Disconnected from invalid user gopal 152.42.231.101 port 44060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Dec 12 18:39:36 host2 sshd[743538]: Disconnected from invalid user mb 155.93.89.195 port 56966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.252
country_id: 6252001
description:
2025-12-12 18:39:10 dovecot_login authenticator failed for wsip-184-191-242-252.fv.ks.cox.net [184.191.242.252]:60932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-12 18:39:32 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:40398: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 18:40:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<oo18+8BFbNaB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.21
country_id: 1643084
description:
Dec 12 18:43:02 host2 sshd[746560]: Disconnected from invalid user ts 103.250.10.21 port 45198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Dec 12 18:43:37 host2 sshd[747038]: Disconnected from invalid user root2 155.93.89.195 port 39752 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-12 18:43:09 dovecot_login authenticator failed for ([186.238.157.140]) [187.9.247.58]:38718: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-12-12 18:43:22 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:37603: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.93.89.195
country_id: 2328926
description:
Dec 12 18:44:15 host2 sshd[747526]: Disconnected from invalid user frappe 155.93.89.195 port 44102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 12 18:44:31 host2 sshd[747773]: Disconnected from invalid user postgres 152.42.231.101 port 42502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Dec 12 18:45:43 host2 sshd[749440]: Disconnected from invalid user admin 168.167.228.123 port 33676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 12 18:46:19 host2 sshd[750235]: Disconnected from invalid user hussain 103.13.207.164 port 35280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 18:47:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<KVahFMFFVN3AqZl0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.21
country_id: 1643084
description:
Dec 12 18:47:35 host2 sshd[751259]: Disconnected from invalid user cacti 103.250.10.21 port 56224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 18:47:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<labQFcFFzrS8pkxr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 12 18:47:42 host2 sshd[751338]: Disconnected from invalid user teamspeak 152.42.231.101 port 51846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-12 18:48:42 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:42760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 12 18:48:57 host2 sshd[752536]: Disconnected from invalid user ts 103.13.207.164 port 36518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 18:49:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<EXL3GsFFUq+8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Dec 12 18:48:13 host2 sshd[751948]: Disconnected from invalid user tes 168.167.228.123 port 33679 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-12 18:48:30 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:57628: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 18:48:31 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:55887: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-12 18:49:20 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:60182: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Dec 12 18:49:24 host2 sshd[752864]: Disconnected from invalid user sally 155.93.89.195 port 46948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.21
country_id: 1643084
description:
Dec 12 18:49:40 host2 sshd[752975]: Disconnected from invalid user azureuser 103.250.10.21 port 42388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Dec 12 18:49:50 host2 sshd[753083]: Disconnected from invalid user readonly 168.167.228.123 port 33681 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 12 18:50:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<XFQ/HsFFsqVog7HN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.21
country_id: 1643084
description:
Dec 12 18:50:22 host2 sshd[753722]: Disconnected from invalid user vivek 103.250.10.21 port 40884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 18:50:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<PueRIcFFhu2kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 18:51:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<wzeEI8FFYL9AF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-12 18:52:10 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (thaturit) [98.204.134.124]:59930: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 12 18:52:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<o8k3JsFFhIjCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 12 18:52:21 host2 sshd[754882]: Disconnected from invalid user vivek 103.13.207.164 port 43866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-12 18:53:29 dovecot_plain authenticator failed for (heniumst) [102.53.15.56]:38016: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-12-12 18:53:51 dovecot_plain authenticator failed for (podli) [65.20.163.103]:37020: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.123
country_id: 6252001
description:
2025-12-12 18:53:53 dovecot_login authenticator failed for wsip-184-191-250-123.fv.ks.cox.net [184.191.250.123]:42813: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-12 18:54:19 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:40280: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-12-12 18:54:21 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:41424: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-12 18:54:22 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (cepinsodee) [24.91.103.202]:59968: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-12 18:54:39 dovecot_login authenticator failed for ([178.232.55.16]) [178.232.55.16]:48177: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 18:55:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<IY4dMMFFgsov/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2025-12-12 18:55:08 dovecot_login authenticator failed for ([208.69.161.214]) [208.69.161.214]:35335: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 18:55:33 host2 sshd[757525]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-12 18:55:38 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:37286: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 18:55:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<1eM7McFFLpkI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.200.91.217
country_id: 1269750
description:
Dec 12 18:56:25 host2 sshd[757985]: Disconnected from invalid user odoo 117.200.91.217 port 35162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 18:56:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Po6VNcFFQL3CBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 18:56:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<+3QWNsFFBMRm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 18:57:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<KJ/ON8FFtqvD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 18:57:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<kAWLOsFF0r4v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-12 18:58:01 dovecot_login authenticator failed for ([182.78.241.30]) [182.78.241.30]:47058: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-12 18:58:21 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:39931: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.157.144
country_id: 2921044
description:
[2025-12-12 18:58:33 +0530] info [cpaneld] 213.209.157.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 18:58:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<mDSiPcFFGqykXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.44
country_id: 6252001
description:
2025-12-12 18:59:46 dovecot_login authenticator failed for ([98.181.46.44]) [98.181.46.44]:35414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-12 19:00:12 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:48329: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-12 19:01:59 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (supes) [68.193.149.88]:47825: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 19:02:02 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (eadie) [96.230.65.90]:42628: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 12 19:02:08 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS: Connection closed, session=<x8PDScFFhi9ChJl5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 19:02:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<N3cLS8FFLI3D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 19:03:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<6b/xTsFF9sc+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 19:03:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<VpUdT8FFaouG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 19:03:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<kJ/oT8FFiqSl6L5h>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 19:04:16 host2 sshd[763920]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 19:04:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<gR5lUcFF/smnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-12-12 19:05:03 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:55065: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 19:05:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<E6yWVMFFMsaKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-12-12 19:05:23 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:54258: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 19:05:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<9Gs+V8FFuqKWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 12 19:06:30 host2 sshd[765114]: Disconnected from invalid user smbuser 34.85.163.94 port 45016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.156.63
country_id: 1269750
description:
Dec 12 19:06:42 host2 sshd[765226]: Disconnected from invalid user alex 64.227.156.63 port 58580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 19:06:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<YQIMWsFFPtUImxNM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.236.46
country_id: 241170
description:
Dec 12 19:07:44 host2 sshd[765745]: Disconnected from invalid user smbuser 156.238.236.46 port 46952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 19:07:50 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (oboklity) [174.169.224.27]:45666: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.254.184.159
country_id: 1269750
description:
2025-12-12 19:08:16 dovecot_plain authenticator failed for (X58MAJ152S6) [38.254.184.159]:53632: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.236.46
country_id: 241170
description:
Dec 12 19:10:00 host2 sshd[766937]: Disconnected from invalid user dimas 156.238.236.46 port 47490 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 19:10:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<j0UDZsFFasQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
country_id: 1269750
description:
2025-12-12 19:09:28 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:50022: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-12-12 19:09:45 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:30254: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 19:11:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<eXeFacFF1sAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 12 19:10:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Y3K8ZsFFXswv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.156.63
country_id: 1269750
description:
Dec 12 19:10:25 host2 sshd[767419]: Disconnected from invalid user smbuser 64.227.156.63 port 51078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 12 19:10:37 host2 sshd[767513]: Disconnected from invalid user dimas 118.26.39.178 port 60424 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-12 19:10:40 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (dited) [73.27.33.174]:56114: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 12 19:11:17 host2 sshd[767901]: Disconnected from invalid user logviewer 118.26.39.178 port 42492 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 12 19:11:45 host2 sshd[768065]: Disconnected from invalid user app 34.85.163.94 port 43612 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 19:13:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<ffHlcsFFkKPO7iqJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 12 19:13:30 host2 sshd[769611]: Disconnected from invalid user ubuntu 118.26.39.178 port 55582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 19:14:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<hJXydcFFAJtntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.113.218
country_id: 953987
description:
2025-12-12 19:14:41 dovecot_login authenticator failed for ([196.25.113.220]) [196.25.113.218]:58225: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-12 19:14:44 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:38004: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-12 19:14:58 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:60574: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 19:14:11 host2 sshd[770252]: Disconnected from invalid user  62.60.131.157 port 44978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-12 19:15:07 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:34662: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 19:15:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<DHwqeMFFlnBetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.200.91.217
country_id: 1269750
description:
Dec 12 19:15:37 host2 sshd[771417]: Disconnected from invalid user frappe 117.200.91.217 port 38547 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-12 19:15:43 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:41306: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-12 19:16:22 dovecot_login authenticator failed for (static.92.254.104.190.cps.com.ar) [190.104.254.91]:40684: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.236.46
country_id: 241170
description:
Dec 12 19:16:42 host2 sshd[772046]: Disconnected from invalid user yy 156.238.236.46 port 34692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 19:20:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<iaWWicFFZo6B4gum>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.200.91.217
country_id: 1269750
description:
Dec 12 19:20:21 host2 sshd[774823]: Disconnected from invalid user kapsch 117.200.91.217 port 53090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-12-12 19:20:40 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:40020: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-12 19:21:01 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:37135: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 19:21:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<WloVkMFFBo4vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-12 19:21:22 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:51714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-12-12 19:21:37 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:46118: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 19:21:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<RtpUj8FFEtF100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.157.144
country_id: 2921044
description:
[2025-12-12 19:21:40 +0530] info [cpaneld] 213.209.157.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.161
country_id: 1269750
description:
Dec 12 19:21:48 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@v-deploy.com>, method=PLAIN, rip=103.104.127.161, lip=66.85.158.91, TLS, session=<s6qujsFFi95naH+h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.89.57.52
country_id: 1269750
description:
Dec 12 19:22:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=103.89.57.52, lip=66.85.158.91, TLS, session=<IjemkMFFRchnWTk0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-12 19:22:26 dovecot_plain authenticator failed for (dious) [65.20.148.194]:52619: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-12 19:22:29 dovecot_plain authenticator failed for (irralneuss) [24.105.248.218]:36766: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 19:22:29 dovecot_plain authenticator failed for (blermos) [65.20.164.137]:39187: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 19:24:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<dl9WmcFFoJ4+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 19:24:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<bBhjmsFFqsuLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 19:25:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<caxCnMFF2IYro2np>


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 49.43.231.64
country_id: 1269750
description:
2025-12-12 19:27:00 dovecot_login authenticator failed for (UJZECE2W) [49.43.231.64]:60726: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 19:26:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<PSp+n8FFkpJnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.231.64
country_id: 1269750
description:
2025-12-12 19:26:45 dovecot_plain authenticator failed for (738K4S3IJ) [49.43.231.64]:57433: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 49.43.231.64
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[49.43.231.64] [Authentication Database]=[mail] (5/5 failures) (blocked until [Fri Dec 12 14:11:58 2025 UTC/Fri Dec 12 19:41:58 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 19:28:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (luctichit) [87.103.126.54]:7736: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 19:28:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<N0Iqp8FFaNMIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-12 19:30:55 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:51812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 19:31:49 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (throing) [96.230.65.90]:52714: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-12 19:31:53 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (hectickee) [24.15.216.41]:33262: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Dec 12 19:31:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 22 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<lC5RtMFFy86TuYXK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-12 19:31:46 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:53462: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Dec 12 19:32:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<WLGRt8FF3uWTuYXK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 19:33:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<vCXHuMFFtNqH6yFP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Dec 12 19:33:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<HKdVucFFFvyTuYXK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-12 19:34:53 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:49750: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-12 19:35:12 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:59116: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 19:37:49 host2 sshd[787779]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 19:37:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<a0B3ycFFrOiB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-12-12 19:38:38 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (roaric) [95.229.5.248]:45486: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-12 19:39:56 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:32884: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-12 19:40:08 dovecot_login authenticator failed for (cm-84.214.63.110.get.no) [84.214.63.110]:45216: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Dec 12 19:40:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS, session=<2pHd0cFFeuqTuYXK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-12 19:40:18 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (inted) [217.215.74.195]:54294: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-12 19:42:03 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:53463: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-12-12 19:41:24 dovecot_login authenticator failed for ([49.124.152.172]) [49.124.152.172]:55450: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 19:41:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<TD9B18FFBuu8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 19:43:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<CqLA28FF7uDAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-12 19:44:32 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (polebed) [67.172.54.29]:32836: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-12-12 19:44:20 dovecot_plain authenticator failed for (unspic) [65.20.163.103]:35463: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 19:45:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<lhrx5cFF+qmkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-12 19:45:56 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:53389: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-12 19:46:09 dovecot_login authenticator failed for 24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:60998: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 19:46:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<tKyB58FFpudAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-12 19:46:47 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:59607: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-12 19:47:02 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:35802: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 19:48:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<YQ4F78FF+sy8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 19:49:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (oving) [87.103.126.54]:46679: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-12 19:49:24 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:33904: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-12 19:50:05 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:34076: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 19:50:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<5okW9sFF3OBm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 19:51:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<nIfQ+sFFbOwI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 19:51:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Vmrg+cFFOK7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 19:53:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<4SEDAMJF1IHCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 19:54:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<+TiJBMJFbtykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 19:55:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<bZSYCcJF9O0v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-12 19:56:34 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:40300: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-12 19:57:01 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:34726: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 19:57:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<JtmpDsJFSu3D+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.165.14.197
country_id: 3469034
description:
Dec 12 19:57:27 host2 sshd[804350]: Disconnected from invalid user cinema 45.165.14.197 port 9593 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-12 19:58:24 dovecot_login authenticator failed for ([125.20.183.201]) [27.123.90.94]:43910: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-12 19:58:42 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:53404: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.165.14.197
country_id: 3469034
description:
Dec 12 19:58:53 host2 sshd[805715]: Disconnected from invalid user test 45.165.14.197 port 29781 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 12 19:59:17 host2 sshd[806152]: Disconnected from invalid user mcserver 78.100.64.148 port 40432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec 12 19:59:21 host2 sshd[806219]: Disconnected from invalid user ociistst 190.129.122.12 port 49698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.165.14.197
country_id: 3469034
description:
Dec 12 19:59:33 host2 sshd[806468]: Disconnected from invalid user prowlarr 45.165.14.197 port 9528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-12 20:00:16 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:55862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-12 20:00:34 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (lants) [96.230.65.90]:42318: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2025-12-12 20:00:54 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:55105: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 20:01:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<8+UZHcJFUM2KxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec 12 20:01:26 host2 sshd[808794]: Disconnected from invalid user minecraft 190.129.122.12 port 49688 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 20:02:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<Hi1EIMJFaKil6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 12 20:02:31 host2 sshd[810067]: Disconnected from invalid user minecraft 78.100.64.148 port 37867 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-12 20:03:54 dovecot_plain authenticator failed for (subble) [65.20.164.137]:53983: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 20:03:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<U3muJsJFiLKG0Wp/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Dec 12 20:03:18 host2 sshd[811230]: Disconnected from invalid user ardi 78.100.64.148 port 33779 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-12 20:03:23 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:34700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-12 20:03:43 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:52089: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 20:04:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<jaeIKMJFJsJntrtb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 12 20:04:57 host2 sshd[813947]: Disconnected from invalid user mc 78.100.64.148 port 63875 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 20:06:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<QQU7LsJFgMKWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-12 20:05:19 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:46164: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-12 20:05:22 dovecot_login authenticator failed for (nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:57246: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-12 20:05:35 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:50174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-12 20:05:35 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:42922: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-12 20:06:28 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:57999: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-12 20:06:53 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:47869: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 20:06:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<UXYrMcJF3NcI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 20:08:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<QCVXNcJFRtYuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-12 20:08:25 dovecot_plain authenticator failed for (facadolod) [185.214.169.10]:59996: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 20:10:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<PjmLPMJFmqI+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 12 20:10:20 host2 sshd[820791]: Disconnected from invalid user steam 101.47.51.7 port 51756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 20:11:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<6Bz0P8JFGuQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 20:11:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<XEeHQMJFWpg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-12 20:11:26 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:47296: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 12 20:11:30 host2 sshd[821589]: Disconnected from invalid user sysadmin 101.47.51.7 port 53850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.195
country_id: 1733045
description:
2025-12-12 20:11:59 dovecot_login authenticator failed for ([49.124.159.195]) [49.124.159.195]:44252: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-12 20:12:09 dovecot_login authenticator failed for ([182.95.63.50]) [182.95.63.50]:55512: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 20:12:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<aR/MRMJFhWZetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-12 20:12:31 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:45888: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 12 20:12:40 host2 sshd[822588]: Disconnected from invalid user daniel 101.47.51.7 port 56474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 20:12:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<prA5RsJFWtfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 20:14:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<CpJ4S8JF+oZo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 20:16:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<h5KLU8JFKreB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.174
country_id: 3469034
description:
Dec 12 20:19:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.247.174, lip=66.85.158.91, TLS, session=<rPZTXcJFo6q60feu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.170
country_id: 3865483
description:
Dec 12 20:19:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=190.122.128.170, lip=66.85.158.91, TLS, session=<k2qUXsJFwrW+eoCq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-12 20:20:07 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (ducyma) [73.213.237.28]:46748: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 20:20:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1BgeYcJFrUl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.182.166.112
country_id: 3865483
description:
2025-12-12 20:20:24 dovecot_login authenticator failed for ([190.182.166.112]) [190.182.166.112]:42750: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 20:20:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<KqtEYsJFuqAro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.5
country_id: 1733045
description:
2025-12-12 20:20:43 dovecot_login authenticator failed for ([49.124.151.5]) [49.124.151.5]:40742: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 20:21:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<NxwzZMJFsrwvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-12 20:21:34 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:56880: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.239
country_id: 6252001
description:
2025-12-12 20:21:54 dovecot_login authenticator failed for wsip-184-191-242-239.fv.ks.cox.net [184.191.242.239]:52132: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 20:24:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<88rIbsJFfMFnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2025-12-12 20:25:37 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:36446: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-12 20:25:52 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:35210: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 20:26:21 host2 sshd[834592]: Disconnected from invalid user admin 2.57.121.112 port 47392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.123.2.69
country_id: 617790
description:
Dec 12 20:27:59 host2 sshd[835907]: Disconnected from invalid user ali 176.123.2.69 port 38758 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 20:28:53 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (dulned) [174.169.224.27]:44822: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.224.67
country_id: 2635167
description:
Dec 12 20:29:20 host2 sshd[837319]: Disconnected from invalid user ubuntu 104.28.224.67 port 40262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 12 20:29:47 host2 sshd[837667]: Disconnected from invalid user ibrahim 23.95.128.167 port 46346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.28
country_id: 3469034
description:
Dec 12 20:30:15 host2 sshd[838229]: Disconnected from invalid user user 102.211.152.28 port 59500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2025-12-12 20:30:50 dovecot_login authenticator failed for ([2.196.202.17]) [2.196.202.17]:41766: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-12 20:30:54 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:14734: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.123.2.69
country_id: 617790
description:
Dec 12 20:31:47 host2 sshd[839380]: Disconnected from invalid user seedbox 176.123.2.69 port 49004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 20:31:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<+Zd4isJFsLIIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.67
country_id: 2635167
description:
Dec 12 20:31:58 host2 sshd[839487]: Disconnected from invalid user mysqluser 104.28.192.67 port 19843 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.66
country_id: 2635167
description:
Dec 12 20:31:19 host2 sshd[839081]: Disconnected from invalid user zeeshan 104.28.192.66 port 37949 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.28
country_id: 3469034
description:
Dec 12 20:31:37 host2 sshd[839251]: Disconnected from invalid user ubuntu 102.211.152.28 port 45008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-12 20:31:08 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:56674: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.153
country_id: 6252001
description:
2025-12-12 20:32:02 dovecot_login authenticator failed for ([98.185.120.153]) [98.185.120.153]:33119: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-12 20:32:16 dovecot_login authenticator failed for ([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 12 20:32:32 host2 sshd[840003]: Disconnected from invalid user user 103.139.192.221 port 53780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Dec 12 20:32:46 host2 sshd[840206]: Disconnected from invalid user unreal 128.199.157.145 port 36726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Dec 12 20:33:48 host2 sshd[841130]: Disconnected from invalid user seedbox 185.193.240.246 port 50350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.67
country_id: 2635167
description:
Dec 12 20:33:53 host2 sshd[841196]: Disconnected from invalid user debian 104.28.192.67 port 46108 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 12 20:33:21 host2 sshd[840667]: Disconnected from invalid user linuxacademy 103.139.192.221 port 37212 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.212
country_id: 6252001
description:
Dec 12 20:35:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.212, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+d0dlsJFf86TuYXU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.123.2.69
country_id: 617790
description:
Dec 12 20:34:06 host2 sshd[841440]: Disconnected from invalid user minecraft 176.123.2.69 port 56696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 12 20:34:42 host2 sshd[841867]: Disconnected from invalid user john 23.95.128.167 port 44108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 20:34:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<uzPxlMJFOJ2H6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.67
country_id: 2635167
description:
Dec 12 20:35:09 host2 sshd[842380]: Disconnected from invalid user hyperchain 104.28.192.67 port 32162 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.212
country_id: 6252001
description:
Dec 12 20:35:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=147.185.133.212, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<YJ/Ql8JFxOiTuYXU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.28.192.67
country_id: 2635167
description:
Dec 12 20:35:49 host2 sshd[842949]: Disconnected from invalid user yekta 104.28.192.67 port 12055 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.228.48
country_id: 6252001
description:
Dec 12 20:35:57 host2 sshd[843050]: Disconnected from invalid user ibrahim 137.184.228.48 port 49192 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:36:52 host2 sshd[843857]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-12 20:36:38 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:40456: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 20:36:39 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (decardruis) [87.103.126.54]:64381: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 12 20:36:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<LVyvm8JF0sXBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.89.127
country_id: 6252001
description:
Dec 12 20:36:06 host2 sshd[843202]: Disconnected from invalid user wow 172.190.89.127 port 45674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Dec 12 20:36:17 host2 sshd[843350]: Disconnected from invalid user asd 128.199.157.145 port 41246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 20:36:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<oruymsJFVtqB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.228.48
country_id: 6252001
description:
Dec 12 20:36:32 host2 sshd[843619]: Disconnected from invalid user testuser1 137.184.228.48 port 34990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-12 20:36:57 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:48108: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:37:33 host2 sshd[844571]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 20:37:11 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unbowee) [87.103.126.54]:35599: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-12 20:37:41 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (cosesed) [73.88.196.91]:43754: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Dec 12 20:37:52 host2 sshd[844890]: Disconnected from invalid user lisa 185.193.240.246 port 51930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-12 20:38:00 dovecot_login authenticator failed for ([125.20.245.194]) [125.20.245.194]:38136: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.123.2.69
country_id: 617790
description:
Dec 12 20:37:07 host2 sshd[844188]: Disconnected from invalid user sbserver 176.123.2.69 port 53150 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:38:12 host2 sshd[845167]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.228.48
country_id: 6252001
description:
Dec 12 20:38:48 host2 sshd[845784]: Disconnected from invalid user ali 137.184.228.48 port 54494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-12 20:38:06 dovecot_plain authenticator failed for (imbenthy) [24.93.140.162]:58880: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-12 20:38:33 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:37662: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 20:39:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<xk+PpMJF7uPAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 20:39:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<ykbopMJF2oW8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.228.48
country_id: 6252001
description:
Dec 12 20:39:23 host2 sshd[846234]: Disconnected from invalid user gituser 137.184.228.48 port 60020 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:40:51 host2 sshd[847747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-12 20:40:54 dovecot_login authenticator failed for c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:35413: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 20:41:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Hx8drMJFcOo+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Dec 12 20:41:20 host2 sshd[848334]: Disconnected from invalid user botuser 107.150.106.178 port 51556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-12 20:41:31 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:49196: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.224.66
country_id: 2635167
description:
Dec 12 20:41:53 host2 sshd[848868]: Disconnected from invalid user wow 104.28.224.66 port 56236 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.212
country_id: 6252001
description:
Dec 12 20:42:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.212, lip=66.85.158.92, TLS, session=<GPrascJFauWTuYXU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 20:42:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<G8yrr8JF6IGkXGTY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Dec 12 20:42:17 host2 sshd[849296]: Disconnected from invalid user ubuntu 107.150.106.178 port 35620 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 20:42:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<fi+EsMJFNNZAF6S9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:44:24 host2 sshd[850777]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 20:44:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KR2xuMJFSJanrKy4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:45:49 host2 sshd[852320]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 20:45:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<b9fxusJF6rJm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 12 20:45:46 host2 sshd[852301]: Disconnected from invalid user myuser 45.61.187.30 port 51284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 20:45:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<fSPRvMJFBqHD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2025-12-12 20:46:59 dovecot_login authenticator failed for ([82.102.158.36]) [82.102.158.36]:54369: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.28.224.66
country_id: 2635167
description:
Dec 12 20:46:51 host2 sshd[853535]: Disconnected from invalid user user 104.28.224.66 port 16492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-12 20:46:55 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (gamicra) [196.47.172.253]:41472: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:47:23 host2 sshd[853951]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 12 20:47:48 host2 sshd[854286]: Disconnected from invalid user arash 45.61.187.30 port 56698 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 20:47:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<jUgExMJFRMAI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-12-12 20:47:11 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:49096: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.66
country_id: 2635167
description:
Dec 12 20:47:30 host2 sshd[854028]: Disconnected from invalid user test 104.28.192.66 port 38828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 20:48:56 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (carier) [87.103.126.54]:37345: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 20:48:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<0JmVxcJFirG8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 12 20:48:35 host2 sshd[854858]: Disconnected from invalid user mcadmin 45.61.187.30 port 42584 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:49:19 host2 sshd[855486]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 20:49:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<+H8ky8JFgqTCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 12 20:50:07 host2 sshd[856204]: Disconnected from invalid user wifi 45.61.187.30 port 42600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 20:50:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<GxWnzcJF8NOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.186
country_id: 3469034
description:
Dec 12 20:50:43 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=186.209.247.186, lip=66.85.158.91, TLS, session=<dduizMJF1uO60fe6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.212.90
country_id: 933860
description:
Dec 12 20:51:04 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=41.216.212.90, lip=66.85.158.91, TLS, session=<7M02zsJFH50p2NRa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 20:51:42 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:41344: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 20:51:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<9g910cJFgubD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-12-12 20:52:05 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:32950: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 20:53:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<N7ML18JFJK4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 20:54:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<wX6m28JF/rRntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-12 20:56:29 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:57882: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.226.192
country_id: 6251999
description:
2025-12-12 20:56:07 dovecot_login authenticator failed for host-24-224-226-192.public.eastlink.ca [24.224.226.192]:56724: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-12 20:56:12 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:53061: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.234
country_id: 3996063
description:
2025-12-12 20:56:18 dovecot_login authenticator failed for (201.173.216.234-clientes-izzi.mx) [201.173.216.234]:58234: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-12 20:57:15 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:51428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-12 20:57:27 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:48944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 20:57:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<J0Xg58JFdIqKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-12 20:58:37 dovecot_plain authenticator failed for (chils) [80.227.102.242]:51751: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 20:58:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<c6KD6sJFjOA+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 21:00:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<RBd28cJF0tKl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-12-12 21:02:10 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:53708: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-12 21:02:32 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:57265: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-12 21:03:01 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:58856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 21:03:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<oyDA+sJFWscI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-12 21:03:22 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:43898: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 21:04:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<+pQ1/sJFuuGG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 21:04:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<OljIAMNF+sCWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 21:05:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<GjOzAcNFZtUuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-12-12 21:05:24 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:58618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-12-12 21:05:41 dovecot_login authenticator failed for (SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:38724: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 21:06:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<tuiwBMNFLNk+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 21:06:49 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (prous) [71.224.169.28]:50690: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 21:08:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<pGl7DcNFkIuLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 21:09:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<m3VdEcNFaOI+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 21:09:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lapxEcNFSkBetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-12 21:10:49 dovecot_plain authenticator failed for (villiders) [178.250.191.189]:54124: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 21:11:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<LV8pGMNFBszO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 21:15:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<XT/eJMNFfLsImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-12 21:16:00 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:39215: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-12 21:16:57 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:50446: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.108
country_id: 6252001
description:
Dec 12 21:16:15 host2 pure-ftpd[875816]: (?@205.210.31.108) [INFO] New connection from 205.210.31.108


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 21:16:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<t2BNKsNFrsIro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-12-12 21:16:44 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:32893: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-12 21:18:35 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (inatiert) [73.129.57.71]:51326: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-12 21:18:51 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:53756: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-12 21:19:02 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:51927: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 21:19:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jxDrM8NFQlZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 21:19:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<KzQhNsNFrOsvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.62
country_id: 6252001
description:
Dec 12 21:21:26 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.62, lip=66.85.158.91, session=<eO/kO8NF5YxomDQ+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.193.85
country_id: 1269750
description:
Dec 12 21:21:30 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@v-deploy.com>, method=PLAIN, rip=103.213.193.85, lip=66.85.158.91, TLS, session=<X3jiOsNFodFn1cFV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.100.10
country_id: 1269750
description:
2025-12-12 21:21:33 dovecot_login authenticator failed for (abts-west-static-208.237.201.106.airtelbroadband.in) [103.218.100.10]:41106: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-12 21:21:45 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:39428: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.98.65
country_id: 3469034
description:
Dec 12 21:21:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.240.98.65, lip=66.85.158.91, TLS, session=<FJ5HPMNFsui/8GJB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-12-12 21:22:01 dovecot_login authenticator failed for (14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:58159: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-12 21:22:25 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:58938: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.12.253.153
country_id: 6252001
description:
Dec 12 21:22:26 host2 sshd[879712]: Disconnected from invalid user pivpn 154.12.253.153 port 42330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 21:22:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<sPahP8NFnL9npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-12 21:22:59 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:41925: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.221.244.34
country_id: 878675
description:
Dec 12 21:23:24 host2 sshd[880375]: Disconnected from invalid user i 197.221.244.34 port 60220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.12.253.153
country_id: 6252001
description:
Dec 12 21:23:49 host2 sshd[880632]: Disconnected from invalid user git 154.12.253.153 port 42438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-12 21:23:17 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:37583: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.90
country_id: 1643084
description:
Dec 12 21:24:25 host2 sshd[881120]: Disconnected from invalid user test 116.193.191.90 port 40498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.12.253.153
country_id: 6252001
description:
Dec 12 21:24:32 host2 sshd[881196]: Disconnected from invalid user ubuntu 154.12.253.153 port 42494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.244.34
country_id: 878675
description:
Dec 12 21:25:47 host2 sshd[882290]: Disconnected from invalid user yuxiang 197.221.244.34 port 38200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.12.253.153
country_id: 6252001
description:
Dec 12 21:25:54 host2 sshd[882401]: Disconnected from invalid user ubuntu 154.12.253.153 port 42606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.67
country_id: 2300660
description:
Dec 12 21:27:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=41.139.11.67, lip=66.85.158.91, TLS, session=<mdwwUMNFK8spiwtD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.207
country_id: 3865483
description:
Dec 12 21:27:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=190.181.97.207, lip=66.85.158.91, TLS, session=<mQGFUcNF++C+tWHP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-12 21:27:52 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:57414: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.215
country_id: 3996063
description:
2025-12-12 21:27:51 dovecot_login authenticator failed for ([177.236.145.215]) [177.236.145.215]:37194: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-12 21:28:04 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:57910: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-12-12 21:28:06 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:35080: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.244.34
country_id: 878675
description:
Dec 12 21:27:23 host2 sshd[883452]: Disconnected from invalid user hadoop 197.221.244.34 port 47538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.90
country_id: 1643084
description:
Dec 12 21:28:15 host2 sshd[883873]: Disconnected from invalid user markus 116.193.191.90 port 36162 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 21:29:25 host2 sshd[884612]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.90
country_id: 1643084
description:
Dec 12 21:29:47 host2 sshd[884799]: Disconnected from invalid user dmdba 116.193.191.90 port 47630 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.88
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.88: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 21:33:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<oGuRZ8NF6Mc+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 21:33:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<pm+gaMNFioqH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 21:34:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<xY2aacNFZKC8pkxr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.10
country_id: 798549
description:
Dec 12 21:35:35 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.10, lip=66.85.158.91, TLS: Connection closed, session=<g4WLbsNFOe1V2YwK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-12 21:36:08 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:43524: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 21:35:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<hk9ybcNFxIMIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 21:35:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<6hS/bcNFEOzAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.247
country_id: 1733045
description:
2025-12-12 21:36:30 dovecot_login authenticator failed for ([49.124.150.247]) [49.124.150.247]:37826: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 21:36:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<BQl0csNFZuGB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.113
country_id: 6252001
description:
2025-12-12 21:37:28 dovecot_login authenticator failed for wsip-184-191-250-113.fv.ks.cox.net [184.191.250.113]:52862: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.89.22.113
country_id: 3469034
description:
2025-12-12 21:37:44 dovecot_login authenticator failed for (177-89-22-113.cable.cabotelecom.com.br) [177.89.22.113]:40932: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-12 21:37:46 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:53528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-12 21:37:14 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:57220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 21:38:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<fW3/eMNFbJ+kXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-12 21:38:37 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (redeoutin) [76.145.10.140]:34624: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-12 21:38:42 dovecot_plain authenticator failed for (jectoes) [91.73.188.251]:40731: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 21:38:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<GQatecNFAoZAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 21:39:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<bmIAfsNFPuxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 21:40:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<fyfLfsNFcNrD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-12 21:41:54 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:40740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-12 21:43:04 dovecot_plain authenticator failed for (proma) [178.250.191.189]:42156: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 21:43:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<BWfIi8NFoqpntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 21:44:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<u5DrjcNFIIcI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-12 21:45:08 dovecot_plain authenticator failed for (prent) [5.26.190.79]:35764: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-12 21:45:15 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (squalnes) [73.183.74.177]:38502: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 21:45:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<cSNyk8NFzN3D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-12 21:46:02 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:58714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-12 21:46:17 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:56600: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-12 21:46:17 dovecot_login authenticator failed for ([125.18.154.73]) [182.95.226.118]:42464: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-12 21:46:35 dovecot_login authenticator failed for (187-163-97-62.cust.smartcall.no) [62.97.163.187]:50390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 21:46:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<8C1IlsNFWq6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 21:46:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<SPl9lsNFlqnCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-12 21:47:24 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:50619: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 21:47:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<oICkmcNFTpe8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-12 21:48:06 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:54570: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 21:48:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<LIxAnMNFatU+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 21:48:58 host2 sshd[899762]: Disconnected from invalid user  62.60.131.157 port 11562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 21:50:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<kF/LpMNFotsv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-12 21:52:04 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:43433: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 21:51:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49640: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-12-12 21:52:24 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:51832: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-12 21:52:50 dovecot_login authenticator failed for (cm-84.210.149.45.get.no) [84.210.149.45]:52563: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-12 21:53:55 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:60878: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 21:54:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<kbOfsMNFfpCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.146
country_id: 3996063
description:
2025-12-12 21:53:16 dovecot_login authenticator failed for (187.161.222.146-clientes-izzi.mx) [187.161.222.146]:60285: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 21:57:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<b25/vMNFSJ9o1joy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.217
country_id: 6252001
description:
Dec 12 21:57:25 host2 pure-ftpd[905933]: (?@205.210.31.217) [INFO] New connection from 205.210.31.217


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 21:59:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<zHfywsNFYNCl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 21:59:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<KqxcxMNFwN0I3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.67.75
country_id: 1880251
description:
Dec 12 22:00:36 host2 sshd[909060]: Invalid user cloudtourssrilan_travel from 167.172.67.75 port 46480


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 22:02:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<u/8PzcNFAtMuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.53.36.78
country_id: 2510769
description:
Dec 12 22:02:45 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=195.53.36.78, lip=66.85.158.91, TLS, session=<vNOkzsNFGgrDNSRO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.132
country_id: 3865483
description:
Dec 12 22:03:07 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.181.101.132, lip=66.85.158.91, TLS, session=<AcjZz8NFSLa+tWWE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 22:02:14 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:46441: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-12 22:02:26 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:45176: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 22:03:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<vm6g0cNFdLOG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 22:03:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<UvT50cNFsKuWXx+e>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Dec 12 22:03:38 host2 pure-ftpd[923391]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-12 22:06:42 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:38220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 22:06:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<2K8m3sNFoPJetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-12 22:07:00 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:40214: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-12 22:08:23 dovecot_plain authenticator failed for (penticary) [102.53.15.180]:35693: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 22:08:27 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (anjugaha) [174.169.224.27]:33382: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 22:08:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ZmT548NFZLU+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 22:09:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<35q358NF6tvO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.173
country_id: 6251999
description:
2025-12-12 22:11:09 dovecot_login authenticator failed for ([207.134.139.173]) [207.134.139.173]:14839: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 12 22:10:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<WD/M68NF2ObCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-12-12 22:10:42 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:58716: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-12 22:10:54 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:42013: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 22:11:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<LDt378NFBJsro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-12 22:11:47 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:59653: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-12 22:12:30 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:58563: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-12 22:12:45 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:57462: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 22:13:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<//v79sNFeNKB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 22:17:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dSHtBcRFuuh100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-12 22:18:03 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:58804: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 22:17:13 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:51074: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 22:17:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Qt5lA8RFADQvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-12 22:17:17 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (imedly) [73.13.220.220]:42680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-12 22:17:31 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:59390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2025-12-12 22:18:21 dovecot_login authenticator failed for (nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:56572: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 22:18:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<D+ycB8RFGqAImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 22:19:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<CfT8C8RFZJRnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 22:19:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Z4Z/DMRFjpU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 22:22:13 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (cohens) [71.224.169.28]:43938: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 22:24:45 host2 sshd[938179]: Disconnected from invalid user admin 2.57.121.112 port 29227 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.164.170.242
country_id: 6252001
description:
Dec 12 22:24:46 host2 pure-ftpd[938220]: (?@54.164.170.242) [INFO] New connection from 54.164.170.242


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 22:25:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<IEeWIMRFLMOnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-12 22:27:42 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:35288: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-12-12 22:28:04 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:41290: 535 Incorrect authentication data (set_id=contact)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 197.147.233.193
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[197.147.233.193] [Remote Port]=[11839] [Authentication Database]=[system] [Username]=[info] (5/5 failures) (blocked until [Fri Dec 12 17:14:10 2025 UTC/Fri Dec 12 22:44:10 2025 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:28:24 +0530] info [cpaneld] 197.147.233.193 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 22:28:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<OnqcLMRFuo68pkxr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 12 22:29:07 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<VsL1LcRFsBDY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 12 22:29:21 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, TLS: Connection closed, session=<dtTNLsRF3ELY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Dec 12 22:29:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.68, lip=66.85.158.91, session=<mU0vL8RFot24aYtE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:29:55 +0530] info [cpaneld] 197.147.233.193 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:29:56 +0530] info [cpaneld] 197.147.233.193 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user cloudtourssrilan) has locked out IP 197.147.233.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:30:42 +0530] info [cpaneld] 197.147.233.193 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user cloudtourssrilan) has locked out IP 197.147.233.193


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 197.147.233.193
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[197.147.233.193] [Remote Port]=[9960] [Authentication Database]=[system] [Username]=[cloudtourssrilan_travel] (10/10 failures) (blocked until [Sat Dec 13 17:00:41 2025 UTC/Sat Dec 13 22:30:41 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 22:32:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<MzVIOMRFMK2H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 22:31:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<n/G3NcRFGIPAqZl0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:31:27 +0530] info [whostmgrd] 197.147.233.193 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user info@cloudtourssrilanka.com) has locked out IP 197.147.233.193


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 22:32:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<4cqyOcRFftdntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-12 22:33:03 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (intla) [24.91.103.202]:35730: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:33:17 host2 sshd[944085]: Disconnected from invalid user hb 143.110.137.94 port 54472 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 22:33:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<rd5GP8RFmOBAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 22:34:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<PqVpQMRF9Mlm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 22:34:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<5huVQMRFQr7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 22:34:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<EMCqQMRFmL+kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 22:34:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<gsZMQsRFwuWB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-12 22:35:04 dovecot_login authenticator failed for (nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:56282: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-12 22:36:56 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:58350: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec 12 22:37:09 host2 sshd[947114]: Disconnected from invalid user test 116.193.191.46 port 59744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-12 22:36:32 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:54304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-12 22:36:43 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:45134: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-12 22:36:57 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:36275: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:37:59 host2 sshd[947693]: Disconnected from invalid user aryan 143.110.137.94 port 35832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 22:37:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<GO3USsRF+MoIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:37:16 host2 sshd[947193]: Disconnected from invalid user db2fenc1 143.110.137.94 port 57572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-12 22:37:49 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:36299: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec 12 22:37:52 host2 sshd[947625]: Disconnected from invalid user shashi 116.193.191.46 port 41044 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 22:38:49 host2 sshd[948297]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec 12 22:38:32 host2 sshd[948079]: Disconnected from invalid user koha 116.193.191.46 port 52526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-12 22:38:40 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:54766: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.155.236
country_id: 690791
description:
Dec 12 22:39:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.221.155.236, lip=66.85.158.91, TLS, session=<wm+VUMRFb7Ul3Zvs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.234.225.9
country_id: 2510769
description:
[2025-12-12 22:39:48 +0530] info [cpaneld] 200.234.225.9 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 22:40:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<FrYyVcRFvMnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.126
country_id: 3175395
description:
Dec 12 22:39:23 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=185.197.8.126, lip=66.85.158.91, TLS, session=<oTi8UcRFTZe5xQh+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.46
country_id: 1643084
description:
Dec 12 22:39:45 host2 sshd[948916]: Disconnected from invalid user ftpuser 116.193.191.46 port 37096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 22:40:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<JBTjVsRFBqkI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.0.67.25
country_id: 1605651
description:
Dec 12 22:40:42 host2 sshd[949718]: Disconnected from invalid user adminftp 49.0.67.25 port 40110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:42:10 host2 sshd[950877]: Disconnected from invalid user aaa 143.110.137.94 port 60130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.0.67.25
country_id: 1605651
description:
Dec 12 22:41:18 host2 sshd[950233]: Disconnected from invalid user ashish 49.0.67.25 port 35950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 22:42:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<i5itXsRFgoekXF7M>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-12-12 22:42:53 +0530] info [cpaneld] 149.30.139.241 - cpsess4340482927frontendpaper_lanternfilemanagerindex.html "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-12 22:43:08 dovecot_login authenticator failed for ([46.212.35.53]) [46.212.35.53]:42380: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 22:43:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<sl8CYMRFLJfCBa8Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 798549
description:
Dec 12 22:42:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.92, session=<Kb/HXMRF/LxV2ZUL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-12 22:43:22 dovecot_login authenticator failed for (cm-84.213.190.55.get.no) [84.213.190.55]:41430: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-12 22:43:32 dovecot_login authenticator failed for (182.239.78.49.hk.chinamobile.com) [182.239.78.49]:31183: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-12 22:43:37 dovecot_login authenticator failed for ([149.232.203.22]) [149.232.203.22]:53613: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-12 22:43:49 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:52244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 22:43:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<xNZ0YsRFNtY+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:43:54 host2 sshd[951985]: Disconnected from invalid user koha 143.110.137.94 port 47212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-12 22:44:08 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:45983: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 22:46:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<wAFWa8RFooi8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.0.67.25
country_id: 1605651
description:
Dec 12 22:47:34 host2 sshd[955211]: Disconnected from invalid user harry 49.0.67.25 port 54030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 22:48:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<tiqDc8RFnp0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 22:50:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<HQhCecRFyJSKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 22:51:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<845rfMRFQMmLOxGe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.79
country_id: 6252001
description:
Dec 12 22:51:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.79, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xELCfsRFrRpAPsVP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-12 22:51:48 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (unmeled) [24.23.125.83]:55456: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Dec 12 22:52:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4NfUf8RFDHxAPsVN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-12 22:52:37 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (plario) [71.41.202.12]:49764: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-12 22:53:26 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:43310: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.193
country_id: 6252001
description:
Dec 12 22:53:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.193, lip=66.85.158.91, session=<CyqqhcRFkNQUQGnB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2025-12-12 22:54:18 dovecot_login authenticator failed for ([82.102.158.36]) [82.102.158.36]:45326: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 22:55:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<dHDEjMRFPq0I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 22:56:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<4aKTkMRFVuyl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 22:58:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<JV25lsRFjNo+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 22:58:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<dFr5l8RFUOYuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-12-12 22:58:23 dovecot_login authenticator failed for (72-107-226-38.edgetelecom.com.br) [38.226.107.70]:34327: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 23:01:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Bju5osRFqomG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-12 23:02:55 dovecot_login authenticator failed for (dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:38168: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-12 23:02:37 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:46124: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-12 23:02:52 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:34586: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-12 23:03:27 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:33523: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 23:03:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<0CqxqcRFupWWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-12 23:04:40 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:34770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 23:04:16 host2 sshd[969310]: Disconnected from invalid user  62.60.131.157 port 65227 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-12-12 23:04:27 dovecot_login authenticator failed for (18980204017.user.veloxzone.com.br) [189.80.146.46]:55039: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-12 23:07:10 dovecot_plain authenticator failed for (unarifixon) [92.62.243.174]:40808: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 23:06:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=</LXsssRFR81etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 23:06:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<AsMFs8RFWsYro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 23:06:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<vdmms8RFAqjO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.106.137.131
country_id: 6252001
description:
Dec 12 23:08:32 host2 sshd[971931]: Disconnected from invalid user asad 170.106.137.131 port 60810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-12 23:08:40 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:36038: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-12 23:08:46 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:40984: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-12 23:08:58 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:59386: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-12 23:09:38 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:47980: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-12-12 23:09:52 dovecot_login authenticator failed for ([2.55.88.51]) [2.55.88.51]:33663: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.106.137.131
country_id: 6252001
description:
Dec 12 23:10:21 host2 sshd[973262]: Disconnected from invalid user cumulus 170.106.137.131 port 46378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 23:11:00 dovecot_plain authenticator failed for (magral) [154.144.243.93]:58502: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.106.137.131
country_id: 6252001
description:
Dec 12 23:11:26 host2 sshd[974051]: Disconnected from invalid user openhabian 170.106.137.131 port 41190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 12 23:11:48 host2 sshd[974341]: Disconnected from invalid user applmgr 103.193.176.131 port 55548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-12 23:12:29 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:46812: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.198.29
country_id: 1522867
description:
2025-12-12 23:12:13 dovecot_login authenticator failed for 2.133.198.29.dynamic.telecom.kz [2.133.198.29]:35063: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-12 23:13:42 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:49658: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 12 23:13:46 host2 sshd[975585]: Disconnected from invalid user asad 103.193.176.131 port 55668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-12 23:13:38 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:41644: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-12 23:13:57 dovecot_login authenticator failed for ([178.232.55.16]) [178.232.55.16]:56600: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 23:14:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<2JYNz8RFDgUvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-12-12 23:13:24 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:54770: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.226
country_id: 6252001
description:
Dec 12 23:14:18 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.226, lip=66.85.158.92, session=<jWmKz8RFVOQNWX3i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 12 23:14:26 host2 sshd[975981]: Disconnected from invalid user ftpuser 103.193.176.131 port 55708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-12 23:14:44 dovecot_plain authenticator failed for (goontal) [5.31.15.108]:53611: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 23:15:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<rUtf1cRF3MU+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 23:16:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<B+4418RFPKpnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 23:16:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<I8hR2MRFat1100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-12 23:19:23 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:54442: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.216.154.78
country_id: 2635167
description:
2025-12-12 23:19:38 dovecot_login authenticator failed for ([62.216.154.78]) [62.216.154.78]:52740: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 23:21:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<vDmB58RFnJkImxNM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec 12 23:20:23 host2 sshd[980745]: Disconnected from invalid user ubuntu 103.249.84.18 port 58430 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 23:21:13 host2 sshd[981483]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 23:21:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<72yw6MRFONBntrtb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.138.194.13
country_id: 6252001
description:
Dec 12 23:21:46 host2 sshd[981785]: Disconnected from invalid user vpnuser 155.138.194.13 port 47242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.138.194.13
country_id: 6252001
description:
Dec 12 23:23:23 host2 sshd[983004]: Disconnected from invalid user a 155.138.194.13 port 56744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-12 23:23:36 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:38662: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-12 23:23:59 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:36580: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec 12 23:24:17 host2 sshd[983489]: Disconnected from invalid user user 103.249.84.18 port 33542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.138.194.13
country_id: 6252001
description:
Dec 12 23:24:25 host2 sshd[983671]: Disconnected from invalid user zhangc 155.138.194.13 port 60146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 23:24:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<S4bE9MRFguC8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 23:25:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<JUmD98RFxLA+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec 12 23:25:50 host2 sshd[984489]: Disconnected from invalid user ubuntu 103.249.84.18 port 38864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 23:27:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<M8zo/MRF+obAqZl0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.18
country_id: 1733045
description:
Dec 12 23:26:38 host2 sshd[984927]: Disconnected from invalid user kk 103.249.84.18 port 54924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-12 23:28:38 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:51590: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.92
country_id: 1733045
description:
2025-12-12 23:28:53 dovecot_login authenticator failed for ([49.125.201.92]) [49.125.201.92]:47046: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-12 23:28:22 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:42105: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-12 23:28:34 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:44876: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 23:28:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<4F/6AsVFgMBm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 23:28:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<TOpSA8VFhKDD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Dec 12 23:29:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, session=<QuceBMVFtvlKUi8C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-12 23:29:09 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:57553: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Dec 12 23:29:13 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS: Connection closed, session=<91foBMVFoqtKUi8C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 23:29:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<VgSMBcVFdoJAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-12-12 23:29:29 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:39602: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Dec 12 23:29:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TlEeBsVFLpFAPpyi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-12 23:29:58 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:47744: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.170.21
country_id: 3996063
description:
2025-12-12 23:30:15 dovecot_login authenticator failed for ([177.236.170.21]) [177.236.170.21]:47231: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 23:30:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<u+lJCcVFHKakXGTY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.86
country_id: 6252001
description:
Dec 12 23:31:23 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=172.236.228.86, lip=66.85.158.92, session=<UUSiDMVFPEas7ORW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 23:32:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<crTNEMVFXI2H6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.79.11
country_id: 337996
description:
2025-12-12 23:32:58 dovecot_plain authenticator failed for (8HRKD1AKEBBNP) [196.191.79.11]:61064: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 23:33:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<L8+VE8VFlNiB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.240.211
country_id: 690791
description:
Dec 12 23:33:35 host2 sshd[990362]: Disconnected from invalid user worker 82.117.240.211 port 42016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-12 23:34:22 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:36774: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 23:34:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<7CcRGMVFgs3D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-12 23:34:43 dovecot_login authenticator failed for (nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:42426: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 23:34:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<jmaUGMVF6IA+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-12 23:34:50 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:55492: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.240.211
country_id: 690791
description:
Dec 12 23:34:55 host2 sshd[991292]: Disconnected from invalid user ubuntu 82.117.240.211 port 55462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.117.240.211
country_id: 690791
description:
Dec 12 23:36:49 host2 sshd[992857]: Disconnected from invalid user yuany 82.117.240.211 port 36764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 23:36:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<DarvHsVFZNMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 23:38:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<EWVZJsVFOJ0IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 23:39:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Ygz4KMVFPL2kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.240.211
country_id: 690791
description:
Dec 12 23:39:37 host2 sshd[994881]: Disconnected from invalid user test 82.117.240.211 port 43954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 23:39:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<RMXKKsVF4KjCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 23:41:47 host2 sshd[996451]: Disconnected from invalid user  62.60.131.157 port 6008 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 23:42:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<TSM2M8VFELVo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-12 23:43:24 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:44728: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 23:43:54 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:49311: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-12 23:43:54 dovecot_login authenticator failed for ([62.97.170.54]) [62.97.170.54]:60797: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-12 23:44:11 dovecot_login authenticator failed for ([182.95.178.158]) [182.95.178.158]:60590: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 23:44:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<zUnEPMVF7JeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-12 23:44:56 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (costogy) [37.150.8.174]:44432: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 23:44:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ArYvPMVFtuC8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 23:46:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<D6YXQcVFgswv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-12 23:48:07 dovecot_login authenticator failed for (200-168-249-9.sconline.com.br) [187.50.226.182]:37526: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.20.59.210
country_id: 2510769
description:
2025-12-12 23:48:40 dovecot_login authenticator failed for 210.red-88-20-59.staticip.rima-tde.net [88.20.59.210]:43417: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 23:51:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<t875VMVFgJ8I3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-12 23:51:39 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (itylikers) [81.225.30.107]:35773: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-12 23:53:07 dovecot_login authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:38152: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-12 23:52:54 dovecot_login authenticator failed for 213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:44504: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-12 23:54:12 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:53986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-12 23:53:14 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:37502: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.215
country_id: 6252001
description:
Dec 12 23:53:29 host2 pure-ftpd[1004696]: (?@205.210.31.215) [INFO] New connection from 205.210.31.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-12 23:55:05 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (ropies) [71.230.228.16]:35140: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 23:54:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<eD2KXsVFMLyl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.121.246.202
country_id: 357994
description:
2025-12-12 23:54:31 dovecot_login authenticator failed for ([41.178.230.115]) [197.121.246.202]:54852: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 23:55:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<J5lVYsVF9JwuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-12 23:56:23 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (coman) [66.177.30.53]:35020: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-12 23:59:03 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:47268: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-12 23:59:07 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:43246: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 23:58:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<hTpxbcVFSt0+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-12 23:58:35 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3950: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-12 23:58:36 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:51900: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.99.37
country_id: 3175395
description:
Dec 13 00:00:04 host2 sshd[1009795]: Disconnected from invalid user andrew 151.19.99.37 port 10888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-12 23:59:20 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:57608: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-12-12 23:59:33 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:35264: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-12 23:59:34 dovecot_plain authenticator failed for (mocally) [88.149.153.106]:55662: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-12 23:59:39 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:56995: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-12-13 00:00:01 dovecot_login authenticator failed for ([37.142.173.63]) [37.142.173.63]:52276: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 00:00:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<icMHdsVFKNIro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 00:00:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<LyFSdsVFLOCG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 00:02:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<uk0yfMVFsN2WXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.19.99.37
country_id: 3175395
description:
Dec 13 00:02:46 host2 sshd[1011895]: Disconnected from invalid user david 151.19.99.37 port 10312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 00:03:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<JIW9f8VFjpHO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.173.39
country_id: 1512440
description:
2025-12-13 00:04:13 dovecot_login authenticator failed for ([45.92.173.39]) [45.92.173.39]:39128: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-13 00:04:28 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:50853: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 00:04:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<nBKHg8VFwRtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 00:06:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<269TisVF8JOnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-13 00:08:50 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:12574: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-13 00:09:10 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:53698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 00:10:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<Hb2ol8VF9JNntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 00:10:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Fuh4mcVFKrY+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 00:10:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<fa8fmsVFiJEvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-13 00:12:34 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:50529: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-13 00:15:02 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:37161: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.19.99.37
country_id: 3175395
description:
Dec 13 00:14:40 host2 sshd[1022643]: Disconnected from invalid user sunil 151.19.99.37 port 10675 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-13 00:15:22 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:33164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 00:16:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<n7H3rMVFcDl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-13 00:16:29 dovecot_plain authenticator failed for (sphit) [192.34.128.202]:49584: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-13 00:17:30 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:49799: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-13 00:17:31 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:60102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.53.232
country_id: 3469034
description:
Dec 13 00:17:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<info@v-deploy.com>, method=PLAIN, rip=170.82.53.232, lip=66.85.158.91, TLS, session=<vuUtscVFF6mqUjXo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-13 00:17:53 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:51454: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.236.38.249
country_id: 130758
description:
Dec 13 00:17:55 host2 sshd[1024876]: Disconnected from invalid user michael 87.236.38.249 port 22958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-13 00:17:18 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:58792: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.52.149
country_id: 3469034
description:
Dec 13 00:18:14 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=170.82.52.149, lip=66.85.158.91, TLS, session=<3EbyssVF6dOqUjSV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.99.37
country_id: 3175395
description:
Dec 13 00:18:23 host2 sshd[1025116]: Disconnected from invalid user test 151.19.99.37 port 10803 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 00:18:41 host2 sshd[1025269]: Disconnected from invalid user  62.60.131.157 port 27422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 13 00:18:24 host2 sshd[1025127]: Disconnected from invalid user proxyuser 197.5.145.150 port 52308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.103.45.76
country_id: 298795
description:
Dec 13 00:18:26 host2 sshd[1025137]: Disconnected from invalid user akbar 94.103.45.76 port 57468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.236.38.249
country_id: 130758
description:
Dec 13 00:18:36 host2 sshd[1025212]: Disconnected from invalid user oracle 87.236.38.249 port 47380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-13 00:19:01 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:55756: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-13 00:19:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tepity) [87.103.126.54]:58450: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 13 00:19:45 host2 sshd[1025917]: Disconnected from invalid user proxyuser 152.42.165.179 port 47378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.32.121
country_id: 390903
description:
2025-12-13 00:19:14 dovecot_login authenticator failed for (149-210-32-121.mobile.nym.cosmote.net) [149.210.32.121]:58414: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.236.38.249
country_id: 130758
description:
Dec 13 00:19:16 host2 sshd[1025701]: Disconnected from invalid user git 87.236.38.249 port 31690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 13 00:20:26 host2 sshd[1026594]: Disconnected from invalid user vpnuser 197.5.145.150 port 57524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 00:20:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<S0tvvMVF7qi8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.236.38.249
country_id: 130758
description:
Dec 13 00:21:46 host2 sshd[1027296]: Disconnected from invalid user www 87.236.38.249 port 24706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.103.45.76
country_id: 298795
description:
Dec 13 00:21:52 host2 sshd[1027357]: Disconnected from invalid user claude 94.103.45.76 port 37326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 00:22:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<i1YQwsVFHIoImxNM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Dec 13 00:22:14 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fW18wsVF8oi4aYtF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 13 00:22:31 host2 sshd[1027657]: Disconnected from invalid user ftpuser 197.5.145.150 port 39422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 00:22:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<g9S7xMVF0tZm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 00:23:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<W5jnxcVFjovAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.216.181.233
country_id: 2661886
description:
2025-12-13 00:23:21 dovecot_login authenticator failed for c80-216-181-233.bredband.tele2.se [80.216.181.233]:38790: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 13 00:23:20 host2 sshd[1028074]: Disconnected from invalid user ubuntu 197.5.145.150 port 46744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 13 00:23:30 host2 sshd[1028131]: Disconnected from invalid user user 152.42.165.179 port 50810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 00:23:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<mRQJx8VFmOHD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-13 00:23:33 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:42907: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-12-13 00:23:54 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:44166: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-13 00:24:24 dovecot_login authenticator failed for (nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:50530: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-13 00:24:40 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:41050: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 00:24:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<a/ASy8VFAOpAF6S9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.149.105
country_id: 953987
description:
Dec 13 00:24:57 host2 sshd[1028948]: Disconnected from invalid user odoo 102.210.149.105 port 53258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.100.10
country_id: 1269750
description:
2025-12-13 00:24:08 dovecot_login authenticator failed for (abts-west-static-208.237.201.106.airtelbroadband.in) [103.218.100.10]:58162: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.110.177.170
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 143.110.177.170 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 13 00:24:41 host2 sshd[1028846]: Disconnected from invalid user serv 142.93.27.16 port 40102 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 00:25:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ITl0zMVFctM+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-13 00:24:11 dovecot_plain authenticator failed for (putchydron) [5.31.15.108]:59818: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 13 00:25:34 host2 sshd[1029507]: Received disconnect from 198.23.143.193 port 59048:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.105
country_id: 953987
description:
Dec 13 00:25:39 host2 sshd[1029581]: Disconnected from invalid user mamad 102.210.149.105 port 33378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 13 00:26:06 host2 sshd[1030008]: Disconnected from invalid user vps 198.23.143.193 port 43076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.104.111.235
country_id: 6252001
description:
Dec 13 00:25:22 host2 sshd[1029371]: Disconnected from invalid user admin 149.104.111.235 port 56266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 149.104.111.235
country_id: 6252001
description:
Dec 13 00:26:40 host2 sshd[1030316]: Disconnected from invalid user user1 149.104.111.235 port 43624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.47.204
country_id: 6251999
description:
2025-12-13 00:26:39 dovecot_login authenticator failed for dhcp-4-bc-9f-70-1a-16.cpe.i-zoom.net [24.137.47.204]:55701: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-12-13 00:26:58 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:54610: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-13 00:27:45 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:44204: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-12-13 00:28:01 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:58099: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 13 00:27:16 host2 sshd[1030642]: Disconnected from invalid user ubuntu 152.42.165.179 port 50608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 13 00:28:44 host2 sshd[1031370]: Disconnected from invalid user wms 157.66.34.121 port 54346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.104.111.235
country_id: 6252001
description:
Dec 13 00:29:35 host2 sshd[1031825]: Disconnected from invalid user admin 149.104.111.235 port 53550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 13 00:29:20 host2 sshd[1031679]: Disconnected from invalid user ftpuser 157.66.34.121 port 58438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 00:29:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<o27V28VF1OHD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 13 00:30:32 host2 sshd[1032458]: Disconnected from invalid user abdi 157.66.34.121 port 33924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 00:32:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<ZorU5cVFkt2H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 00:32:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<DbTp5sVFpL4I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 00:32:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<D7oT6MVF1M6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 00:33:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<DaRI7MVFYpuLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 00:33:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<nUmq6cVF7NKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-13 00:33:23 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:39661: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-12-13 00:33:35 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:50884: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.31
country_id: 3469034
description:
Dec 13 00:33:35 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=191.53.131.31, lip=66.85.158.91, TLS, session=<IgUQ6sVFjLq/NYMf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.190
country_id: 953987
description:
Dec 13 00:33:56 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=102.64.45.190, lip=66.85.158.91, TLS, session=<R/o/68VFetNmQC2+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.149
country_id: 6252001
description:
Dec 13 00:34:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.149, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xuHA7sVFbz1APpyV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Dec 13 00:34:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0LbP78VF6B5APpyO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 00:35:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<zFlg8sVFQqekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 00:36:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<nieB9MVFaM68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 00:36:36 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (polate) [73.197.236.163]:39246: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 00:36:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<ji0q9sVFMO3CBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-13 00:36:46 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (berly) [89.67.37.2]:52482: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-13 00:36:56 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:41088: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.32
country_id: 6252001
description:
2025-12-13 00:37:08 dovecot_login authenticator failed for ([98.181.46.32]) [98.181.46.32]:50760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 00:38:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<nyQx/MVFpJgIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.11
country_id: 3996063
description:
2025-12-13 00:41:46 dovecot_login authenticator failed for (189.218.82.11-clientes-izzi.mx) [189.218.82.11]:54468: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-13 00:42:05 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:49894: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 00:42:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<txfAC8ZF1Ikv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-13 00:42:14 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:46160: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-13 00:43:17 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:42911: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-13 00:43:33 dovecot_login authenticator failed for ([182.95.63.10]) [182.95.63.10]:48304: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.211.100.149
country_id: 3469034
description:
Dec 13 00:44:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.211.100.149, lip=66.85.158.91, TLS, session=<177jD8ZFK46602SV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.69
country_id: 1269750
description:
Dec 13 00:44:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.207.4.69, lip=66.85.158.91, TLS, session=<clEVEcZFFIFnzwRF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.155
country_id: 3469034
description:
Dec 13 00:46:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt>, method=PLAIN, rip=186.209.246.155, lip=66.85.158.91, TLS, session=<DmVEGcZFrLG60fab>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.92
country_id: 3469034
description:
Dec 13 00:46:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=170.80.41.92, lip=66.85.158.91, TLS, session=<R/f7F8ZFs9+qUClc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-13 00:46:31 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tuilioted) [87.103.126.54]:58197: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 00:47:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<FkB+HcZFJNII3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 00:48:35 host2 sshd[1044582]: Disconnected from invalid user admin 2.57.121.112 port 54557 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-13 00:49:03 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:39116: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-13 00:48:17 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:50563: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-13 00:48:31 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:60642: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-12-13 00:49:41 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:51722: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-13 00:51:16 dovecot_plain authenticator failed for (dririck) [105.72.176.66]:50770: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-13 00:51:19 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (uncom) [71.62.34.216]:57798: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 00:51:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<lxqCLMZFProuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 00:52:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=</JKLLcZFpICl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-12-13 00:54:52 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:56705: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-13 00:55:07 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:50106: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-13 00:55:25 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49004: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 00:55:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<goPwOcZFEssro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 00:56:01 host2 sshd[1050528]: Disconnected from invalid user  62.60.131.157 port 9356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-13 00:58:02 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:42124: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-13 00:58:26 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:45556: 535 Incorrect authentication data (set_id=contact)


