# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.153
country_id: 6252001
description:
2025-12-12 20:32:02 dovecot_login authenticator failed for ([98.185.120.153]) [98.185.120.153]:33119: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-12 20:32:16 dovecot_login authenticator failed for ([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 12 20:32:32 host2 sshd[840003]: Disconnected from invalid user user 103.139.192.221 port 53780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Dec 12 20:32:46 host2 sshd[840206]: Disconnected from invalid user unreal 128.199.157.145 port 36726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Dec 12 20:33:48 host2 sshd[841130]: Disconnected from invalid user seedbox 185.193.240.246 port 50350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.67
country_id: 2635167
description:
Dec 12 20:33:53 host2 sshd[841196]: Disconnected from invalid user debian 104.28.192.67 port 46108 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 12 20:33:21 host2 sshd[840667]: Disconnected from invalid user linuxacademy 103.139.192.221 port 37212 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.212
country_id: 6252001
description:
Dec 12 20:35:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.212, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+d0dlsJFf86TuYXU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.123.2.69
country_id: 617790
description:
Dec 12 20:34:06 host2 sshd[841440]: Disconnected from invalid user minecraft 176.123.2.69 port 56696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 12 20:34:42 host2 sshd[841867]: Disconnected from invalid user john 23.95.128.167 port 44108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 20:34:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<uzPxlMJFOJ2H6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.67
country_id: 2635167
description:
Dec 12 20:35:09 host2 sshd[842380]: Disconnected from invalid user hyperchain 104.28.192.67 port 32162 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.212
country_id: 6252001
description:
Dec 12 20:35:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=147.185.133.212, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<YJ/Ql8JFxOiTuYXU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.28.192.67
country_id: 2635167
description:
Dec 12 20:35:49 host2 sshd[842949]: Disconnected from invalid user yekta 104.28.192.67 port 12055 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.228.48
country_id: 6252001
description:
Dec 12 20:35:57 host2 sshd[843050]: Disconnected from invalid user ibrahim 137.184.228.48 port 49192 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:36:52 host2 sshd[843857]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-12 20:36:38 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:40456: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 20:36:39 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (decardruis) [87.103.126.54]:64381: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 12 20:36:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<LVyvm8JF0sXBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.89.127
country_id: 6252001
description:
Dec 12 20:36:06 host2 sshd[843202]: Disconnected from invalid user wow 172.190.89.127 port 45674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Dec 12 20:36:17 host2 sshd[843350]: Disconnected from invalid user asd 128.199.157.145 port 41246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 20:36:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<oruymsJFVtqB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.228.48
country_id: 6252001
description:
Dec 12 20:36:32 host2 sshd[843619]: Disconnected from invalid user testuser1 137.184.228.48 port 34990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-12 20:36:57 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:48108: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:37:33 host2 sshd[844571]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 20:37:11 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unbowee) [87.103.126.54]:35599: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-12 20:37:41 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (cosesed) [73.88.196.91]:43754: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Dec 12 20:37:52 host2 sshd[844890]: Disconnected from invalid user lisa 185.193.240.246 port 51930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-12 20:38:00 dovecot_login authenticator failed for ([125.20.245.194]) [125.20.245.194]:38136: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.123.2.69
country_id: 617790
description:
Dec 12 20:37:07 host2 sshd[844188]: Disconnected from invalid user sbserver 176.123.2.69 port 53150 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:38:12 host2 sshd[845167]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.228.48
country_id: 6252001
description:
Dec 12 20:38:48 host2 sshd[845784]: Disconnected from invalid user ali 137.184.228.48 port 54494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-12 20:38:06 dovecot_plain authenticator failed for (imbenthy) [24.93.140.162]:58880: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-12 20:38:33 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:37662: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 20:39:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<xk+PpMJF7uPAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 20:39:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<ykbopMJF2oW8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.228.48
country_id: 6252001
description:
Dec 12 20:39:23 host2 sshd[846234]: Disconnected from invalid user gituser 137.184.228.48 port 60020 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:40:51 host2 sshd[847747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-12 20:40:54 dovecot_login authenticator failed for c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:35413: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 20:41:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Hx8drMJFcOo+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Dec 12 20:41:20 host2 sshd[848334]: Disconnected from invalid user botuser 107.150.106.178 port 51556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-12 20:41:31 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:49196: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.224.66
country_id: 2635167
description:
Dec 12 20:41:53 host2 sshd[848868]: Disconnected from invalid user wow 104.28.224.66 port 56236 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.212
country_id: 6252001
description:
Dec 12 20:42:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.212, lip=66.85.158.92, TLS, session=<GPrascJFauWTuYXU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 20:42:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<G8yrr8JF6IGkXGTY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Dec 12 20:42:17 host2 sshd[849296]: Disconnected from invalid user ubuntu 107.150.106.178 port 35620 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 20:42:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<fi+EsMJFNNZAF6S9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:44:24 host2 sshd[850777]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 20:44:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KR2xuMJFSJanrKy4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:45:49 host2 sshd[852320]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 20:45:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<b9fxusJF6rJm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 12 20:45:46 host2 sshd[852301]: Disconnected from invalid user myuser 45.61.187.30 port 51284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 20:45:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<fSPRvMJFBqHD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2025-12-12 20:46:59 dovecot_login authenticator failed for ([82.102.158.36]) [82.102.158.36]:54369: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.28.224.66
country_id: 2635167
description:
Dec 12 20:46:51 host2 sshd[853535]: Disconnected from invalid user user 104.28.224.66 port 16492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-12 20:46:55 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (gamicra) [196.47.172.253]:41472: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:47:23 host2 sshd[853951]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 12 20:47:48 host2 sshd[854286]: Disconnected from invalid user arash 45.61.187.30 port 56698 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 20:47:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<jUgExMJFRMAI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-12-12 20:47:11 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:49096: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.66
country_id: 2635167
description:
Dec 12 20:47:30 host2 sshd[854028]: Disconnected from invalid user test 104.28.192.66 port 38828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-12 20:48:56 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (carier) [87.103.126.54]:37345: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 20:48:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<0JmVxcJFirG8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 12 20:48:35 host2 sshd[854858]: Disconnected from invalid user mcadmin 45.61.187.30 port 42584 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 20:49:19 host2 sshd[855486]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 20:49:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<+H8ky8JFgqTCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 12 20:50:07 host2 sshd[856204]: Disconnected from invalid user wifi 45.61.187.30 port 42600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 20:50:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<GxWnzcJF8NOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.186
country_id: 3469034
description:
Dec 12 20:50:43 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=186.209.247.186, lip=66.85.158.91, TLS, session=<dduizMJF1uO60fe6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.212.90
country_id: 933860
description:
Dec 12 20:51:04 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=41.216.212.90, lip=66.85.158.91, TLS, session=<7M02zsJFH50p2NRa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-12 20:51:42 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:41344: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 20:51:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<9g910cJFgubD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-12-12 20:52:05 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:32950: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 20:53:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<N7ML18JFJK4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 20:54:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<wX6m28JF/rRntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-12 20:56:29 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:57882: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.226.192
country_id: 6251999
description:
2025-12-12 20:56:07 dovecot_login authenticator failed for host-24-224-226-192.public.eastlink.ca [24.224.226.192]:56724: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-12 20:56:12 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:53061: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.234
country_id: 3996063
description:
2025-12-12 20:56:18 dovecot_login authenticator failed for (201.173.216.234-clientes-izzi.mx) [201.173.216.234]:58234: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-12 20:57:15 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:51428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-12 20:57:27 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:48944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 20:57:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<J0Xg58JFdIqKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-12 20:58:37 dovecot_plain authenticator failed for (chils) [80.227.102.242]:51751: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 12 20:58:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<c6KD6sJFjOA+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 21:00:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<RBd28cJF0tKl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-12-12 21:02:10 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:53708: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-12 21:02:32 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:57265: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-12 21:03:01 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:58856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 21:03:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<oyDA+sJFWscI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-12 21:03:22 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:43898: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 21:04:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<+pQ1/sJFuuGG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 21:04:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<OljIAMNF+sCWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 21:05:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<GjOzAcNFZtUuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-12-12 21:05:24 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:58618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-12-12 21:05:41 dovecot_login authenticator failed for (SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:38724: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 21:06:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<tuiwBMNFLNk+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 21:06:49 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (prous) [71.224.169.28]:50690: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 21:08:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<pGl7DcNFkIuLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 21:09:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<m3VdEcNFaOI+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 21:09:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lapxEcNFSkBetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-12 21:10:49 dovecot_plain authenticator failed for (villiders) [178.250.191.189]:54124: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 21:11:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<LV8pGMNFBszO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 21:15:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<XT/eJMNFfLsImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-12 21:16:00 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:39215: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-12 21:16:57 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:50446: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.108
country_id: 6252001
description:
Dec 12 21:16:15 host2 pure-ftpd[875816]: (?@205.210.31.108) [INFO] New connection from 205.210.31.108


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 21:16:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<t2BNKsNFrsIro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-12-12 21:16:44 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:32893: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-12 21:18:35 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (inatiert) [73.129.57.71]:51326: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-12 21:18:51 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:53756: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-12 21:19:02 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:51927: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 21:19:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jxDrM8NFQlZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 21:19:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<KzQhNsNFrOsvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.62
country_id: 6252001
description:
Dec 12 21:21:26 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.62, lip=66.85.158.91, session=<eO/kO8NF5YxomDQ+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.193.85
country_id: 1269750
description:
Dec 12 21:21:30 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@v-deploy.com>, method=PLAIN, rip=103.213.193.85, lip=66.85.158.91, TLS, session=<X3jiOsNFodFn1cFV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.100.10
country_id: 1269750
description:
2025-12-12 21:21:33 dovecot_login authenticator failed for (abts-west-static-208.237.201.106.airtelbroadband.in) [103.218.100.10]:41106: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-12 21:21:45 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:39428: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.98.65
country_id: 3469034
description:
Dec 12 21:21:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.240.98.65, lip=66.85.158.91, TLS, session=<FJ5HPMNFsui/8GJB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-12-12 21:22:01 dovecot_login authenticator failed for (14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:58159: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-12 21:22:25 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:58938: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.12.253.153
country_id: 6252001
description:
Dec 12 21:22:26 host2 sshd[879712]: Disconnected from invalid user pivpn 154.12.253.153 port 42330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 21:22:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<sPahP8NFnL9npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-12 21:22:59 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:41925: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.221.244.34
country_id: 878675
description:
Dec 12 21:23:24 host2 sshd[880375]: Disconnected from invalid user i 197.221.244.34 port 60220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.12.253.153
country_id: 6252001
description:
Dec 12 21:23:49 host2 sshd[880632]: Disconnected from invalid user git 154.12.253.153 port 42438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-12 21:23:17 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:37583: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.90
country_id: 1643084
description:
Dec 12 21:24:25 host2 sshd[881120]: Disconnected from invalid user test 116.193.191.90 port 40498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.12.253.153
country_id: 6252001
description:
Dec 12 21:24:32 host2 sshd[881196]: Disconnected from invalid user ubuntu 154.12.253.153 port 42494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.244.34
country_id: 878675
description:
Dec 12 21:25:47 host2 sshd[882290]: Disconnected from invalid user yuxiang 197.221.244.34 port 38200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.12.253.153
country_id: 6252001
description:
Dec 12 21:25:54 host2 sshd[882401]: Disconnected from invalid user ubuntu 154.12.253.153 port 42606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.67
country_id: 2300660
description:
Dec 12 21:27:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=41.139.11.67, lip=66.85.158.91, TLS, session=<mdwwUMNFK8spiwtD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.207
country_id: 3865483
description:
Dec 12 21:27:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=190.181.97.207, lip=66.85.158.91, TLS, session=<mQGFUcNF++C+tWHP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-12 21:27:52 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:57414: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.215
country_id: 3996063
description:
2025-12-12 21:27:51 dovecot_login authenticator failed for ([177.236.145.215]) [177.236.145.215]:37194: 535 Incorrect authentication data (set_id=manager@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-12 21:28:04 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:57910: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-12-12 21:28:06 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:35080: 535 Incorrect authentication data (set_id=manager)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.244.34
country_id: 878675
description:
Dec 12 21:27:23 host2 sshd[883452]: Disconnected from invalid user hadoop 197.221.244.34 port 47538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.90
country_id: 1643084
description:
Dec 12 21:28:15 host2 sshd[883873]: Disconnected from invalid user markus 116.193.191.90 port 36162 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 21:29:25 host2 sshd[884612]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.90
country_id: 1643084
description:
Dec 12 21:29:47 host2 sshd[884799]: Disconnected from invalid user dmdba 116.193.191.90 port 47630 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.88
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.88: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 21:33:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<oGuRZ8NF6Mc+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 21:33:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<pm+gaMNFioqH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 21:34:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<xY2aacNFZKC8pkxr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.10
country_id: 798549
description:
Dec 12 21:35:35 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.10, lip=66.85.158.91, TLS: Connection closed, session=<g4WLbsNFOe1V2YwK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-12 21:36:08 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:43524: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 21:35:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<hk9ybcNFxIMIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 21:35:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<6hS/bcNFEOzAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.247
country_id: 1733045
description:
2025-12-12 21:36:30 dovecot_login authenticator failed for ([49.124.150.247]) [49.124.150.247]:37826: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 21:36:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<BQl0csNFZuGB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.113
country_id: 6252001
description:
2025-12-12 21:37:28 dovecot_login authenticator failed for wsip-184-191-250-113.fv.ks.cox.net [184.191.250.113]:52862: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.89.22.113
country_id: 3469034
description:
2025-12-12 21:37:44 dovecot_login authenticator failed for (177-89-22-113.cable.cabotelecom.com.br) [177.89.22.113]:40932: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-12 21:37:46 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:53528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-12 21:37:14 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:57220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 21:38:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<fW3/eMNFbJ+kXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-12 21:38:37 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (redeoutin) [76.145.10.140]:34624: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-12 21:38:42 dovecot_plain authenticator failed for (jectoes) [91.73.188.251]:40731: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 21:38:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<GQatecNFAoZAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 21:39:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<bmIAfsNFPuxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 21:40:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<fyfLfsNFcNrD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-12 21:41:54 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:40740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-12 21:43:04 dovecot_plain authenticator failed for (proma) [178.250.191.189]:42156: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 21:43:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<BWfIi8NFoqpntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 21:44:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<u5DrjcNFIIcI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-12 21:45:08 dovecot_plain authenticator failed for (prent) [5.26.190.79]:35764: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-12 21:45:15 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (squalnes) [73.183.74.177]:38502: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 21:45:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<cSNyk8NFzN3D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-12 21:46:02 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:58714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-12 21:46:17 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:56600: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-12 21:46:17 dovecot_login authenticator failed for ([125.18.154.73]) [182.95.226.118]:42464: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-12 21:46:35 dovecot_login authenticator failed for (187-163-97-62.cust.smartcall.no) [62.97.163.187]:50390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 21:46:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<8C1IlsNFWq6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 21:46:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<SPl9lsNFlqnCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-12 21:47:24 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:50619: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 21:47:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<oICkmcNFTpe8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-12 21:48:06 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:54570: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 21:48:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<LIxAnMNFatU+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 21:48:58 host2 sshd[899762]: Disconnected from invalid user  62.60.131.157 port 11562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 21:50:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<kF/LpMNFotsv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-12 21:52:04 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:43433: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-12 21:51:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49640: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-12-12 21:52:24 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:51832: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-12 21:52:50 dovecot_login authenticator failed for (cm-84.210.149.45.get.no) [84.210.149.45]:52563: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-12 21:53:55 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:60878: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 21:54:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<kbOfsMNFfpCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.146
country_id: 3996063
description:
2025-12-12 21:53:16 dovecot_login authenticator failed for (187.161.222.146-clientes-izzi.mx) [187.161.222.146]:60285: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 21:57:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<b25/vMNFSJ9o1joy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.217
country_id: 6252001
description:
Dec 12 21:57:25 host2 pure-ftpd[905933]: (?@205.210.31.217) [INFO] New connection from 205.210.31.217


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 21:59:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<zHfywsNFYNCl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 21:59:37 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<KqxcxMNFwN0I3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.67.75
country_id: 1880251
description:
Dec 12 22:00:36 host2 sshd[909060]: Invalid user cloudtourssrilan_travel from 167.172.67.75 port 46480


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 22:02:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<u/8PzcNFAtMuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.53.36.78
country_id: 2510769
description:
Dec 12 22:02:45 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=195.53.36.78, lip=66.85.158.91, TLS, session=<vNOkzsNFGgrDNSRO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.132
country_id: 3865483
description:
Dec 12 22:03:07 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.181.101.132, lip=66.85.158.91, TLS, session=<AcjZz8NFSLa+tWWE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 22:02:14 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:46441: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-12 22:02:26 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:45176: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 22:03:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<vm6g0cNFdLOG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 22:03:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<UvT50cNFsKuWXx+e>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Dec 12 22:03:38 host2 pure-ftpd[923391]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-12 22:06:42 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:38220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 22:06:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<2K8m3sNFoPJetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-12 22:07:00 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:40214: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-12 22:08:23 dovecot_plain authenticator failed for (penticary) [102.53.15.180]:35693: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-12 22:08:27 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (anjugaha) [174.169.224.27]:33382: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 22:08:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ZmT548NFZLU+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 22:09:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<35q358NF6tvO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.173
country_id: 6251999
description:
2025-12-12 22:11:09 dovecot_login authenticator failed for ([207.134.139.173]) [207.134.139.173]:14839: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 12 22:10:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<WD/M68NF2ObCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-12-12 22:10:42 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:58716: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-12 22:10:54 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:42013: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 22:11:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<LDt378NFBJsro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-12 22:11:47 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:59653: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-12 22:12:30 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:58563: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2025-12-12 22:12:45 dovecot_login authenticator failed for (static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:57462: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 12 22:13:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<//v79sNFeNKB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 22:17:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dSHtBcRFuuh100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-12 22:18:03 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:58804: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-12 22:17:13 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:51074: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 22:17:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Qt5lA8RFADQvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-12 22:17:17 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (imedly) [73.13.220.220]:42680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-12 22:17:31 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:59390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2025-12-12 22:18:21 dovecot_login authenticator failed for (nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:56572: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 22:18:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<D+ycB8RFGqAImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 22:19:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<CfT8C8RFZJRnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 22:19:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Z4Z/DMRFjpU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-12 22:22:13 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (cohens) [71.224.169.28]:43938: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 12 22:24:45 host2 sshd[938179]: Disconnected from invalid user admin 2.57.121.112 port 29227 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.164.170.242
country_id: 6252001
description:
Dec 12 22:24:46 host2 pure-ftpd[938220]: (?@54.164.170.242) [INFO] New connection from 54.164.170.242


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 12 22:25:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<IEeWIMRFLMOnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-12 22:27:42 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:35288: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-12-12 22:28:04 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:41290: 535 Incorrect authentication data (set_id=contact)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 197.147.233.193
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[197.147.233.193] [Remote Port]=[11839] [Authentication Database]=[system] [Username]=[info] (5/5 failures) (blocked until [Fri Dec 12 17:14:10 2025 UTC/Fri Dec 12 22:44:10 2025 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:28:24 +0530] info [cpaneld] 197.147.233.193 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 22:28:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<OnqcLMRFuo68pkxr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 12 22:29:07 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<VsL1LcRFsBDY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 12 22:29:21 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, TLS: Connection closed, session=<dtTNLsRF3ELY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Dec 12 22:29:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.68, lip=66.85.158.91, session=<mU0vL8RFot24aYtE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:29:55 +0530] info [cpaneld] 197.147.233.193 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:29:56 +0530] info [cpaneld] 197.147.233.193 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user cloudtourssrilan) has locked out IP 197.147.233.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:30:42 +0530] info [cpaneld] 197.147.233.193 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user cloudtourssrilan) has locked out IP 197.147.233.193


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 197.147.233.193
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[197.147.233.193] [Remote Port]=[9960] [Authentication Database]=[system] [Username]=[cloudtourssrilan_travel] (10/10 failures) (blocked until [Sat Dec 13 17:00:41 2025 UTC/Sat Dec 13 22:30:41 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 22:32:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<MzVIOMRFMK2H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 22:31:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<n/G3NcRFGIPAqZl0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.233.193
country_id: 2542007
description:
[2025-12-12 22:31:27 +0530] info [whostmgrd] 197.147.233.193 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user info@cloudtourssrilanka.com) has locked out IP 197.147.233.193


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 22:32:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<4cqyOcRFftdntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-12 22:33:03 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (intla) [24.91.103.202]:35730: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:33:17 host2 sshd[944085]: Disconnected from invalid user hb 143.110.137.94 port 54472 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 22:33:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<rd5GP8RFmOBAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 22:34:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<PqVpQMRF9Mlm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 22:34:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<5huVQMRFQr7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 22:34:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<EMCqQMRFmL+kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 22:34:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<gsZMQsRFwuWB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-12 22:35:04 dovecot_login authenticator failed for (nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:56282: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-12 22:36:56 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:58350: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec 12 22:37:09 host2 sshd[947114]: Disconnected from invalid user test 116.193.191.46 port 59744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-12 22:36:32 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:54304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-12 22:36:43 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:45134: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-12 22:36:57 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:36275: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:37:59 host2 sshd[947693]: Disconnected from invalid user aryan 143.110.137.94 port 35832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 22:37:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<GO3USsRF+MoIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:37:16 host2 sshd[947193]: Disconnected from invalid user db2fenc1 143.110.137.94 port 57572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-12 22:37:49 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:36299: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec 12 22:37:52 host2 sshd[947625]: Disconnected from invalid user shashi 116.193.191.46 port 41044 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 22:38:49 host2 sshd[948297]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec 12 22:38:32 host2 sshd[948079]: Disconnected from invalid user koha 116.193.191.46 port 52526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-12 22:38:40 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:54766: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.155.236
country_id: 690791
description:
Dec 12 22:39:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.221.155.236, lip=66.85.158.91, TLS, session=<wm+VUMRFb7Ul3Zvs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.234.225.9
country_id: 2510769
description:
[2025-12-12 22:39:48 +0530] info [cpaneld] 200.234.225.9 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 22:40:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<FrYyVcRFvMnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.126
country_id: 3175395
description:
Dec 12 22:39:23 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=185.197.8.126, lip=66.85.158.91, TLS, session=<oTi8UcRFTZe5xQh+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.46
country_id: 1643084
description:
Dec 12 22:39:45 host2 sshd[948916]: Disconnected from invalid user ftpuser 116.193.191.46 port 37096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 22:40:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<JBTjVsRFBqkI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.0.67.25
country_id: 1605651
description:
Dec 12 22:40:42 host2 sshd[949718]: Disconnected from invalid user adminftp 49.0.67.25 port 40110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:42:10 host2 sshd[950877]: Disconnected from invalid user aaa 143.110.137.94 port 60130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.0.67.25
country_id: 1605651
description:
Dec 12 22:41:18 host2 sshd[950233]: Disconnected from invalid user ashish 49.0.67.25 port 35950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 22:42:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<i5itXsRFgoekXF7M>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-12-12 22:42:53 +0530] info [cpaneld] 149.30.139.241 - cpsess4340482927frontendpaper_lanternfilemanagerindex.html "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-12 22:43:08 dovecot_login authenticator failed for ([46.212.35.53]) [46.212.35.53]:42380: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 22:43:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<sl8CYMRFLJfCBa8Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 798549
description:
Dec 12 22:42:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.92, session=<Kb/HXMRF/LxV2ZUL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-12 22:43:22 dovecot_login authenticator failed for (cm-84.213.190.55.get.no) [84.213.190.55]:41430: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-12 22:43:32 dovecot_login authenticator failed for (182.239.78.49.hk.chinamobile.com) [182.239.78.49]:31183: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-12 22:43:37 dovecot_login authenticator failed for ([149.232.203.22]) [149.232.203.22]:53613: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-12 22:43:49 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:52244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 12 22:43:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<xNZ0YsRFNtY+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 12 22:43:54 host2 sshd[951985]: Disconnected from invalid user koha 143.110.137.94 port 47212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-12 22:44:08 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:45983: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 22:46:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<wAFWa8RFooi8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.0.67.25
country_id: 1605651
description:
Dec 12 22:47:34 host2 sshd[955211]: Disconnected from invalid user harry 49.0.67.25 port 54030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 22:48:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<tiqDc8RFnp0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 22:50:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<HQhCecRFyJSKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 12 22:51:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<845rfMRFQMmLOxGe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.79
country_id: 6252001
description:
Dec 12 22:51:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.79, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xELCfsRFrRpAPsVP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-12 22:51:48 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (unmeled) [24.23.125.83]:55456: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Dec 12 22:52:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4NfUf8RFDHxAPsVN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-12 22:52:37 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (plario) [71.41.202.12]:49764: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-12 22:53:26 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:43310: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.193
country_id: 6252001
description:
Dec 12 22:53:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.193, lip=66.85.158.91, session=<CyqqhcRFkNQUQGnB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2025-12-12 22:54:18 dovecot_login authenticator failed for ([82.102.158.36]) [82.102.158.36]:45326: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 22:55:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<dHDEjMRFPq0I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 22:56:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<4aKTkMRFVuyl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 12 22:58:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<JV25lsRFjNo+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 22:58:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<dFr5l8RFUOYuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-12-12 22:58:23 dovecot_login authenticator failed for (72-107-226-38.edgetelecom.com.br) [38.226.107.70]:34327: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 12 23:01:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Bju5osRFqomG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-12 23:02:55 dovecot_login authenticator failed for (dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:38168: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-12 23:02:37 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:46124: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-12 23:02:52 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:34586: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-12 23:03:27 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:33523: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 12 23:03:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<0CqxqcRFupWWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-12 23:04:40 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:34770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 23:04:16 host2 sshd[969310]: Disconnected from invalid user  62.60.131.157 port 65227 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-12-12 23:04:27 dovecot_login authenticator failed for (18980204017.user.veloxzone.com.br) [189.80.146.46]:55039: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-12 23:07:10 dovecot_plain authenticator failed for (unarifixon) [92.62.243.174]:40808: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 12 23:06:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=</LXsssRFR81etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 12 23:06:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<AsMFs8RFWsYro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 12 23:06:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<vdmms8RFAqjO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.106.137.131
country_id: 6252001
description:
Dec 12 23:08:32 host2 sshd[971931]: Disconnected from invalid user asad 170.106.137.131 port 60810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-12 23:08:40 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:36038: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-12 23:08:46 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:40984: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-12 23:08:58 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:59386: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-12 23:09:38 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:47980: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-12-12 23:09:52 dovecot_login authenticator failed for ([2.55.88.51]) [2.55.88.51]:33663: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.106.137.131
country_id: 6252001
description:
Dec 12 23:10:21 host2 sshd[973262]: Disconnected from invalid user cumulus 170.106.137.131 port 46378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-12 23:11:00 dovecot_plain authenticator failed for (magral) [154.144.243.93]:58502: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.106.137.131
country_id: 6252001
description:
Dec 12 23:11:26 host2 sshd[974051]: Disconnected from invalid user openhabian 170.106.137.131 port 41190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 12 23:11:48 host2 sshd[974341]: Disconnected from invalid user applmgr 103.193.176.131 port 55548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-12 23:12:29 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:46812: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.198.29
country_id: 1522867
description:
2025-12-12 23:12:13 dovecot_login authenticator failed for 2.133.198.29.dynamic.telecom.kz [2.133.198.29]:35063: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-12 23:13:42 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:49658: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 12 23:13:46 host2 sshd[975585]: Disconnected from invalid user asad 103.193.176.131 port 55668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-12 23:13:38 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:41644: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-12 23:13:57 dovecot_login authenticator failed for ([178.232.55.16]) [178.232.55.16]:56600: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 12 23:14:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<2JYNz8RFDgUvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-12-12 23:13:24 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:54770: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.226
country_id: 6252001
description:
Dec 12 23:14:18 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.226, lip=66.85.158.92, session=<jWmKz8RFVOQNWX3i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 12 23:14:26 host2 sshd[975981]: Disconnected from invalid user ftpuser 103.193.176.131 port 55708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-12 23:14:44 dovecot_plain authenticator failed for (goontal) [5.31.15.108]:53611: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 23:15:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<rUtf1cRF3MU+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 12 23:16:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<B+4418RFPKpnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 12 23:16:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<I8hR2MRFat1100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-12 23:19:23 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:54442: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.216.154.78
country_id: 2635167
description:
2025-12-12 23:19:38 dovecot_login authenticator failed for ([62.216.154.78]) [62.216.154.78]:52740: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 12 23:21:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<vDmB58RFnJkImxNM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec 12 23:20:23 host2 sshd[980745]: Disconnected from invalid user ubuntu 103.249.84.18 port 58430 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 12 23:21:13 host2 sshd[981483]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 12 23:21:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<72yw6MRFONBntrtb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.138.194.13
country_id: 6252001
description:
Dec 12 23:21:46 host2 sshd[981785]: Disconnected from invalid user vpnuser 155.138.194.13 port 47242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.138.194.13
country_id: 6252001
description:
Dec 12 23:23:23 host2 sshd[983004]: Disconnected from invalid user a 155.138.194.13 port 56744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-12 23:23:36 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:38662: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-12 23:23:59 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:36580: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec 12 23:24:17 host2 sshd[983489]: Disconnected from invalid user user 103.249.84.18 port 33542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.138.194.13
country_id: 6252001
description:
Dec 12 23:24:25 host2 sshd[983671]: Disconnected from invalid user zhangc 155.138.194.13 port 60146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 12 23:24:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<S4bE9MRFguC8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 12 23:25:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<JUmD98RFxLA+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Dec 12 23:25:50 host2 sshd[984489]: Disconnected from invalid user ubuntu 103.249.84.18 port 38864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 12 23:27:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<M8zo/MRF+obAqZl0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.18
country_id: 1733045
description:
Dec 12 23:26:38 host2 sshd[984927]: Disconnected from invalid user kk 103.249.84.18 port 54924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-12 23:28:38 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:51590: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.92
country_id: 1733045
description:
2025-12-12 23:28:53 dovecot_login authenticator failed for ([49.125.201.92]) [49.125.201.92]:47046: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-12 23:28:22 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:42105: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-12 23:28:34 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:44876: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 12 23:28:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<4F/6AsVFgMBm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 23:28:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<TOpSA8VFhKDD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Dec 12 23:29:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, session=<QuceBMVFtvlKUi8C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-12 23:29:09 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:57553: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Dec 12 23:29:13 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS: Connection closed, session=<91foBMVFoqtKUi8C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 12 23:29:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<VgSMBcVFdoJAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-12-12 23:29:29 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:39602: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Dec 12 23:29:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TlEeBsVFLpFAPpyi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-12 23:29:58 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:47744: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.170.21
country_id: 3996063
description:
2025-12-12 23:30:15 dovecot_login authenticator failed for ([177.236.170.21]) [177.236.170.21]:47231: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 12 23:30:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<u+lJCcVFHKakXGTY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.86
country_id: 6252001
description:
Dec 12 23:31:23 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=172.236.228.86, lip=66.85.158.92, session=<UUSiDMVFPEas7ORW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 12 23:32:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<crTNEMVFXI2H6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.79.11
country_id: 337996
description:
2025-12-12 23:32:58 dovecot_plain authenticator failed for (8HRKD1AKEBBNP) [196.191.79.11]:61064: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 12 23:33:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<L8+VE8VFlNiB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.240.211
country_id: 690791
description:
Dec 12 23:33:35 host2 sshd[990362]: Disconnected from invalid user worker 82.117.240.211 port 42016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-12 23:34:22 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:36774: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 12 23:34:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<7CcRGMVFgs3D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-12 23:34:43 dovecot_login authenticator failed for (nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:42426: 535 Incorrect authentication data (set_id=hello@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 12 23:34:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<jmaUGMVF6IA+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-12 23:34:50 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:55492: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.240.211
country_id: 690791
description:
Dec 12 23:34:55 host2 sshd[991292]: Disconnected from invalid user ubuntu 82.117.240.211 port 55462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.117.240.211
country_id: 690791
description:
Dec 12 23:36:49 host2 sshd[992857]: Disconnected from invalid user yuany 82.117.240.211 port 36764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 23:36:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<DarvHsVFZNMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 12 23:38:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<EWVZJsVFOJ0IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 12 23:39:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Ygz4KMVFPL2kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.240.211
country_id: 690791
description:
Dec 12 23:39:37 host2 sshd[994881]: Disconnected from invalid user test 82.117.240.211 port 43954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 12 23:39:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<RMXKKsVF4KjCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 12 23:41:47 host2 sshd[996451]: Disconnected from invalid user  62.60.131.157 port 6008 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 12 23:42:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<TSM2M8VFELVo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-12 23:43:24 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:44728: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-12 23:43:54 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:49311: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-12 23:43:54 dovecot_login authenticator failed for ([62.97.170.54]) [62.97.170.54]:60797: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-12 23:44:11 dovecot_login authenticator failed for ([182.95.178.158]) [182.95.178.158]:60590: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 12 23:44:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<zUnEPMVF7JeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-12 23:44:56 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (costogy) [37.150.8.174]:44432: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 12 23:44:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ArYvPMVFtuC8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 12 23:46:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<D6YXQcVFgswv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-12 23:48:07 dovecot_login authenticator failed for (200-168-249-9.sconline.com.br) [187.50.226.182]:37526: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.20.59.210
country_id: 2510769
description:
2025-12-12 23:48:40 dovecot_login authenticator failed for 210.red-88-20-59.staticip.rima-tde.net [88.20.59.210]:43417: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 12 23:51:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<t875VMVFgJ8I3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-12 23:51:39 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (itylikers) [81.225.30.107]:35773: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-12 23:53:07 dovecot_login authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:38152: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-12 23:52:54 dovecot_login authenticator failed for 213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:44504: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-12 23:54:12 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:53986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-12 23:53:14 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:37502: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.215
country_id: 6252001
description:
Dec 12 23:53:29 host2 pure-ftpd[1004696]: (?@205.210.31.215) [INFO] New connection from 205.210.31.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-12 23:55:05 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (ropies) [71.230.228.16]:35140: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 12 23:54:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<eD2KXsVFMLyl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.121.246.202
country_id: 357994
description:
2025-12-12 23:54:31 dovecot_login authenticator failed for ([41.178.230.115]) [197.121.246.202]:54852: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 12 23:55:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<J5lVYsVF9JwuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-12 23:56:23 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (coman) [66.177.30.53]:35020: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-12 23:59:03 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:47268: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-12 23:59:07 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:43246: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 12 23:58:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<hTpxbcVFSt0+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-12 23:58:35 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3950: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-12 23:58:36 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:51900: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.99.37
country_id: 3175395
description:
Dec 13 00:00:04 host2 sshd[1009795]: Disconnected from invalid user andrew 151.19.99.37 port 10888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-12 23:59:20 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:57608: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-12-12 23:59:33 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:35264: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-12 23:59:34 dovecot_plain authenticator failed for (mocally) [88.149.153.106]:55662: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-12 23:59:39 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:56995: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-12-13 00:00:01 dovecot_login authenticator failed for ([37.142.173.63]) [37.142.173.63]:52276: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 00:00:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<icMHdsVFKNIro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 00:00:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<LyFSdsVFLOCG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 00:02:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<uk0yfMVFsN2WXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.19.99.37
country_id: 3175395
description:
Dec 13 00:02:46 host2 sshd[1011895]: Disconnected from invalid user david 151.19.99.37 port 10312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 00:03:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<JIW9f8VFjpHO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.173.39
country_id: 1512440
description:
2025-12-13 00:04:13 dovecot_login authenticator failed for ([45.92.173.39]) [45.92.173.39]:39128: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-13 00:04:28 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:50853: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 00:04:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<nBKHg8VFwRtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 00:06:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<269TisVF8JOnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-13 00:08:50 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:12574: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-13 00:09:10 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:53698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 00:10:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<Hb2ol8VF9JNntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 00:10:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Fuh4mcVFKrY+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 00:10:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<fa8fmsVFiJEvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-13 00:12:34 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:50529: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-13 00:15:02 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:37161: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.19.99.37
country_id: 3175395
description:
Dec 13 00:14:40 host2 sshd[1022643]: Disconnected from invalid user sunil 151.19.99.37 port 10675 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-13 00:15:22 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:33164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 00:16:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<n7H3rMVFcDl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-13 00:16:29 dovecot_plain authenticator failed for (sphit) [192.34.128.202]:49584: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-13 00:17:30 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:49799: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-13 00:17:31 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:60102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.53.232
country_id: 3469034
description:
Dec 13 00:17:51 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<info@v-deploy.com>, method=PLAIN, rip=170.82.53.232, lip=66.85.158.91, TLS, session=<vuUtscVFF6mqUjXo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-13 00:17:53 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:51454: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.236.38.249
country_id: 130758
description:
Dec 13 00:17:55 host2 sshd[1024876]: Disconnected from invalid user michael 87.236.38.249 port 22958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-13 00:17:18 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:58792: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.52.149
country_id: 3469034
description:
Dec 13 00:18:14 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=170.82.52.149, lip=66.85.158.91, TLS, session=<3EbyssVF6dOqUjSV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.99.37
country_id: 3175395
description:
Dec 13 00:18:23 host2 sshd[1025116]: Disconnected from invalid user test 151.19.99.37 port 10803 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 00:18:41 host2 sshd[1025269]: Disconnected from invalid user  62.60.131.157 port 27422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 13 00:18:24 host2 sshd[1025127]: Disconnected from invalid user proxyuser 197.5.145.150 port 52308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.103.45.76
country_id: 298795
description:
Dec 13 00:18:26 host2 sshd[1025137]: Disconnected from invalid user akbar 94.103.45.76 port 57468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.236.38.249
country_id: 130758
description:
Dec 13 00:18:36 host2 sshd[1025212]: Disconnected from invalid user oracle 87.236.38.249 port 47380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-13 00:19:01 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:55756: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-13 00:19:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tepity) [87.103.126.54]:58450: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 13 00:19:45 host2 sshd[1025917]: Disconnected from invalid user proxyuser 152.42.165.179 port 47378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.32.121
country_id: 390903
description:
2025-12-13 00:19:14 dovecot_login authenticator failed for (149-210-32-121.mobile.nym.cosmote.net) [149.210.32.121]:58414: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.236.38.249
country_id: 130758
description:
Dec 13 00:19:16 host2 sshd[1025701]: Disconnected from invalid user git 87.236.38.249 port 31690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 13 00:20:26 host2 sshd[1026594]: Disconnected from invalid user vpnuser 197.5.145.150 port 57524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 00:20:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<S0tvvMVF7qi8pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.236.38.249
country_id: 130758
description:
Dec 13 00:21:46 host2 sshd[1027296]: Disconnected from invalid user www 87.236.38.249 port 24706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.103.45.76
country_id: 298795
description:
Dec 13 00:21:52 host2 sshd[1027357]: Disconnected from invalid user claude 94.103.45.76 port 37326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 00:22:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<i1YQwsVFHIoImxNM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Dec 13 00:22:14 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fW18wsVF8oi4aYtF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 13 00:22:31 host2 sshd[1027657]: Disconnected from invalid user ftpuser 197.5.145.150 port 39422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 00:22:53 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<g9S7xMVF0tZm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 00:23:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<W5jnxcVFjovAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.216.181.233
country_id: 2661886
description:
2025-12-13 00:23:21 dovecot_login authenticator failed for c80-216-181-233.bredband.tele2.se [80.216.181.233]:38790: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 13 00:23:20 host2 sshd[1028074]: Disconnected from invalid user ubuntu 197.5.145.150 port 46744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 13 00:23:30 host2 sshd[1028131]: Disconnected from invalid user user 152.42.165.179 port 50810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 00:23:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<mRQJx8VFmOHD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-13 00:23:33 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:42907: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-12-13 00:23:54 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:44166: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-13 00:24:24 dovecot_login authenticator failed for (nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:50530: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-13 00:24:40 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:41050: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 00:24:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<a/ASy8VFAOpAF6S9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.149.105
country_id: 953987
description:
Dec 13 00:24:57 host2 sshd[1028948]: Disconnected from invalid user odoo 102.210.149.105 port 53258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.100.10
country_id: 1269750
description:
2025-12-13 00:24:08 dovecot_login authenticator failed for (abts-west-static-208.237.201.106.airtelbroadband.in) [103.218.100.10]:58162: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.110.177.170
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 143.110.177.170 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 13 00:24:41 host2 sshd[1028846]: Disconnected from invalid user serv 142.93.27.16 port 40102 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 00:25:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ITl0zMVFctM+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-13 00:24:11 dovecot_plain authenticator failed for (putchydron) [5.31.15.108]:59818: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 13 00:25:34 host2 sshd[1029507]: Received disconnect from 198.23.143.193 port 59048:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.105
country_id: 953987
description:
Dec 13 00:25:39 host2 sshd[1029581]: Disconnected from invalid user mamad 102.210.149.105 port 33378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 13 00:26:06 host2 sshd[1030008]: Disconnected from invalid user vps 198.23.143.193 port 43076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.104.111.235
country_id: 6252001
description:
Dec 13 00:25:22 host2 sshd[1029371]: Disconnected from invalid user admin 149.104.111.235 port 56266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 149.104.111.235
country_id: 6252001
description:
Dec 13 00:26:40 host2 sshd[1030316]: Disconnected from invalid user user1 149.104.111.235 port 43624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.47.204
country_id: 6251999
description:
2025-12-13 00:26:39 dovecot_login authenticator failed for dhcp-4-bc-9f-70-1a-16.cpe.i-zoom.net [24.137.47.204]:55701: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-12-13 00:26:58 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:54610: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-13 00:27:45 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:44204: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-12-13 00:28:01 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:58099: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 13 00:27:16 host2 sshd[1030642]: Disconnected from invalid user ubuntu 152.42.165.179 port 50608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 13 00:28:44 host2 sshd[1031370]: Disconnected from invalid user wms 157.66.34.121 port 54346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.104.111.235
country_id: 6252001
description:
Dec 13 00:29:35 host2 sshd[1031825]: Disconnected from invalid user admin 149.104.111.235 port 53550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 13 00:29:20 host2 sshd[1031679]: Disconnected from invalid user ftpuser 157.66.34.121 port 58438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 00:29:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<o27V28VF1OHD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 13 00:30:32 host2 sshd[1032458]: Disconnected from invalid user abdi 157.66.34.121 port 33924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 00:32:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<ZorU5cVFkt2H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 00:32:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<DbTp5sVFpL4I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 00:32:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<D7oT6MVF1M6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 00:33:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<DaRI7MVFYpuLOxGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 00:33:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<nUmq6cVF7NKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-13 00:33:23 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:39661: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-12-13 00:33:35 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:50884: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.31
country_id: 3469034
description:
Dec 13 00:33:35 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=191.53.131.31, lip=66.85.158.91, TLS, session=<IgUQ6sVFjLq/NYMf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.190
country_id: 953987
description:
Dec 13 00:33:56 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=102.64.45.190, lip=66.85.158.91, TLS, session=<R/o/68VFetNmQC2+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.149
country_id: 6252001
description:
Dec 13 00:34:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.149, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xuHA7sVFbz1APpyV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Dec 13 00:34:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0LbP78VF6B5APpyO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 00:35:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<zFlg8sVFQqekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 00:36:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<nieB9MVFaM68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 00:36:36 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (polate) [73.197.236.163]:39246: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 00:36:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<ji0q9sVFMO3CBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-13 00:36:46 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (berly) [89.67.37.2]:52482: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-13 00:36:56 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:41088: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.32
country_id: 6252001
description:
2025-12-13 00:37:08 dovecot_login authenticator failed for ([98.181.46.32]) [98.181.46.32]:50760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 00:38:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<nyQx/MVFpJgIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.11
country_id: 3996063
description:
2025-12-13 00:41:46 dovecot_login authenticator failed for (189.218.82.11-clientes-izzi.mx) [189.218.82.11]:54468: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-13 00:42:05 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:49894: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 00:42:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<txfAC8ZF1Ikv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-13 00:42:14 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:46160: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-13 00:43:17 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:42911: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-13 00:43:33 dovecot_login authenticator failed for ([182.95.63.10]) [182.95.63.10]:48304: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.211.100.149
country_id: 3469034
description:
Dec 13 00:44:10 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.211.100.149, lip=66.85.158.91, TLS, session=<177jD8ZFK46602SV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.69
country_id: 1269750
description:
Dec 13 00:44:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.207.4.69, lip=66.85.158.91, TLS, session=<clEVEcZFFIFnzwRF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.155
country_id: 3469034
description:
Dec 13 00:46:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt>, method=PLAIN, rip=186.209.246.155, lip=66.85.158.91, TLS, session=<DmVEGcZFrLG60fab>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.92
country_id: 3469034
description:
Dec 13 00:46:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=170.80.41.92, lip=66.85.158.91, TLS, session=<R/f7F8ZFs9+qUClc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-13 00:46:31 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tuilioted) [87.103.126.54]:58197: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 00:47:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<FkB+HcZFJNII3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 00:48:35 host2 sshd[1044582]: Disconnected from invalid user admin 2.57.121.112 port 54557 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-13 00:49:03 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:39116: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-13 00:48:17 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:50563: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-13 00:48:31 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:60642: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-12-13 00:49:41 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:51722: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-13 00:51:16 dovecot_plain authenticator failed for (dririck) [105.72.176.66]:50770: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-13 00:51:19 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (uncom) [71.62.34.216]:57798: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 00:51:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<lxqCLMZFProuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 00:52:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=</JKLLcZFpICl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-12-13 00:54:52 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:56705: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-13 00:55:07 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:50106: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-13 00:55:25 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49004: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 00:55:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<goPwOcZFEssro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 00:56:01 host2 sshd[1050528]: Disconnected from invalid user  62.60.131.157 port 9356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-13 00:58:02 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:42124: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-13 00:58:26 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:45556: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 00:58:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<l3diRcZFHrxntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 00:59:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<nUBKSMZF4peG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-13 01:00:29 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:53252: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 01:00:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<TwTrS8ZFktPO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-13 01:00:51 dovecot_login authenticator failed for ([161.8.241.121]) [161.8.241.121]:41417: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 01:01:39 host2 sshd[1053860]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 01:01:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<g1KTTsZFaL2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-13 01:01:59 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:54584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-13 01:02:14 dovecot_login authenticator failed for ([182.95.178.206]) [182.95.178.206]:51810: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 01:03:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<NV2QVcZFa/JetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 01:04:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<RB9cWsZFaplnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-13 01:05:32 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (iweeze) [87.103.126.54]:64964: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 01:05:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<6DrPXcZFuOg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 01:05:50 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (reffal) [85.225.19.144]:41238: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2025-12-13 01:07:33 dovecot_login authenticator failed for ([152.52.220.126]) [152.52.220.126]:42904: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 01:07:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<0sMHZcZFqoUvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-13 01:07:56 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (fabled) [87.103.126.54]:27702: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-13 01:07:10 dovecot_login authenticator failed for ([182.79.87.18]) [182.79.87.18]:43064: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2025-12-13 01:07:22 dovecot_login authenticator failed for ([177.236.146.222]) [177.236.146.222]:55393: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-12-13 01:08:18 dovecot_plain authenticator failed for c-73-55-194-114.hsd1.tx.comcast.net (ficatefals) [73.55.194.114]:50664: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-13 01:09:03 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:38570: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 01:09:40 host2 sshd[1059019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.92.201
country_id: 2802361
description:
Dec 13 01:09:26 host2 pure-ftpd[1058907]: (?@34.140.92.201) [INFO] New connection from 34.140.92.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-13 01:13:04 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:40038: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-12-13 01:13:17 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:3972: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.46.42
country_id: 1821275
description:
2025-12-13 01:13:40 dovecot_login authenticator failed for ([125.31.46.42]) [125.31.46.42]:55070: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 01:13:54 dovecot_login authenticator failed for ([182.95.138.209]) [182.95.181.62]:47828: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 01:14:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<j6YafcZF4PZ100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-13 01:14:39 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (lamium) [76.97.155.25]:35060: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 01:15:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<cyT2gMZFuIe8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-12-13 01:15:59 dovecot_plain authenticator failed for c-73-55-194-114.hsd1.tx.comcast.net (ackent) [73.55.194.114]:59842: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-13 01:16:01 dovecot_login authenticator failed for ([78.156.6.163]) [78.156.6.163]:41484: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-12-13 01:16:36 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:46801: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 01:16:59 host2 sshd[1063293]: Disconnected from invalid user admin 2.57.121.112 port 12500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 01:17:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<vfm9hsZF/sRm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 01:18:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<10KqisZFEurD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 01:19:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<hE1ekMZFaJDAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 01:20:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<0rh5ksZFKsdAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 01:21:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<y8j9l8ZFwKIImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-13 01:23:14 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:54510: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-12-13 01:23:31 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:35545: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 01:24:04 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=</p6Bn8ZFzqnD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:25:18 host2 sshd[1068671]: Disconnected from invalid user artem 200.73.135.75 port 45032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 01:26:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<QJDOqMZFLtBo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2025-12-13 01:27:21 dovecot_login authenticator failed for 236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:52811: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-12-13 01:27:36 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:49108: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:28:27 host2 sshd[1070737]: Disconnected from invalid user ftpuser 200.73.135.75 port 41096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.53.141
country_id: 1880251
description:
Dec 13 01:28:31 host2 sshd[1070752]: Disconnected from invalid user nodejs 43.134.53.141 port 48242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:28:57 host2 sshd[1070909]: Disconnected from invalid user ha 54.162.68.141 port 53652 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 01:28:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<XE4YscZFgpMI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:29:32 host2 sshd[1071187]: Disconnected from invalid user nami 54.162.68.141 port 46806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 01:30:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<KGG7tMZFXpSKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:29:09 host2 sshd[1071013]: Disconnected from invalid user postgres 200.73.135.75 port 53596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:30:37 host2 sshd[1071983]: Disconnected from invalid user ubuntu 54.162.68.141 port 40384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:31:12 host2 sshd[1072341]: Disconnected from invalid user r00t 200.73.135.75 port 34662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.53.141
country_id: 1880251
description:
Dec 13 01:31:21 host2 sshd[1072434]: Disconnected from invalid user postgres 43.134.53.141 port 51942 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 01:31:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<K1kHusZFRoSB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 01:31:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<OK8husZFKJiH6yFP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:32:15 host2 sshd[1073348]: Disconnected from invalid user ubuntu 54.162.68.141 port 56840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-13 01:32:19 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:59682: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-13 01:32:30 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:34693: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2025-12-13 01:32:53 dovecot_login authenticator failed for (aes-static-225.77.144.59.airtel.in) [182.95.123.50]:50244: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 01:32:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<A7eEvMZFRr2kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-13 01:32:12 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:33036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.53.141
country_id: 1880251
description:
Dec 13 01:33:10 host2 sshd[1073925]: Disconnected from invalid user julio 43.134.53.141 port 46584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.162.68.141
country_id: 6252001
description:
Dec 13 01:33:20 host2 sshd[1074037]: Disconnected from invalid user patrol 54.162.68.141 port 41118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-13 01:33:48 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1127: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 01:34:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<zb1yw8ZF3KTCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-13 01:34:10 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:59324: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.53.141
country_id: 1880251
description:
Dec 13 01:35:05 host2 sshd[1075349]: Disconnected from invalid user luis 43.134.53.141 port 35508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Dec 13 01:36:04 host2 sshd[1076139]: Disconnected from invalid user julio 200.73.135.75 port 37560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 01:35:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<KO68x8ZFto68putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 01:37:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<kh7TzsZFntcIgeYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.241.64
country_id: 1269750
description:
Dec 13 01:38:13 host2 sshd[1077699]: Disconnected from invalid user peter 143.110.241.64 port 36816 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-13 01:38:22 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:54350: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-13 01:38:42 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:3584: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-13 01:39:10 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:39126: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.185
country_id: 3144096
description:
2025-12-13 01:39:40 dovecot_login authenticator failed for (cm-84.215.111.185.get.no) [84.215.111.185]:35894: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 01:39:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<b9Zb18ZFZrgv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.241.64
country_id: 1269750
description:
Dec 13 01:39:49 host2 sshd[1078534]: Disconnected from invalid user lee 143.110.241.64 port 42560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 01:40:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<GGIR2sZFaqc+PIMp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.241.64
country_id: 1269750
description:
Dec 13 01:40:27 host2 sshd[1079130]: Disconnected from invalid user deployer 143.110.241.64 port 36542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 13 01:40:34 host2 sshd[1079186]: Disconnected from invalid user support 20.12.41.6 port 43560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 13 01:41:10 host2 sshd[1079460]: Disconnected from invalid user ftpuser 20.12.41.6 port 45654 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 13 01:42:28 host2 sshd[1080030]: Disconnected from invalid user kafka 20.12.41.6 port 60734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 13 01:43:43 host2 sshd[1080772]: Disconnected from invalid user test 20.12.41.6 port 46494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 01:44:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<2hI56sZFGL2B4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 01:44:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<6Z8b6MZFaNQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-13 01:44:50 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (undist) [144.64.157.244]:52173: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-13 01:46:32 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (snecoeace) [68.38.201.238]:47222: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-13 01:47:31 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (regasia) [73.176.157.57]:57912: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-13 01:48:01 dovecot_plain authenticator failed for (eluenest) [149.62.239.4]:38612: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 01:48:06 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (obionvoust) [96.230.65.90]:48302: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 01:48:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<EeO798ZFiuQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-13 01:48:48 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:41315: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 01:48:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<I+lz98ZF0oqnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 13 01:49:24 host2 sshd[1084665]: Disconnected from invalid user www-data 103.38.182.49 port 49872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 01:49:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<z0pZ+8ZFbI9ntrtb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 01:51:07 host2 sshd[1085971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 01:50:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<Lm7G/MZFWJ+l6L5h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 13 01:50:18 host2 sshd[1085441]: Disconnected from invalid user test3 186.87.166.141 port 33182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 01:50:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<HIb1/sZF4OUro2np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.170
country_id: 1643084
description:
Dec 13 01:50:46 host2 sshd[1085721]: Disconnected from invalid user qiyuesuo 103.179.56.170 port 60808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 13 01:51:28 host2 sshd[1086157]: Disconnected from invalid user git 191.185.168.78 port 60246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-13 01:52:01 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:36614: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 13 01:52:01 host2 sshd[1086438]: Disconnected from invalid user ubuntu 103.38.182.49 port 34450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-13 01:52:30 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:41620: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-13 01:52:50 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:56648: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.229
country_id: 192950
description:
Dec 13 01:52:58 host2 sshd[1087144]: Disconnected from invalid user ftp_user 102.220.23.229 port 56066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 13 01:53:19 host2 sshd[1087353]: Disconnected from invalid user proxyuser 103.38.182.49 port 55010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.253.45.10
country_id: 2510769
description:
Dec 13 01:53:28 host2 sshd[1087420]: Disconnected from invalid user ftpuser 46.253.45.10 port 36040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-13 01:53:38 dovecot_login authenticator failed for (201.172.89.74-clientes-izzi.mx) [201.172.89.74]:43754: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.229
country_id: 192950
description:
Dec 13 01:53:41 host2 sshd[1087541]: Disconnected from invalid user qiyuesuo 102.220.23.229 port 36710 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-12-13 01:53:19 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:33836: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 13 01:53:50 host2 sshd[1087623]: Disconnected from invalid user temp 191.185.168.78 port 47224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 13 01:54:38 host2 sshd[1088568]: Disconnected from invalid user mata 191.185.168.78 port 33474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 13 01:54:42 host2 sshd[1088608]: Disconnected from invalid user bpadmin 103.38.182.49 port 52864 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.229
country_id: 192950
description:
Dec 13 01:54:23 host2 sshd[1088308]: Disconnected from invalid user admin 102.220.23.229 port 39668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 13 01:54:32 host2 sshd[1088520]: Disconnected from invalid user ftp-test 37.32.10.237 port 40198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 13 01:55:42 host2 sshd[1089355]: Disconnected from invalid user elk 37.32.10.237 port 51026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 13 01:55:50 host2 sshd[1089449]: Disconnected from invalid user ubuntu 194.233.74.228 port 55092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Dec 13 01:55:16 host2 sshd[1089013]: Disconnected from invalid user mytest 152.32.218.244 port 52672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.229
country_id: 192950
description:
Dec 13 01:56:28 host2 sshd[1089860]: Disconnected from invalid user bpadmin 102.220.23.229 port 33608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 13 01:56:44 host2 sshd[1090035]: Disconnected from invalid user ela 186.87.166.141 port 58820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 01:57:02 host2 sshd[1090190]: Disconnected from invalid user temp 27.112.78.245 port 51910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.244
country_id: 1880251
description:
Dec 13 01:57:08 host2 sshd[1090301]: Disconnected from invalid user sammy 152.32.218.244 port 44446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 13 01:57:13 host2 sshd[1090380]: Disconnected from invalid user ircd 194.233.74.228 port 45516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 13 01:57:29 host2 sshd[1090533]: Disconnected from invalid user xray 37.32.10.237 port 40964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 13 01:57:45 host2 sshd[1090658]: Disconnected from invalid user evan 191.185.168.78 port 34942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-13 01:57:22 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:42856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.217.70
country_id: 1269750
description:
2025-12-13 01:57:32 dovecot_login authenticator failed for ([203.129.217.70]) [203.129.217.70]:58259: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-13 01:57:42 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:46910: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.250
country_id: 6252001
description:
2025-12-13 01:57:43 dovecot_login authenticator failed for ([98.185.121.250]) [98.185.121.250]:42191: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 01:57:57 host2 sshd[1090782]: Disconnected from invalid user builder 27.112.78.245 port 43238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 01:58:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<MSWnGcdF9K/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-13 01:58:17 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:35704: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-13 01:58:29 dovecot_login authenticator failed for (187-163-97-62.cust.smartcall.no) [62.97.163.187]:41895: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 01:58:46 host2 sshd[1091331]: Disconnected from invalid user git 27.112.78.245 port 54908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 01:59:55 host2 sshd[1091889]: Disconnected from invalid user admin 2.57.121.112 port 49717 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 01:59:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<mybsHMdFQMOG0Wp/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 01:59:42 host2 sshd[1091804]: Disconnected from invalid user mata 27.112.78.245 port 37644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 01:59:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<d7ALH8dFuOPCw3NV>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 46.253.45.10
country_id: 2510769
description:
Dec 13 02:00:09 host2 sshd[1092230]: Received disconnect from 46.253.45.10 port 33180:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 02:00:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<xg2WIcdFDNc+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-13 02:00:45 dovecot_plain authenticator failed for (furate) [64.72.74.162]:55940: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 13 02:00:29 host2 sshd[1092476]: Disconnected from invalid user ircd 37.32.10.237 port 49974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-13 02:00:41 dovecot_plain authenticator failed for (hoosig) [5.11.140.219]:59586: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 13 02:00:42 host2 sshd[1092596]: Disconnected from invalid user elk 194.233.74.228 port 50084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 13 02:00:47 host2 sshd[1092640]: Disconnected from invalid user rajesh 137.59.55.50 port 48870 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 02:01:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<urgNJMdFvpOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 02:01:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<KFbWJMdFjqNnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 13 02:01:29 host2 sshd[1093006]: Disconnected from invalid user ubuntu 27.112.78.245 port 44708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 13 02:02:03 host2 sshd[1093335]: Disconnected from invalid user ubuntu 137.59.55.50 port 57924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-13 02:03:00 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:45779: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 13 02:03:47 host2 sshd[1094627]: Disconnected from invalid user syncuser 202.51.214.99 port 56660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-13 02:03:44 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:51304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 13 02:03:15 host2 sshd[1094266]: Disconnected from invalid user www-data 137.59.55.50 port 53076 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 02:03:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<d+BELMdFNuBetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.170
country_id: 1643084
description:
Dec 13 02:03:11 host2 sshd[1094208]: Disconnected from invalid user rajesh 103.179.56.170 port 45942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-13 02:03:13 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:56568: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 13 02:04:10 host2 sshd[1094987]: Disconnected from invalid user hadoop 107.150.110.167 port 12956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.170
country_id: 1643084
description:
Dec 13 02:04:37 host2 sshd[1095275]: Disconnected from invalid user es_user 103.179.56.170 port 58214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 02:04:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<xsj0MMdFLCcvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-13 02:04:44 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (oveed) [73.168.136.150]:43260: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 02:04:47 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (vagiver) [96.230.65.90]:56314: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 13 02:05:30 host2 sshd[1096040]: Disconnected from invalid user gautam 202.51.214.99 port 57246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 13 02:05:37 host2 sshd[1096126]: Disconnected from invalid user jy 107.150.110.167 port 41020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 13 02:05:44 host2 sshd[1096162]: Disconnected from invalid user mani 197.158.254.18 port 38916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.77
country_id: 6252001
description:
Dec 13 02:05:47 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.77, lip=66.85.158.91, session=<xZDVNMdFdvnG6xhN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Dec 13 02:06:22 host2 sshd[1096481]: Disconnected from invalid user pepe 103.154.77.48 port 57370 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-13 02:07:03 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:35740: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-13 02:07:58 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:52680: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 13 02:07:14 host2 sshd[1096950]: Disconnected from invalid user test 193.187.148.79 port 39856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 13 02:07:16 host2 sshd[1096982]: Disconnected from invalid user ubuntu 107.150.110.167 port 23272 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-13 02:07:21 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (sularding) [66.177.30.53]:33324: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 13 02:07:25 host2 sshd[1097069]: Disconnected from invalid user niti 202.51.214.99 port 37786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 02:07:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<xrvOO8dFYpE+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Dec 13 02:08:43 host2 sshd[1098091]: Disconnected from invalid user enter 103.154.77.48 port 47530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.150.56
country_id: 6252001
description:
Dec 13 02:08:57 host2 sshd[1098223]: Disconnected from invalid user pepe 198.23.150.56 port 43132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Dec 13 02:09:07 host2 sshd[1098347]: Disconnected from invalid user dbuser 104.248.17.208 port 41664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 13 02:08:34 host2 sshd[1097792]: Disconnected from invalid user june 197.158.254.18 port 53364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 13 02:09:26 host2 sshd[1098571]: Disconnected from invalid user admin 197.158.254.18 port 39346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 02:09:38 host2 sshd[1098704]: Disconnected from invalid user  62.60.131.157 port 62498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 13 02:09:58 host2 sshd[1098906]: Disconnected from invalid user ftp_user 193.187.148.79 port 36650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 13 02:10:16 host2 sshd[1099306]: Disconnected from invalid user willem 197.158.254.18 port 53558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Dec 13 02:10:25 host2 sshd[1099418]: Disconnected from invalid user ubuntu 45.249.245.22 port 37290 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.17.208
country_id: 2921044
description:
Dec 13 02:10:30 host2 sshd[1099511]: Disconnected from invalid user factorio 104.248.17.208 port 47324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 02:10:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<rADCRsdFzKy8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 02:11:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Ctq3ScdFrIxm1bVi>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 13 02:12:05 host2 sshd[1100517]: Received disconnect from 193.187.148.79 port 39866:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 13 02:12:05 host2 sshd[1100517]: Disconnected from invalid user ubuntu 193.187.148.79 port 39866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-13 02:13:33 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:52582: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 13 02:13:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<Fy+LT8dF8K/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2025-12-13 02:13:19 dovecot_login authenticator failed for 180.188.76.219.static.netvigator.com [219.76.188.180]:54791: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 02:13:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<qQ3aT8dF+pbD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 02:16:58 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (domarigo) [96.230.65.90]:40766: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-13 02:16:25 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (hipomonony) [196.47.172.253]:33112: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 02:16:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<a/8WW8dFxoBAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 02:16:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<quhYXMdFApfAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-12-13 02:18:01 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:52721: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.43
country_id: 3175395
description:
Dec 13 02:18:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=217.26.178.43, lip=66.85.158.91, TLS, session=<6YG9X8dFE4jZGrIr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.107
country_id: 3175395
description:
Dec 13 02:18:24 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.47.136.107, lip=66.85.158.91, TLS, session=<p3fpYMdFPOi5L4hr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.198.29
country_id: 1522867
description:
2025-12-13 02:18:38 dovecot_login authenticator failed for 2.133.198.29.dynamic.telecom.kz [2.133.198.29]:54955: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 02:18:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<5/1/Y8dFbM+LOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-13 02:19:09 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:47408: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-13 02:19:32 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (pyromers) [76.31.164.124]:46124: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 02:19:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<8nr6ZMdF8rTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 02:20:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54582: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 02:21:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<XraJa8dFTs0ImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.51.52.15
country_id: 1605651
description:
2025-12-13 02:22:01 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [101.51.52.15]:42891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-13 02:22:02 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:50879: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.88
country_id: 3996063
description:
2025-12-13 02:22:14 dovecot_login authenticator failed for ([201.173.97.88]) [201.173.97.88]:46083: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-13 02:22:29 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:40752: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-13 02:22:53 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:38480: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2025-12-13 02:23:07 dovecot_login authenticator failed for (164-53-26-103.intechonline.net) [122.169.40.221]:39116: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.61
country_id: 6252001
description:
2025-12-13 02:24:04 dovecot_login authenticator failed for ([98.185.120.61]) [98.185.120.61]:56840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-12-13 02:24:10 dovecot_plain authenticator failed for c-73-55-194-114.hsd1.tx.comcast.net (cambly) [73.55.194.114]:46890: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 13 02:23:40 host2 sshd[1108278]: Disconnected from invalid user git 103.176.79.117 port 60306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 13 02:23:49 host2 sshd[1108355]: Disconnected from invalid user erpnext 152.32.203.205 port 36628 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.70.252
country_id: 2921044
description:
Dec 13 02:24:26 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.70.252, lip=66.85.158.92, session=<C9KCd8dFz2aGekb8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.78.30
country_id: 2921044
description:
Dec 13 02:24:26 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.232.78.30, lip=66.85.158.92, session=<km2Jd8dFBhSl6E4e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-13 02:24:55 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (ancized) [73.137.7.97]:41206: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 13 02:25:10 host2 sshd[1109324]: Disconnected from invalid user frappe 207.154.247.4 port 59840 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 02:26:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=</YhafcdF4NAI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 02:25:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<6k2BesdFxtOKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 13 02:25:23 host2 sshd[1109586]: Disconnected from invalid user joao 152.32.203.205 port 58840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 13 02:25:45 host2 sshd[1109763]: Disconnected from invalid user builduser 103.164.81.65 port 57338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 13 02:25:48 host2 sshd[1109780]: Disconnected from invalid user test 223.17.0.220 port 38512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 13 02:26:17 host2 sshd[1110035]: Disconnected from invalid user temp 152.32.203.205 port 43266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-13 02:28:04 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:58170: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-13 02:28:08 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:59786: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 13 02:27:44 host2 sshd[1110775]: Disconnected from invalid user john 103.164.81.65 port 39584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-13 02:27:46 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (gention) [68.193.149.88]:36320: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-13 02:27:54 dovecot_login authenticator failed for ([182.95.178.154]) [182.95.178.154]:53800: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.87.153
country_id: 1880251
description:
Dec 13 02:29:14 host2 sshd[1111799]: Disconnected from invalid user fran 43.128.87.153 port 48334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.160
country_id: 2186224
description:
2025-12-13 02:28:20 dovecot_login authenticator failed for ([121.73.169.160]) [121.73.169.160]:43356: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Dec 13 02:28:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<v88OhsdFoFSnXpI6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 02:28:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<khVuhsdFruGkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-13 02:29:01 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:33963: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 13 02:28:57 host2 sshd[1111483]: Disconnected from invalid user ftpuser 207.154.247.4 port 54278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 13 02:29:12 host2 sshd[1111770]: Disconnected from invalid user www-data 103.103.245.61 port 49068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-13 02:29:08 dovecot_login authenticator failed for (88.255.189.21.static.ttnet.com.tr) [88.255.189.21]:33464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 13 02:28:20 host2 sshd[1111162]: Disconnected from invalid user ftpuser 103.164.81.65 port 51988 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-13 02:29:15 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:35654: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 13 02:29:37 host2 sshd[1112018]: Disconnected from invalid user elena 207.154.247.4 port 33050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 13 02:29:46 host2 sshd[1112078]: Disconnected from invalid user elena 103.103.245.61 port 33746 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-13 02:29:25 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:47867: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 13 02:30:06 host2 sshd[1112431]: Disconnected from invalid user erpnext 223.17.0.220 port 44610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.237.122.43
country_id: 6252001
description:
Dec 13 02:30:31 host2 sshd[1112701]: Disconnected from invalid user builduser 135.237.122.43 port 51158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 02:30:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<Sf/QjMdF9ICH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 02:30:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<Ekd6jMdFWMaB4kCN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.87.153
country_id: 1880251
description:
Dec 13 02:32:07 host2 sshd[1113580]: Disconnected from invalid user elena 43.128.87.153 port 43958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 13 02:31:28 host2 sshd[1113213]: Disconnected from invalid user elena 72.144.12.31 port 45204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 02:31:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<07KykMdFVJbCBa8Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 13 02:32:04 host2 sshd[1113564]: Disconnected from invalid user fran 103.103.245.61 port 58952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-13 02:32:38 dovecot_plain authenticator failed for (intably) [24.187.213.29]:53398: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 13 02:32:49 host2 sshd[1113947]: Disconnected from invalid user ftpuser 103.176.79.117 port 39250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 13 02:32:39 host2 sshd[1113867]: Disconnected from invalid user ftpuser 103.103.245.61 port 36604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 13 02:33:18 host2 sshd[1114270]: Disconnected from invalid user user1 72.144.12.31 port 57846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Dec 13 02:33:35 host2 sshd[1114426]: Disconnected from invalid user esunny 135.237.122.43 port 46912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 02:33:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<1TRWmMdFIOm8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.30
country_id: 798544
description:
Dec 13 02:33:49 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=91.228.33.30, lip=66.85.158.91, TLS, session=<OHMjmMdFFrRb5CEe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.194
country_id: 3865483
description:
Dec 13 02:34:11 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=186.190.167.194, lip=66.85.158.91, TLS, session=<VvVEmcdFwZe6vqfC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 13 02:35:15 host2 sshd[1115705]: Disconnected from invalid user user1 103.176.79.117 port 57398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 02:36:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<7CoGo8dFgqgIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 02:37:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<nvOnp8dF1Okv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-13 02:37:33 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:54125: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 13 02:38:26 host2 sshd[1117292]: Disconnected from invalid user jbernal 103.176.79.117 port 44118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-13 02:38:40 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:58053: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-13 02:39:00 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:60140: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 02:40:12 dovecot_plain authenticator failed for (seling) [12.150.243.22]:17050: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 02:39:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<eAUFrsdFotNntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 02:39:51 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<dkeQrsdF/OqB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-13 02:41:11 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (pores) [144.64.157.244]:39676: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 02:41:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<+xFPtMdFHNkI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 02:42:56 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:36450: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-13 02:42:41 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:54400: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.235.40.131
country_id: 6252001
description:
Dec 13 02:43:42 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.235.40.131, lip=66.85.158.92, session=<LVRsvMdFNres6yiD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 02:43:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<XU3JusdFeI8+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.144
country_id: 3865483
description:
Dec 13 02:44:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=190.181.109.144, lip=66.85.158.91, TLS, session=<mcWlvcdFksq+tW2Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.166
country_id: 3469034
description:
Dec 13 02:44:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.92.247.166, lip=66.85.158.91, TLS, session=<WWHvvsdFhJqxXPem>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 02:44:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<P9/6v8dFFO0uZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Dec 13 02:45:02 host2 dovecot[3988696]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.92, session=<PfMywcdFKjXAm1rc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.222
country_id: 798544
description:
Dec 13 02:46:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=46.227.39.222, lip=66.85.158.91, TLS, session=<dg2VxcdFe6Eu4yfe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.102
country_id: 3865483
description:
Dec 13 02:46:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=45.238.107.102, lip=66.85.158.91, TLS, session=<ELvExsdFX8Mt7mtm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 02:46:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<XsL0xcdFaqcro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-13 02:47:53 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:59349: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 02:47:54 dovecot_login authenticator failed for ([182.95.181.62]) [182.95.181.62]:39724: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 02:48:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<XEypy8dFguyl6L5h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-13 02:47:15 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:39673: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-13 02:47:41 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:42784: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-13 02:48:33 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:23640: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-13 02:49:11 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:49386: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 13 02:52:40 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<aJGG3MdFILm58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-13 02:53:13 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:41644: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-13 02:53:28 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:58821: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-13 02:54:16 dovecot_login authenticator failed for ([65.20.250.93]) [65.20.250.93]:35661: 535 Incorrect authentication data (set_id=order@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-12-13 02:54:39 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:37604: 535 Incorrect authentication data (set_id=order)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 02:56:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<xcdR6MdFOq/O7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 13 02:58:05 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Z2je78dFtrO58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 02:58:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<jmML8MdFmJaG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 02:57:40 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<+QdH7sdF5uhnpBQq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 02:59:13 host2 sshd[1129605]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.111.150
country_id: 2921044
description:
Dec 13 02:59:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=46.101.111.150, lip=66.85.158.92, session=<sK1v9MdF0VEuZW+W>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.159.71
country_id: 2921044
description:
Dec 13 02:59:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.159.71, lip=66.85.158.92, session=<+iB19MdFTOel459H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 03:00:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<mnN398dFWNmWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-13 03:01:27 dovecot_plain authenticator failed for (osing) [46.10.210.68]:59599: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 03:02:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<vSXe/sdF2C4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 03:02:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<yuCE/8dFWHVetwuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 03:04:04 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:38238: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.233.96.173
country_id: 2802361
description:
Dec 13 03:04:16 host2 pure-ftpd[1132900]: (?@35.233.96.173) [INFO] New connection from 35.233.96.173


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-13 03:04:18 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:41080: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:05:37 host2 sshd[1133755]: Disconnected from invalid user developer 20.193.141.133 port 56124 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:06:52 host2 sshd[1134484]: Disconnected from invalid user tommy 20.193.141.133 port 20130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 03:07:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<MrcLEMhFDLlm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:06:15 host2 sshd[1134179]: Disconnected from invalid user testuser 20.193.141.133 port 39348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:07:29 host2 sshd[1134934]: Disconnected from invalid user eco 20.193.141.133 port 5961 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-13 03:07:38 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:58039: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-13 03:07:56 dovecot_login authenticator failed for ([125.19.110.89]) [182.78.107.6]:57474: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-13 03:07:25 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:55232: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.75.185.190
country_id: 6252001
description:
2025-12-13 03:07:27 dovecot_login authenticator failed for (149-75-185-190.s445.c3-0.elg-e6k1.nape.il.cable.rcncustomer.com) [149.75.185.190]:51740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 03:08:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<mjCsFchFGtzD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 03:09:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<8EqUF8hFVt28pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-13 03:08:22 dovecot_plain authenticator failed for (cringrate) [5.11.143.72]:54318: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-13 03:09:37 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (clace) [73.197.194.98]:34014: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-13 03:09:41 dovecot_plain authenticator failed for (synon) [12.150.243.22]:6539: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 13 03:10:06 host2 sshd[1136482]: Disconnected from invalid user term2 20.193.141.133 port 64704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Dec 13 03:10:22 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<l6rNG8hFIsGTuYSK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 13 03:10:23 host2 sshd[1136724]: Disconnected from invalid user user 103.179.57.150 port 39144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-13 03:11:24 dovecot_plain authenticator failed for (forearity) [199.192.123.12]:55344: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 03:11:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ZDNJIMhFt0l100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 13 03:11:14 host2 sshd[1137258]: Disconnected from invalid user ammar 103.179.57.150 port 38616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 03:12:45 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<k+QxJMhFzuVAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 03:12:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<qqJ9JMhFuuNo1joy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-12-13 03:12:55 dovecot_login authenticator failed for ([49.124.151.56]) [49.124.151.56]:52628: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-12-13 03:12:27 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:52888: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-13 03:12:39 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:37463: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-13 03:12:42 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:58026: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-13 03:14:01 dovecot_login authenticator failed for ([103.186.193.149]) [103.186.193.149]:43452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 13 03:15:05 host2 sshd[1139456]: Disconnected from invalid user pablo 103.179.57.150 port 42822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 03:14:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4f/FKshFlI/D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 03:14:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<hPGCK8hFAqHAqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-13 03:18:48 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:51720: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 03:19:03 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<+s60OshFXM8+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-13 03:19:11 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:59596: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-12-13 03:19:34 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:55868: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-12-13 03:20:24 dovecot_login authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:52473: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 03:20:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ILi9P8hFNp2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 03:21:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<vTpkQshFipAImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 03:23:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<3LJOSchFxL0I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 03:25:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<BLEUUshF/LikXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.198
country_id: 6252001
description:
Dec 13 03:27:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sENaV8hFitTN0h/G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 03:29:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<S7pKXshF+pGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 03:29:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<8g9KXshF4Ntntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-13 03:29:07 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (coromanks) [76.157.219.158]:51422: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 03:29:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<MSoDYMhFzomB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 03:29:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<sQiQYMhF6tHCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-13 03:29:46 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:39054: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 03:31:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<9nRQZshFzIK8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 13 03:31:49 host2 sshd[1150050]: Disconnected from invalid user fox 92.191.96.115 port 4154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-13 03:31:52 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (snanum) [73.208.81.125]:35964: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:32:03 host2 sshd[1150209]: Disconnected from invalid user temp 51.77.137.25 port 51888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 03:32:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<OffQashFZoCH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:32:35 host2 sshd[1150560]: Disconnected from invalid user teamcity 51.77.137.25 port 39820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:33:05 host2 sshd[1150818]: Disconnected from invalid user backend 51.77.137.25 port 35322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-13 03:33:06 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:36162: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:33:35 host2 sshd[1151065]: Disconnected from invalid user fox 51.77.137.25 port 38542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-12-13 03:33:41 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:41383: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 13 03:35:07 host2 sshd[1152209]: Disconnected from invalid user sysadmin 51.77.137.25 port 57328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 13 03:35:09 host2 sshd[1152251]: Disconnected from invalid user igor 92.191.96.115 port 64000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 03:35:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<RIdadchF1qgv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 13 03:35:50 host2 sshd[1152840]: Disconnected from invalid user vpn 92.191.96.115 port 35374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 03:37:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<73ASe8hFZoMIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-13 03:38:06 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:41374: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-13 03:38:12 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (hawiss) [174.161.27.82]:55348: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-13 03:37:53 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:34946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-13 03:38:17 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:60838: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-12-13 03:38:27 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:57010: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 03:38:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<3KvLgMhFmKsI3tq7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.239
country_id: 6252001
description:
Dec 13 03:38:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.239, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KbeGgchFddPN0h/v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-13 03:39:43 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:37014: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-13 03:39:57 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:46204: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 03:40:14 host2 sshd[1155994]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-13 03:41:09 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:32982: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 03:41:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<52X5ichFctkuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-13 03:40:40 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (sacopher) [67.172.54.29]:58454: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 03:42:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<YzZaj8hFbL8ro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-13 03:44:00 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:55981: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Dec 13 03:44:03 host2 sshd[1158381]: Disconnected from invalid user test1234 120.62.8.17 port 47643 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-13 03:43:48 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:52583: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 13 03:45:09 host2 sshd[1159550]: Disconnected from invalid user teste 103.84.236.222 port 38226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-13 03:45:12 dovecot_login authenticator failed for (mail3.hurst.co.uk) [77.89.143.122]:39214: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 13 03:44:26 host2 sshd[1158920]: Disconnected from invalid user samuel 122.166.49.42 port 40740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-13 03:45:01 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:41926: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.248.73.162
country_id: 1643084
description:
Dec 13 03:45:23 host2 pure-ftpd[1160057]: (?@178.248.73.162) [INFO] New connection from 178.248.73.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.86.29.123
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 195.86.29.123 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 120.62.8.17
country_id: 1269750
description:
Dec 13 03:45:30 host2 sshd[1160283]: Disconnected from invalid user daniil 120.62.8.17 port 60964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 03:46:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<oi+hm8hFdpCB4gum>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 13 03:45:18 host2 sshd[1159762]: Disconnected from invalid user fmaster 122.166.49.42 port 55936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-13 03:46:52 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:55334: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-13 03:46:32 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:59490: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.10
country_id: 798549
description:
Dec 13 03:48:20 host2 pure-ftpd[1162643]: (?@85.217.140.10) [INFO] New connection from 85.217.140.10


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 03:48:50 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<Pi0upchFxMal6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 03:48:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<cLCUpchFANE+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 13 03:49:32 host2 sshd[1163437]: Disconnected from invalid user dj 103.84.236.222 port 41338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Dec 13 03:49:47 host2 sshd[1163545]: Disconnected from invalid user samuel 120.62.8.17 port 47447 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 03:49:53 host2 sshd[1163564]: Disconnected from invalid user user 2.57.121.25 port 37692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 13 03:50:44 host2 sshd[1164341]: Disconnected from invalid user hydra 103.84.236.222 port 38190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 03:51:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Qaj5rMhFsM8+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 13 03:53:18 host2 sshd[1165908]: Disconnected from invalid user kafka 45.182.207.45 port 54208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 03:54:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<uKUfuchFsJhnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 03:54:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<AeCNuchFXIHO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 13 03:55:25 host2 sshd[1167682]: Disconnected from invalid user going 45.182.207.45 port 60042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-13 03:56:59 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (polate) [217.215.74.195]:40001: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 13 03:58:08 host2 sshd[1169266]: Disconnected from invalid user jmarquez 45.182.207.45 port 51866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 03:57:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<yyyUxMhFQKOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-12-13 03:57:46 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:45464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-13 03:58:37 dovecot_login authenticator failed for ([182.95.25.234]) [182.95.63.10]:47394: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 04:00:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<rEx2zchF7qKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 04:00:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<O1LhzshFbnwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 04:02:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<WcZJ1shFwitetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 04:02:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<SnKD18hFNrVm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.40
country_id: 1733045
description:
2025-12-13 04:02:55 dovecot_login authenticator failed for ([49.124.146.40]) [49.124.146.40]:54898: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-13 04:02:59 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:54852: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 04:03:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<mxAF2MhF1NWLOxGe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-13 04:02:33 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:38202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-13 04:03:23 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:36909: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-13 04:03:41 dovecot_plain authenticator failed for (unstest) [102.88.10.10]:38202: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-13 04:04:22 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:43267: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-12-13 04:04:34 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:51832: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.248.73.162
country_id: 1643084
description:
Dec 13 04:04:40 host2 pure-ftpd[1173927]: (?@178.248.73.162) [INFO] New connection from 178.248.73.162


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.86.29.123
country_id: 1643084
description:
[2025-12-13 04:04:42 +0530] info [cpaneld] 195.86.29.123 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 04:04:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<02B+3MhFqNTD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 13 04:05:07 host2 sshd[1174285]: Disconnected from invalid user admin 45.121.147.47 port 56850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 04:05:14 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<AI7n38hFpK28pkxr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 13 04:06:09 host2 sshd[1175002]: Disconnected from invalid user switch 35.237.94.18 port 50754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 13 04:06:23 host2 sshd[1175100]: Disconnected from invalid user admin 45.121.147.47 port 52868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 13 04:07:38 host2 sshd[1175889]: Disconnected from invalid user water 45.121.147.47 port 48876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 13 04:07:53 host2 sshd[1175983]: Disconnected from invalid user water 35.237.94.18 port 36136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-13 04:08:41 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:40528: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 13 04:08:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SWlZ7MhF4olChJmK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-13 04:09:01 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:49920: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 13 04:10:12 host2 sshd[1177448]: Disconnected from invalid user sshuser 35.237.94.18 port 35468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-13 04:09:42 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:29701: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 13 04:09:30 host2 sshd[1176908]: Disconnected from invalid user switch 45.121.147.47 port 57018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-13 04:09:55 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:60722: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 04:10:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<YLaN8chFYqrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 04:09:19 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<0NN87shFCqhAF6S9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:10:33 host2 sshd[1177677]: Disconnected from invalid user xiaoming 102.88.137.213 port 49694 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.93.128.179
country_id: 1269750
description:
Dec 13 04:11:01 host2 sshd[1177909]: Disconnected from invalid user sftpuser 34.93.128.179 port 44110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 04:10:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<xRRo8shFGI5100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec 13 04:11:23 host2 sshd[1178130]: Disconnected from invalid user admin 197.225.146.23 port 47716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-13 04:11:49 dovecot_login authenticator failed for ([84.214.63.110]) [84.214.63.110]:58000: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 13 04:11:53 host2 sshd[1178388]: Disconnected from invalid user ubuntu 35.237.94.18 port 49078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:13:23 host2 sshd[1179720]: Disconnected from invalid user ftpuser 102.88.137.213 port 1387 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 04:13:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<i+bu/chFeq/AqZl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.77.155
country_id: 2921044
description:
Dec 13 04:14:00 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.226.77.155, lip=66.85.158.92, session=<0PVf/8hFmCtA4k2b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec 13 04:14:25 host2 sshd[1180744]: Disconnected from invalid user sshuser 197.225.146.23 port 44648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:14:56 host2 sshd[1181086]: Disconnected from invalid user rocketmq 102.88.137.213 port 1383 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:15:47 host2 sshd[1181768]: Disconnected from invalid user ftpuser 102.88.137.213 port 49624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-13 04:15:47 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (lariaked) [96.230.65.90]:49226: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-13 04:15:50 dovecot_plain authenticator failed for (sandally) [12.182.125.210]:41102: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-13 04:15:53 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:33969: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-13 04:15:22 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:47558: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 04:16:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hj24B8lFBq6KxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 13 04:16:29 host2 sshd[1182272]: Disconnected from invalid user choi 102.88.137.213 port 17658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.3.48
country_id: 690791
description:
Dec 13 04:18:16 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.3.48, lip=66.85.158.91, TLS, session=<ZXWaDclFscOwZwMw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.215
country_id: 3865483
description:
Dec 13 04:17:57 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.249.215, lip=66.85.158.91, TLS, session=<T5FVDMlF2d2zAPnX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-13 04:18:04 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (ingiverms) [76.157.219.158]:55126: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 04:18:08 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<BqsEDslFYNVntrtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2025-12-13 04:19:00 dovecot_login authenticator failed for cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:48966: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.107
country_id: 6252001
description:
Dec 13 04:19:05 host2 pure-ftpd[1183849]: (?@198.235.24.107) [INFO] New connection from 198.235.24.107


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 04:20:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<hPpPFslFVscI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.63.18
country_id: 6252001
description:
2025-12-13 04:20:55 dovecot_login authenticator failed for ([98.181.63.18]) [98.181.63.18]:42665: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-13 04:21:19 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (tomifies) [174.166.153.20]:58552: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 04:21:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<6rMuGslF6LEImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 04:22:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<h7mGHMlFJIM+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-13 04:22:24 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:42590: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-13 04:22:40 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:58475: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 04:22:52 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</vvzHslFUsOkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 13 04:26:25 host2 sshd[1188173]: Disconnected from invalid user jason 103.144.28.85 port 57980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-13 04:28:08 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:36026: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 13 04:27:34 host2 sshd[1188782]: Disconnected from invalid user admin 103.144.28.85 port 55004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-13 04:27:37 dovecot_login authenticator failed for ([89.218.247.234]) [89.218.247.234]:40058: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-13 04:27:41 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:54550: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 04:27:42 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<BE48MMlFKK3CBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-13 04:28:06 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:40356: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-13 04:28:36 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:50544: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 04:28:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<hafdNMlFgLqB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2025-12-13 04:29:03 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:57075: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 04:29:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Fr8BNclFkIK8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 13 04:29:14 host2 sshd[1189870]: Disconnected from invalid user hadoop 103.144.28.85 port 36424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 04:29:58 host2 sshd[1190218]: Disconnected from invalid user user 2.57.121.25 port 17024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 13 04:30:19 host2 sshd[1190738]: Disconnected from invalid user abdi 103.144.28.85 port 33450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-13 04:31:52 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:33216: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-12-13 04:33:05 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:56016: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 04:32:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<DSPgQMlFpMqH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.27
country_id: 6252001
description:
2025-12-13 04:32:26 dovecot_login authenticator failed for ([70.174.168.27]) [70.174.168.27]:37497: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 04:33:22 host2 sshd[1192339]: Disconnected from invalid user  62.60.131.157 port 39588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.91.229
country_id: 3865483
description:
Dec 13 04:33:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.91.229, lip=66.85.158.91, TLS, session=<xgnnQ8lFb8m+tVvl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-13 04:33:41 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:38850: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.136
country_id: 3175395
description:
Dec 13 04:33:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=185.139.180.136, lip=66.85.158.91, TLS, session=<WVlbRclFFcC5i7SI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-13 04:34:06 dovecot_login authenticator failed for (187.161.198.68-clientes-izzi.mx) [187.161.198.68]:56169: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 04:33:17 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<uSE6RMlF1tcv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-13 04:34:51 dovecot_plain authenticator failed for (thmisom) [24.104.225.201]:36787: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 04:35:48 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=</V0xTclFTM0I3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-12-13 04:36:15 dovecot_plain authenticator failed for 5.185.198.73.ipv4.public.orange.pl (ovatite) [5.185.198.73]:46320: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.185.11.240
country_id: 357994
description:
2025-12-13 04:35:38 dovecot_plain authenticator failed for (CEJ5O) [102.185.11.240]:54652: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 04:37:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<WNCuUslFpL8IgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 04:37:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<m2RPU8lF1MYuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-13 04:39:04 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (sauxoct) [174.166.153.20]:57614: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 04:38:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<rPCEV8lFPL4ro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 13 04:41:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<JZ7qYclFBuI+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-13 04:42:14 dovecot_plain authenticator failed for (unctiotree) [65.20.143.159]:41781: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-13 04:43:05 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:37549: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-13 04:43:16 dovecot_login authenticator failed for ([174.75.211.196]) [121.73.162.242]:55676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 04:42:48 dovecot_plain authenticator failed for (matbewels) [154.144.243.93]:51498: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.195.251.43
country_id: 3573591
description:
2025-12-13 04:43:34 dovecot_login authenticator failed for ([174.64.199.88]) [186.195.251.43]:56385: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.152
country_id: 3175395
description:
Dec 13 04:43:52 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.26.178.152, lip=66.85.158.91, TLS, session=<2uAkaclFCtTZGrKY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.76
country_id: 953987
description:
Dec 13 04:44:13 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.57.76, lip=66.85.158.91, TLS, session=<GL1PaslF+odmgTlM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.194.94
country_id: 1269750
description:
2025-12-13 04:43:21 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:50568: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-13 04:43:31 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (ytive) [73.224.171.101]:59490: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.193
country_id: 6252001
description:
Dec 13 04:45:57 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.193, lip=66.85.158.92, session=<x6qecclFY6hb5qjB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.196
country_id: 6252001
description:
Dec 13 04:46:00 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.196, lip=66.85.158.92, session=<pb7NcclFU9pb5qjE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.175
country_id: 732800
description:
Dec 13 04:46:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.255.215.175, lip=66.85.158.91, TLS, session=<cnIccclFZOy5/9ev>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-13 04:45:32 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (litaxe) [73.0.235.30]:57616: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.242
country_id: 6252001
description:
Dec 13 04:45:33 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.242, lip=66.85.158.92, session=<KM02cMlF4ZBb5qjy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.199
country_id: 6252001
description:
Dec 13 04:45:44 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.199, lip=66.85.158.92, session=<wFHgcMlF34lb5qjH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.67
country_id: 3469034
description:
Dec 13 04:46:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<designdpt>, method=PLAIN, rip=186.209.249.67, lip=66.85.158.91, TLS, session=<c8SIcslFn+260flD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-13 04:46:40 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (ferach) [73.195.211.98]:38356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-13 04:46:54 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:54946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 04:47:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<gzmjdclF/rml6L5h>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 04:47:58 host2 sshd[1203902]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-13 04:47:49 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:51184: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 04:49:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<HnWsfMlFaMY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 04:50:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<oxRHgMlF7NZnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-13 04:52:08 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:50504: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-13 04:51:40 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (fators) [174.161.27.82]:33278: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-13 04:51:46 dovecot_plain authenticator failed for (unial) [5.11.221.119]:34972: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.251
country_id: 1733045
description:
2025-12-13 04:51:46 dovecot_login authenticator failed for ([49.124.152.251]) [49.124.152.251]:45304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-13 04:51:56 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:43184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-13 04:52:19 dovecot_login authenticator failed for ([128.185.247.254]) [125.19.158.2]:32916: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 04:52:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<mtVHiclFhoTO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-13 04:53:06 dovecot_login authenticator failed for host-148-170-156-248.public.eastlink.ca [148.170.156.248]:41664: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-13 04:53:36 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:56290: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 04:56:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<Ylwal8lF3MOG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-13 04:58:16 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:33782: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.203
country_id: 6252001
description:
2025-12-13 04:57:34 dovecot_login authenticator failed for ([72.214.132.203]) [72.214.132.203]:58464: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 04:57:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pAmhm8lFuHEvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 04:57:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<k/w4nMlFxLxm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-13 04:58:01 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:48051: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-13 04:58:26 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:53202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 04:58:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<QHtKnslFpIdo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 04:59:01 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<OS44oMlFzOQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-13 04:59:05 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:33956: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 04:59:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ZaBioclFXNvD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 04:59:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Bx6qoclFUN6WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-13 05:01:13 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:59474: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 05:00:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<s8gJpslF6KO8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-13 05:01:32 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:53234: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 05:02:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<VxOXq8lFdEpetwuC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 13 05:03:34 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS handshaking: Connection closed, session=</QKfsMlF8gZChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 05:05:13 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<845ntslFYpfD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 05:05:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<uhH7tslFHqZAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 05:07:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<Qmp0vslFwpJntrtb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.138
country_id: 2635167
description:
Dec 13 05:07:57 host2 dovecot[3988696]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.138, lip=66.85.158.91, TLS, session=<6C1NwMlFtcO594mK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2025-12-13 05:07:58 dovecot_login authenticator failed for ([49.124.153.35]) [49.124.153.35]:46962: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-13 05:08:25 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:56486: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 05:08:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<rj1SwslF3v5100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-13 05:08:39 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (demens) [73.144.27.228]:55620: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-13 05:10:07 dovecot_plain authenticator failed for (ounde) [173.25.186.130]:54323: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-13 05:09:27 dovecot_plain authenticator failed for (fuseudo) [91.73.188.251]:55574: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 05:09:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<QbRex8lFfN2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 05:10:07 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<spjrx8lFqLnAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 05:10:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hm5CyslFWLKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-13 05:11:54 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:44584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-13 05:12:16 dovecot_login authenticator failed for ([149.54.62.62]) [149.54.62.62]:58854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-13 05:12:39 dovecot_plain authenticator failed for (amimatic) [65.20.143.159]:54764: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-13 05:13:05 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:58507: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-13 05:14:02 dovecot_login authenticator failed for (cm-178.232.126.146.get.no) [178.232.126.146]:49184: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 05:13:20 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<zSJ408lF/KY+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-13 05:14:00 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (psers) [24.1.200.187]:53846: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-13 05:15:44 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (plosisable) [73.53.254.168]:54550: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-13 05:16:43 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:53368: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.29
country_id: 6252001
description:
2025-12-13 05:16:50 dovecot_login authenticator failed for ([98.181.46.29]) [98.181.46.29]:39215: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-12-13 05:16:57 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:32779: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 13 05:16:59 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<WBWF4MlF/KLCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-13 05:17:02 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:57514: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:16:35 host2 sshd[1229361]: Disconnected from invalid user admin 103.39.243.15 port 38240 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 13 05:17:16 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<+Z2F4clFfqpog7HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 05:17:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<V63Z4clFgrQI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-12-13 05:18:09 dovecot_login authenticator failed for (190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:51638: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.100.26.107
country_id: 1269750
description:
2025-12-13 05:18:25 dovecot_login authenticator failed for (as135139-skylinkfibernet.com) [27.100.26.107]:32936: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 05:20:05 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<I+WV68lFQt6kXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-13 05:19:38 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (tereck) [73.183.74.177]:47256: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 05:20:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<YqmM7slF/uoImxNM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:21:08 host2 sshd[1231782]: Disconnected from invalid user nima 103.39.243.15 port 53616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.243.15
country_id: 1269750
description:
Dec 13 05:21:47 host2 sshd[1232036]: Disconnected from invalid user supermaint 103.39.243.15 port 37774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-12-13 05:22:09 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:45343: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-13 05:22:31 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:48150: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-13 05:23:29 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:51585: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-13 05:23:36 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:47338: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 05:25:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<BdN3/8lFKqvCBa8Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 05:25:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<lsvA/8lF6My8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 05:26:56 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (dicapped) [73.197.236.163]:35286: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 05:28:54 host2 sshd[1235492]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.40
country_id: 6252001
description:
Dec 13 05:28:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.40, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Cs4tCspFPcOTuYQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 05:28:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<svElCspFHtqB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-13 05:29:11 dovecot_plain authenticator failed for (joidae) [24.105.248.218]:32914: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.184
country_id: 6252001
description:
Dec 13 05:30:38 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EMhvEcpF9dzG6xi4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 05:30:41 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<BbtwEcpFOpYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 13 05:31:09 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<80wkE8pFqoA+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 05:31:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<P+n0FcpFQIqH6yFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 13 05:32:24 host2 sshd[1237147]: Disconnected from invalid user user 2.57.121.25 port 6913 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 05:32:49 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<rY0YGcpFxJMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 05:33:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<VsJ0GspF3qMuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-13 05:33:16 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:54406: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-13 05:33:28 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:60088: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.16
country_id: 6252001
description:
2025-12-13 05:33:52 dovecot_login authenticator failed for wsip-184-191-243-16.fv.ks.cox.net [184.191.243.16]:45001: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 05:34:22 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<x0+uHspF7tsro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-13 05:34:46 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:37642: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 05:35:16 host2 sshd[1238877]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 52780


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 05:37:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<LrcOKMpFco0IgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-13 05:37:11 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:33218: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-13 05:37:44 dovecot_login authenticator failed for ([128.185.247.254]) [125.19.158.2]:51044: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-13 05:38:55 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (consicae) [73.213.237.28]:56368: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-13 05:39:16 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (ersheed) [2.135.31.74]:49570: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 13 05:40:07 host2 sshd[1241211]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 54961


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 13 05:40:39 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<j8AnNcpFoJ2B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-13 05:41:39 dovecot_plain authenticator failed for (giess) [12.182.125.210]:40895: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-13 05:41:57 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:55100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-13 05:42:09 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:53977: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 13 05:41:33 host2 sshd[1241914]: Disconnected from invalid user admin 2.57.121.112 port 45591 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-13 05:42:24 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:41588: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-12-13 05:42:54 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:36217: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-13 05:43:24 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:38960: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-13 05:44:04 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:55677: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 05:44:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<3suPRMpFNJCl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.17.158
country_id: 1269750
description:
Dec 13 05:45:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=139.59.17.158, lip=66.85.158.91, session=<tPLTRMpF6LyLOxGe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:45:06 host2 sshd[1243913]: Disconnected from invalid user user 128.199.155.236 port 50276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 05:45:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<MvecRspFMthnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:47:34 host2 sshd[1245521]: Disconnected from invalid user user 34.58.124.191 port 34738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:47:43 host2 sshd[1245576]: Disconnected from invalid user user 128.199.155.236 port 38292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-13 05:48:37 dovecot_plain authenticator failed for (apping) [92.62.243.175]:54460: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:48:43 host2 sshd[1246019]: Disconnected from invalid user spectrum 34.58.124.191 port 36694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:49:05 host2 sshd[1246285]: Disconnected from invalid user deploy 128.199.155.236 port 59554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-13 05:48:19 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:46062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 05:48:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Rl9dUcpFiJA+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-13 05:48:41 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:51751: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:49:16 host2 sshd[1246473]: Disconnected from invalid user mikrotik 34.58.124.191 port 37394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-13 05:49:21 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:51343: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-13 05:49:35 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:50900: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.155.236
country_id: 1880251
description:
Dec 13 05:51:05 host2 sshd[1247514]: Disconnected from invalid user roots 128.199.155.236 port 39388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-13 05:50:35 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (coffic) [24.127.53.61]:53616: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 05:50:55 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lkvfWcpF4OrO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec 13 05:51:29 host2 sshd[1247690]: Disconnected from invalid user kserge 34.58.124.191 port 59504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:52:13 host2 sshd[1248051]: Disconnected from invalid user chrism 101.47.162.24 port 40354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 05:52:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<bYWEYMpFLsxm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:53:19 host2 sshd[1248535]: Disconnected from invalid user testing 101.47.162.24 port 42126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.238.68
country_id: 6252001
description:
2025-12-13 05:54:13 dovecot_login authenticator failed for ([75.110.238.68]) [75.110.238.68]:46292: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.60
country_id: 1880251
description:
Dec 13 05:54:15 host2 sshd[1249098]: Disconnected from invalid user nmr 45.78.201.60 port 49466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 05:54:24 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<6EJJZspF4O3D+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.24
country_id: 1880251
description:
Dec 13 05:54:29 host2 sshd[1249480]: Disconnected from invalid user ubuntu 101.47.162.24 port 45594 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.247.79
country_id: 2921044
description:
Dec 13 05:54:45 host2 dovecot[3988696]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=209.38.247.79, lip=66.85.158.92, session=<aGSvZ8pFKszRJvdP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 05:54:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<V+qoZ8pFEl8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-13 05:54:48 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:33528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 05:55:15 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<H8lUacpF1NCG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 05:56:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<0hnGbspFWLBntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 05:56:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<WNX3bcpFHMi8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-13 05:58:15 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:51828: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.145.35
country_id: 2750405
description:
Dec 13 05:57:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.145.35, lip=66.85.158.92, TLS: Connection closed, session=<wveyccpFHtChI5Ej>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.182.92
country_id: 6252001
description:
Dec 13 05:57:48 host2 dovecot[3988696]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=165.154.182.92, lip=66.85.158.92, TLS, session=<KD2YcspFeuKlmrZc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.92
country_id: 6252001
description:
Dec 13 05:57:48 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.182.92, lip=66.85.158.92, session=<3yqWcspFvOGlmrZc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-13 05:57:58 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (hiactal) [98.40.101.10]:50050: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.57.97.103
country_id: 2510769
description:
2025-12-13 05:58:02 dovecot_login authenticator failed for 103.red-83-57-97.dynamicip.rima-tde.net [83.57.97.103]:38481: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 13 05:58:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<6CYEdcpFvNs+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 05:58:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<kz1mdspFIr2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:00:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<QBxoe8pF5OXD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.60
country_id: 1880251
description:
Dec 13 06:00:54 host2 sshd[1252212]: Disconnected from invalid user mikrotik 45.78.201.60 port 47002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 06:01:56 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<5T47gcpFGKlAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-13 06:01:18 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:43116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-12-13 06:01:44 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:4961: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 06:01:44 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<hbuIgMpFgGRetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:03:04 host2 sshd[1253004]: Disconnected from invalid user wangjia 152.32.129.236 port 60276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-13 06:02:20 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:55283: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:02:25 host2 sshd[1252760]: Disconnected from invalid user zihan 152.32.129.236 port 40722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-13 06:02:37 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (oueitting) [73.183.74.177]:52230: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-13 06:03:11 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:38388: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-13 06:02:16 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:41987: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-13 06:02:22 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:49223: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-13 06:02:49 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:37872: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 13 06:04:16 host2 sshd[1253668]: Disconnected from invalid user kkadmin 152.32.129.236 port 43514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-13 06:04:49 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (hoodism) [24.1.200.187]:60360: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 06:05:36 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<EQVijspFytOKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-13 06:06:33 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:50387: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-13 06:06:39 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:46078: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 06:07:09 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:43069: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-13 06:06:28 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:52012: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 06:06:32 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<KCOxkcpF+C9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-13 06:06:46 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:50213: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.3.138
country_id: 1605651
description:
2025-12-13 06:06:56 dovecot_login authenticator failed for ([110.49.3.138]) [110.49.3.138]:51602: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 06:06:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<kuQ3k8pFvr3AqZl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.3
country_id: 1733045
description:
2025-12-13 06:07:45 dovecot_login authenticator failed for ([49.124.153.3]) [49.124.153.3]:49972: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-13 06:12:58 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:60361: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-13 06:12:25 dovecot_login authenticator failed for (cm-178.232.153.184.get.no) [178.232.153.184]:38336: 535 Incorrect authentication data (set_id=mailbox@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-13 06:12:46 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:37190: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-13 06:12:49 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65466: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.50
country_id: 1269750
description:
2025-12-13 06:13:24 dovecot_login authenticator failed for ([128.185.212.50]) [128.185.212.50]:36006: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-13 06:13:58 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (perge) [73.213.237.28]:51720: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-13 06:14:02 dovecot_plain authenticator failed for (tracented) [38.248.111.238]:56686: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 06:14:35 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<vjF8rspFYO0I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.20
country_id: 690791
description:
Dec 13 06:16:09 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=176.103.7.20, lip=66.85.158.91, TLS, session=<cltBs8pFu5awZwcU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.102
country_id: 953987
description:
Dec 13 06:16:31 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.47.102, lip=66.85.158.91, TLS, session=<QwNftMpFx4dmQC9m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Dec 13 06:17:42 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=<mm3CucpFIuGnXpIx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 06:17:47 dovecot_plain authenticator failed for (catirize) [154.144.243.93]:41614: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 13 06:17:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<6a1cuMpFwqSkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 06:20:21 host2 sshd[1261486]: Disconnected from invalid user  62.60.131.157 port 17986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-13 06:21:09 dovecot_plain authenticator failed for (gless) [5.11.221.119]:58934: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-13 06:22:13 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:45046: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Dec 13 06:22:46 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<R5u3y8pFfqwImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 13 06:23:10 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ZykuzcpFjoa8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-13 06:22:26 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:34890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.5.175.24
country_id: 130758
description:
Dec 13 06:24:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=194.5.175.24, lip=66.85.158.91, session=<Mt780cpF7urCBa8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-13 06:25:25 dovecot_plain authenticator failed for (jicaphy) [154.144.243.93]:37716: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-12-13 06:26:15 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:33666: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2025-12-13 06:26:29 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:47282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 13 06:28:31 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<zD1T4MpFGMQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 13 06:28:28 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<9FQf4MpFyLOB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 13 06:28:29 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<PgQq4MpFXLcuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 13 06:30:00 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<O/Cd5cpFNIQI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 13 06:30:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<awiU58pF0tYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-13 06:31:14 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:51842: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-13 06:31:25 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:43198: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-13 06:31:29 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:40284: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-13 06:31:48 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:34783: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.35.3
country_id: 1269750
description:
Dec 13 06:32:01 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.118.35.3, lip=66.85.158.91, TLS, session=<QBGj68pFtYgtdiMD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.37
country_id: 3865483
description:
Dec 13 06:32:23 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=186.124.218.37, lip=66.85.158.91, TLS, session=<58oZ7cpFkNW6fNol>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 06:32:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<jOkB8MpFaM0+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-12-13 06:33:36 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:1195: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Dec 13 06:34:38 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<yBsr9spFauKH6yFP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.13
country_id: 798549
description:
Dec 13 06:34:46 host2 pure-ftpd[1270323]: (?@85.217.149.13) [INFO] New connection from 85.217.149.13


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 13 06:36:51 host2 sshd[1271580]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 13 06:36:25 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<tWmZ/MpFJIo+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-13 06:37:42 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:55245: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-12-13 06:38:19 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:51728: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 13 06:38:18 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<49VIA8tFdMM+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 13 06:38:27 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<mjLUA8tFAswIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-13 06:38:32 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:52357: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.87
country_id: 6252001
description:
Dec 13 06:40:40 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.87, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5OXrC8tFJcbN0h9X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 13 06:41:23 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<jk1VDstFROlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.40
country_id: 3469034
description:
Dec 13 06:42:17 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.246.40, lip=66.85.158.91, TLS, session=<bnhyEMtFwoa60fYo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.183
country_id: 798544
description:
Dec 13 06:42:34 host2 dovecot[3988696]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.232.165.183, lip=66.85.158.91, TLS, session=<bsy7EctF1bZb6KW3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.214.58.50
country_id: 6252001
description:
Dec 13 06:44:11 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=104.214.58.50, lip=66.85.158.91, session=<k7FTGMtF5plo1joy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.190.97
country_id: 1269750
description:
Dec 13 06:44:12 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=165.232.190.97, lip=66.85.158.91, session=<BOJlGMtF+OKl6L5h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.35
country_id: 3865483
description:
Dec 13 06:44:21 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.251.35, lip=66.85.158.91, TLS, session=<su7OF8tFhrSzAPsj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.37
country_id: 933860
description:
Dec 13 06:44:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=41.216.213.37, lip=66.85.158.91, TLS, session=<rMg3GctFUrMp2NUl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-13 06:44:46 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (crize) [73.197.236.163]:33918: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-13 06:45:49 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (lacon) [73.0.235.30]:39816: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-13 06:47:44 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:33814: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-13 06:47:55 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:53775: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Dec 13 06:47:54 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<TSmqJctFjJZm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-13 06:48:00 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:56782: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-13 06:48:07 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:58686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.182.187.91
country_id: 1643084
description:
Dec 13 06:48:33 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=103.182.187.91, lip=66.85.158.91, session=<lG36J8tFEsdntrtb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 13 06:49:30 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KJJgK8tF9tSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 13 06:49:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<4f8pLMtF8MrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:49:47 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<2KpkLMtFNNvD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.120.212
country_id: 6252001
description:
Dec 13 06:49:58 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=13.89.120.212, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<BmosLctFqM0NWXjU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 13 06:52:02 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<ZuljNMtFLOE+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 13 06:52:06 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<f9ClNMtFPC8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-12-13 06:52:41 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:49042: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.226.80.143
country_id: 6252001
description:
2025-12-13 06:54:56 dovecot_login authenticator failed for dhcp-011-143.coonvalley.mwt.net ([91.126.40.196]) [216.226.80.143]:57172: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 13 06:54:57 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<xKjZPstFfL68pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 13 06:55:26 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<XSeSQMtFOoaG0Wp/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.220.172.154
country_id: 6252001
description:
[2025-12-13 06:55:41 +0530] info [whostmgrd] 24.220.172.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 13 06:55:43 host2 dovecot[3988696]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<MVuVQctFUOXD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 13 06:56:06 host2 sshd[1283467]: Disconnected from invalid user  62.60.131.157 port 28045 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-13 06:57:12 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:62456: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-13 06:57:59 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:40950: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-13 06:57:34 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:41919: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-13 06:57:42 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:59122: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 13 06:58:31 host2 dovecot[1284827]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 13 06:58:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<S4h6TMtF/t2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Dec 13 06:58:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<LgH9TMtFpqtAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Dec 13 07:01:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<JGzsVMtF4BVetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 13 07:01:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<stixVctFTLiKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-13 07:03:56 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:47696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.169.153.116
country_id: 6252001
description:
Dec 13 07:04:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=192.169.153.116, lip=66.85.158.91, session=<qRSzX8tFqNrAqZl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 13 07:04:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<huQOYctFLDN100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-13 07:05:06 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (crophioted) [81.225.30.107]:56290: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


