# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.47.58.12
country_id: 6252001
description:
[2025-12-10 12:46:40 +0530] info [cpaneld] 216.47.58.12 - sivagnanamfound "GET /login/?login_only=1&user=sivagnanamfound&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfound (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.14.38
country_id: 6252001
description:
[2025-12-10 12:46:41 +0530] info [cpaneld] 71.193.14.38 - sivagnanamfoun "GET /login/?login_only=1&user=sivagnanamfoun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.63.40.23
country_id: 6252001
description:
[2025-12-10 12:46:46 +0530] info [cpaneld] 136.63.40.23 - sivagnan "GET /login/?login_only=1&user=sivagnan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.229.172.142
country_id: 6252001
description:
[2025-12-10 12:46:46 +0530] info [cpaneld] 47.229.172.142 - sivagnana "GET /login/?login_only=1&user=sivagnana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.239.96.174
country_id: 6252001
description:
[2025-12-10 12:46:53 +0530] info [cpaneld] 96.239.96.174 - siv "GET /login/?login_only=1&user=siv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user siv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.16.187.251
country_id: 6252001
description:
[2025-12-10 12:46:54 +0530] info [cpaneld] 76.16.187.251 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.13.236
country_id: 6252001
description:
[2025-12-10 12:46:56 +0530] info [cpaneld] 71.9.13.236 - sivagna1 "GET /login/?login_only=1&user=sivagna1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagna1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.82.89
country_id: 6252001
description:
[2025-12-10 12:46:39 +0530] info [cpaneld] 96.2.82.89 - sivagnanamfounda "GET /login/?login_only=1&user=sivagnanamfounda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.72.52.241
country_id: 6252001
description:
[2025-12-10 12:46:45 +0530] info [cpaneld] 73.72.52.241 - sivagnanam "GET /login/?login_only=1&user=sivagnanam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.168.222.247
country_id: 6252001
description:
[2025-12-10 12:46:48 +0530] info [cpaneld] 146.168.222.247 - sivagna "GET /login/?login_only=1&user=sivagna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.1.116
country_id: 6252001
description:
[2025-12-10 12:46:49 +0530] info [cpaneld] 98.97.1.116 - sivag "GET /login/?login_only=1&user=sivag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.180.191
country_id: 6252001
description:
[2025-12-10 12:46:38 +0530] info [cpaneld] 184.179.180.191 - sivagnanamfoundat "GET /login/?login_only=1&user=sivagnanamfoundat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.66.76.23
country_id: 6252001
description:
[2025-12-10 12:46:37 +0530] info [cpaneld] 207.66.76.23 - sivagnanamfoundati "GET /login/?login_only=1&user=sivagnanamfoundati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.39.223.89
country_id: 6252001
description:
[2025-12-10 12:46:42 +0530] info [cpaneld] 73.39.223.89 - sivagnanamfou "GET /login/?login_only=1&user=sivagnanamfou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.110.132.213
country_id: 6252001
description:
[2025-12-10 12:46:48 +0530] info [cpaneld] 64.110.132.213 - sivagn "GET /login/?login_only=1&user=sivagn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.218.231.24
country_id: 6252001
description:
[2025-12-10 12:46:51 +0530] info [cpaneld] 32.218.231.24 - siva "GET /login/?login_only=1&user=siva&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user siva (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.143
country_id: 6252001
description:
[2025-12-10 12:46:44 +0530] info [cpaneld] 172.58.167.143 - sivagnanamf "GET /login/?login_only=1&user=sivagnanamf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.75.52.210
country_id: 6252001
description:
[2025-12-10 12:46:43 +0530] info [cpaneld] 66.75.52.210 - sivagnanamfo "GET /login/?login_only=1&user=sivagnanamfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-10 12:48:08 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:41772: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-12-10 12:48:24 dovecot_login authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:56282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 12:47:48 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<I4Q005NFeMO8putr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.103.248.15
country_id: 6252001
description:
[2025-12-10 12:48:50 +0530] info [cpaneld] 73.103.248.15 - agronaturehol "GET /login/?login_only=1&user=agronaturehol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronaturehol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.108.98.23
country_id: 6252001
description:
[2025-12-10 12:49:07 +0530] info [cpaneld] 64.108.98.23 - agronat2 "GET /login/?login_only=1&user=agronat2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronat2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.82.148.208
country_id: 6252001
description:
[2025-12-10 12:48:40 +0530] info [cpaneld] 75.82.148.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.142.118
country_id: 6252001
description:
[2025-12-10 12:48:42 +0530] info [whostmgrd] 71.9.142.118 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.55.204.69
country_id: 6252001
description:
[2025-12-10 12:48:43 +0530] info [cpaneld] 174.55.204.69 - agronatureholdingscom "GET /login/?login_only=1&user=agronatureholdingscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.50.252.106
country_id: 6252001
description:
[2025-12-10 12:49:01 +0530] info [cpaneld] 76.50.252.106 - agron "GET /login/?login_only=1&user=agron&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agron (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.123.110
country_id: 6252001
description:
[2025-12-10 12:49:05 +0530] info [cpaneld] 76.175.123.110 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.155.105.95
country_id: 6252001
description:
[2025-12-10 12:49:06 +0530] info [cpaneld] 184.155.105.95 - agronat1 "GET /login/?login_only=1&user=agronat1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronat1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.10.13.142
country_id: 6252001
description:
[2025-12-10 12:48:38 +0530] info [cpaneld] 72.10.13.142 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.183.100.138
country_id: 6252001
description:
[2025-12-10 12:48:54 +0530] info [cpaneld] 24.183.100.138 - agronature "GET /login/?login_only=1&user=agronature&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronature (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.146.52.131
country_id: 6252001
description:
[2025-12-10 12:49:03 +0530] info [cpaneld] 35.146.52.131 - agro "GET /login/?login_only=1&user=agro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.34.223.204
country_id: 6252001
description:
[2025-12-10 12:48:49 +0530] info [cpaneld] 47.34.223.204 - agronaturehold "GET /login/?login_only=1&user=agronaturehold&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronaturehold (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.205.108
country_id: 6252001
description:
[2025-12-10 12:49:00 +0530] info [cpaneld] 24.4.205.108 - agrona "GET /login/?login_only=1&user=agrona&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.37.195
country_id: 6252001
description:
[2025-12-10 12:48:41 +0530] info [cpaneld] 73.170.37.195 - agronatureholdings "GET /login/?login_only=1&user=agronatureholdings&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholdings (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.163.24.141
country_id: 6252001
description:
[2025-12-10 12:48:45 +0530] info [cpaneld] 174.163.24.141 - agronatureholding "GET /login/?login_only=1&user=agronatureholding&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholding (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.76.174
country_id: 6252001
description:
[2025-12-10 12:48:46 +0530] info [cpaneld] 76.32.76.174 - agronatureholdi "GET /login/?login_only=1&user=agronatureholdi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholdi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.126.43.75
country_id: 6252001
description:
[2025-12-10 12:48:57 +0530] info [cpaneld] 141.126.43.75 - agronatu "GET /login/?login_only=1&user=agronatu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.198.13
country_id: 6252001
description:
[2025-12-10 12:48:55 +0530] info [cpaneld] 76.35.198.13 - agronatur "GET /login/?login_only=1&user=agronatur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.81.90.202
country_id: 6252001
description:
[2025-12-10 12:48:58 +0530] info [cpaneld] 206.81.90.202 - agronat "GET /login/?login_only=1&user=agronat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.233.144
country_id: 6252001
description:
[2025-12-10 12:49:04 +0530] info [cpaneld] 23.243.233.144 - agr "GET /login/?login_only=1&user=agr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.17.12
country_id: 6252001
description:
[2025-12-10 12:48:46 +0530] info [cpaneld] 76.150.17.12 - agronatureholdin "GET /login/?login_only=1&user=agronatureholdin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.186.86.120
country_id: 6252001
description:
[2025-12-10 12:48:51 +0530] info [cpaneld] 75.186.86.120 - agronatureho "GET /login/?login_only=1&user=agronatureho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.166.145.173
country_id: 6252001
description:
[2025-12-10 12:48:52 +0530] info [cpaneld] 76.166.145.173 - agronatureh "GET /login/?login_only=1&user=agronatureh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureh (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 12:50:17 host2 sshd[2190785]: Disconnected from invalid user user 2.57.121.25 port 52872 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.226.61.95
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.226.61.95: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.114.25
country_id: 6252001
description:
Dec 10 12:52:20 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.114.25, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3ceM45NFOMKsynIZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-10 12:53:17 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:46161: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-10 12:53:19 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:38347: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-10 12:53:40 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:53938: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2025-12-10 12:53:40 dovecot_login authenticator failed for ([182.95.125.122]) [182.95.125.122]:49132: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-10 12:54:28 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:60222: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-10 12:55:04 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:46048: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.240
country_id: 6252001
description:
2025-12-10 12:57:01 dovecot_login authenticator failed for wsip-184-191-242-240.fv.ks.cox.net [184.191.242.240]:36175: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-10 12:57:17 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:46510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.55
country_id: 1733045
description:
2025-12-10 12:57:20 dovecot_login authenticator failed for ([49.124.151.55]) [49.124.151.55]:41322: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-12-10 12:57:23 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:47570: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2025-12-10 12:57:23 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:59368: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.222.192.238
country_id: 6252001
description:
[2025-12-10 12:58:22 +0530] info [cpaneld] 73.222.192.238 - greentara "GET /login/?login_only=1&user=greentara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.9.161.118
country_id: 6252001
description:
[2025-12-10 12:58:24 +0530] info [cpaneld] 104.9.161.118 - greenta "GET /login/?login_only=1&user=greenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.218.18.139
country_id: 6252001
description:
[2025-12-10 12:58:24 +0530] info [cpaneld] 174.218.18.139 - greentar "GET /login/?login_only=1&user=greentar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.78.40.164
country_id: 6252001
description:
[2025-12-10 12:58:28 +0530] info [cpaneld] 73.78.40.164 - gree "GET /login/?login_only=1&user=gree&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.90.54.164
country_id: 6252001
description:
[2025-12-10 12:58:32 +0530] info [cpaneld] 73.90.54.164 - greenta2 "GET /login/?login_only=1&user=greenta2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.10.252.198
country_id: 6252001
description:
[2025-12-10 12:58:31 +0530] info [cpaneld] 24.10.252.198 - greenta1 "GET /login/?login_only=1&user=greenta1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-10 12:58:15 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:40280: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.53.240.138
country_id: 6252001
description:
[2025-12-10 12:58:29 +0530] info [cpaneld] 174.53.240.138 - gre "GET /login/?login_only=1&user=gre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.49.56.249
country_id: 6252001
description:
[2025-12-10 12:58:30 +0530] info [cpaneld] 24.49.56.249 - gr "GET /login/?login_only=1&user=gr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.222.145.10
country_id: 6252001
description:
[2025-12-10 12:58:12 +0530] info [cpaneld] 69.222.145.10 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.42.82.212
country_id: 6252001
description:
[2025-12-10 12:58:14 +0530] info [cpaneld] 68.42.82.212 - greentaraceylon "GET /login/?login_only=1&user=greentaraceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.71.25.185
country_id: 6252001
description:
[2025-12-10 12:58:16 +0530] info [cpaneld] 209.71.25.185 - greentaraceyloncom "GET /login/?login_only=1&user=greentaraceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.16.211.69
country_id: 6252001
description:
[2025-12-10 12:58:19 +0530] info [cpaneld] 100.16.211.69 - greentaracey "GET /login/?login_only=1&user=greentaracey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaracey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.228.104.74
country_id: 6252001
description:
[2025-12-10 12:58:21 +0530] info [cpaneld] 104.228.104.74 - greentarac "GET /login/?login_only=1&user=greentarac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentarac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.182.201.168
country_id: 6252001
description:
[2025-12-10 12:58:26 +0530] info [cpaneld] 174.182.201.168 - green "GET /login/?login_only=1&user=green&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user green (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-10 12:57:39 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:41099: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.184.241.84
country_id: 6252001
description:
[2025-12-10 12:58:13 +0530] info [cpaneld] 64.184.241.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.161.115.156
country_id: 6252001
description:
[2025-12-10 12:58:15 +0530] info [whostmgrd] 69.161.115.156 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.218.139.237
country_id: 6252001
description:
[2025-12-10 12:58:18 +0530] info [cpaneld] 15.218.139.237 - greentaraceyl "GET /login/?login_only=1&user=greentaraceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.250.53.76
country_id: 6252001
description:
[2025-12-10 12:58:17 +0530] info [cpaneld] 96.250.53.76 - greentaraceylo "GET /login/?login_only=1&user=greentaraceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.89.98.63
country_id: 6252001
description:
[2025-12-10 12:58:20 +0530] info [cpaneld] 108.89.98.63 - greentarace "GET /login/?login_only=1&user=greentarace&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentarace (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.8.114.211
country_id: 6252001
description:
[2025-12-10 12:58:25 +0530] info [cpaneld] 73.8.114.211 - greent "GET /login/?login_only=1&user=greent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greent (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-10 12:58:36 dovecot_login authenticator failed for ([149.54.62.26]) [149.54.62.26]:54102: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-10 12:59:16 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:44416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.158.252.235
country_id: 6252001
description:
[2025-12-10 12:59:49 +0530] info [cpaneld] 99.158.252.235 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-10 12:59:58 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:49305: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.89.206.181
country_id: 6252001
description:
[2025-12-10 12:59:44 +0530] info [cpaneld] 72.89.206.181 - trails "GET /login/?login_only=1&user=trails&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.131.109.191
country_id: 6252001
description:
[2025-12-10 12:59:44 +0530] info [cpaneld] 107.131.109.191 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.23.176.24
country_id: 6252001
description:
[2025-12-10 12:59:47 +0530] info [cpaneld] 98.23.176.24 - trail "GET /login/?login_only=1&user=trail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.33.162.34
country_id: 6252001
description:
[2025-12-10 12:59:46 +0530] info [cpaneld] 100.33.162.34 - trailslk "GET /login/?login_only=1&user=trailslk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trailslk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.189.132.119
country_id: 6252001
description:
[2025-12-10 12:59:42 +0530] info [cpaneld] 70.189.132.119 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.73.14.9
country_id: 6252001
description:
[2025-12-10 12:59:45 +0530] info [whostmgrd] 69.73.14.9 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.248.220.165
country_id: 6252001
description:
[2025-12-10 12:59:48 +0530] info [cpaneld] 108.248.220.165 - trai "GET /login/?login_only=1&user=trai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.171.72.3
country_id: 6252001
description:
[2025-12-10 12:59:50 +0530] info [cpaneld] 97.171.72.3 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-10 13:02:28 dovecot_plain authenticator failed for (warole) [91.73.188.251]:33445: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 13:02:23 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (piter) [51.195.117.220]:10050: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.223.93.160
country_id: 6252001
description:
[2025-12-10 13:06:16 +0530] info [whostmgrd] 98.223.93.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.203.9.24
country_id: 6252001
description:
[2025-12-10 13:06:19 +0530] info [cpaneld] 12.203.9.24 - simpleengineeri "GET /login/?login_only=1&user=simpleengineeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.216.108.34
country_id: 6252001
description:
[2025-12-10 13:06:22 +0530] info [cpaneld] 72.216.108.34 - simpleenginee "GET /login/?login_only=1&user=simpleenginee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleenginee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.184.182
country_id: 6252001
description:
[2025-12-10 13:06:31 +0530] info [cpaneld] 172.59.184.182 - simple "GET /login/?login_only=1&user=simple&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simple (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.173.193.243
country_id: 6252001
description:
[2025-12-10 13:06:32 +0530] info [cpaneld] 71.173.193.243 - simpl "GET /login/?login_only=1&user=simpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.9.22.144
country_id: 6252001
description:
[2025-12-10 13:06:13 +0530] info [cpaneld] 99.9.22.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.154.103.153
country_id: 6252001
description:
[2025-12-10 13:06:14 +0530] info [cpaneld] 24.154.103.153 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.193.213.191
country_id: 6252001
description:
[2025-12-10 13:06:23 +0530] info [cpaneld] 98.193.213.191 - simpleengine "GET /login/?login_only=1&user=simpleengine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.220.223.10
country_id: 6252001
description:
[2025-12-10 13:06:27 +0530] info [cpaneld] 98.220.223.10 - simpleengi "GET /login/?login_only=1&user=simpleengi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.7.57.1
country_id: 6252001
description:
[2025-12-10 13:06:25 +0530] info [cpaneld] 47.7.57.1 - simpleengin "GET /login/?login_only=1&user=simpleengin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.114.182.106
country_id: 6252001
description:
[2025-12-10 13:06:15 +0530] info [cpaneld] 73.114.182.106 - simpleengineering "GET /login/?login_only=1&user=simpleengineering&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineering (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.45.87.181
country_id: 6252001
description:
[2025-12-10 13:06:21 +0530] info [cpaneld] 98.45.87.181 - simpleengineer "GET /login/?login_only=1&user=simpleengineer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.54.126.108
country_id: 6252001
description:
[2025-12-10 13:06:29 +0530] info [cpaneld] 104.54.126.108 - simpleen "GET /login/?login_only=1&user=simpleen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.168.26.217
country_id: 6252001
description:
[2025-12-10 13:06:28 +0530] info [cpaneld] 206.168.26.217 - simpleeng "GET /login/?login_only=1&user=simpleeng&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleeng (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.218.215.57
country_id: 6252001
description:
[2025-12-10 13:06:17 +0530] info [cpaneld] 97.218.215.57 - simpleengineeringlk "GET /login/?login_only=1&user=simpleengineeringlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineeringlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.186.71.142
country_id: 6252001
description:
[2025-12-10 13:06:18 +0530] info [cpaneld] 67.186.71.142 - simpleengineerin "GET /login/?login_only=1&user=simpleengineerin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.83.118.234
country_id: 6252001
description:
[2025-12-10 13:06:30 +0530] info [cpaneld] 184.83.118.234 - simplee "GET /login/?login_only=1&user=simplee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.191.212
country_id: 6252001
description:
[2025-12-10 13:06:34 +0530] info [cpaneld] 172.59.191.212 - sim "GET /login/?login_only=1&user=sim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.202
country_id: 6252001
description:
[2025-12-10 13:06:33 +0530] info [cpaneld] 172.58.167.202 - simp "GET /login/?login_only=1&user=simp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.129.32.162
country_id: 6252001
description:
[2025-12-10 13:06:36 +0530] info [cpaneld] 66.129.32.162 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.63.51.8
country_id: 6252001
description:
[2025-12-10 13:06:39 +0530] info [cpaneld] 104.63.51.8 - simplee2 "GET /login/?login_only=1&user=simplee2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.81.136.149
country_id: 6252001
description:
[2025-12-10 13:06:38 +0530] info [cpaneld] 75.81.136.149 - simplee1 "GET /login/?login_only=1&user=simplee1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-10 13:10:10 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:64841: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-10 13:10:45 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:50734: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.255
country_id: 6252001
description:
Dec 10 13:11:40 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.255, lip=66.85.158.92, TLS, session=<7sS1KJRFjvnG6xj/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Dec 10 13:16:55 host2 sshd[2215098]: Disconnected from invalid user cortega 103.161.207.2 port 54814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Dec 10 13:17:20 host2 sshd[2215423]: Disconnected from invalid user testuser 122.176.122.24 port 40214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 13:17:30 host2 sshd[2215524]: Disconnected from invalid user admin 2.57.121.112 port 56646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-10 13:19:09 dovecot_login authenticator failed for ([182.78.241.30]) [182.78.241.30]:45854: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.43.207
country_id: 3144096
description:
2025-12-10 13:19:12 dovecot_login authenticator failed for (cm-46.212.43.207.get.no) [46.212.43.207]:36840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Dec 10 13:18:22 host2 sshd[2216269]: Disconnected from invalid user stefano 103.161.207.2 port 52116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 10 13:18:40 host2 sshd[2216737]: Disconnected from invalid user ricardo 197.5.145.8 port 56240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-10 13:19:31 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:44458: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 10 13:19:37 host2 sshd[2217387]: Disconnected from invalid user yzx 197.5.145.8 port 50738 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-10 13:19:26 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:54142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-10 13:20:18 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:48436: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-10 13:20:39 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:55373: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Dec 10 13:20:51 host2 sshd[2218591]: Disconnected from invalid user ssh 192.227.128.3 port 51890 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 10 13:22:03 host2 sshd[2219393]: Received disconnect from 197.5.145.8 port 51632:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 10 13:22:03 host2 sshd[2219393]: Disconnected from invalid user user01 197.5.145.8 port 51632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Dec 10 13:23:38 host2 sshd[2220594]: Disconnected from invalid user jinyu 94.102.4.12 port 44678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Dec 10 13:25:47 host2 sshd[2222293]: Disconnected from invalid user user5 94.102.4.12 port 46690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 6252001
description:
2025-12-10 13:26:02 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:36196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-10 13:25:41 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:38552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Dec 10 13:25:43 host2 sshd[2222157]: Disconnected from invalid user sftpuser 192.227.128.3 port 42772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-10 13:26:16 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:39162: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-10 13:26:19 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:37509: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-10 13:26:27 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:59884: 535 Incorrect authentication data (set_id=contact)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.226.61.95
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.226.61.95: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.81.250
country_id: 1269750
description:
Dec 10 13:27:11 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.30.81.250, lip=66.85.158.91, TLS, session=<Gr0iX5RF4NZnHlH6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.47.99.66
country_id: 3077311
description:
Dec 10 13:27:29 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=31.47.99.66, lip=66.85.158.91, TLS, session=<py5GYJRFp5cfL2NC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-10 13:27:34 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:39334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-10 13:27:49 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:55602: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 13:28:04 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<eV42Y5RFxoWPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-10 13:27:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57226: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.102.4.12
country_id: 298795
description:
Dec 10 13:29:25 host2 sshd[2225498]: Disconnected from invalid user applmgr 94.102.4.12 port 59006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 13:30:36 host2 sshd[2226504]: Disconnected from invalid user admin 2.57.121.112 port 38576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-10 13:31:26 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:40969: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-10 13:31:40 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:33858: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.151.200.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.151.200.250 - nsteel "GET /login/?login_only=1&user=nsteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-10 13:33:07 dovecot_plain authenticator failed for (roment) [75.97.190.237]:44899: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.131.198.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.131.198.50 - nsteelengcom "GET /login/?login_only=1&user=nsteelengcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteelengcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.75.113.76
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.75.113.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 13:33:10 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (viterchers) [51.195.117.220]:60138: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-10 13:33:12 dovecot_login authenticator failed for ([152.52.234.4]) [152.52.231.202]:53844: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-10 13:32:21 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:57258: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.62.189.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 144.62.189.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.204.105.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.204.105.40 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.158.111.222
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.158.111.222 - nsteele "GET /login/?login_only=1&user=nsteele&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteele (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.86
country_id: 6252001
description:
Dec 10 13:32:36 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.86, lip=66.85.158.92, session=<X4WMc5RFZv/N0h9W>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.1.117.187
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.1.117.187 - nsteelen "GET /login/?login_only=1&user=nsteelen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteelen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.117.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 143.105.117.144 - nsteeleng "GET /login/?login_only=1&user=nsteeleng&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.191.164.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.191.164.126 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.51.106.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.51.106.203 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Dec 10 13:33:38 host2 sshd[2228964]: Disconnected from invalid user rsyncuser 94.102.4.12 port 57686 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.215.41.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.215.41.230 - nstee "GET /login/?login_only=1&user=nstee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.237.17.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.237.17.160 - nste "GET /login/?login_only=1&user=nste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nste (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Dec 10 13:35:54 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<GUFff5RFmKBBMQHo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2025-12-10 13:36:04 dovecot_login authenticator failed for ([149.54.62.2]) [149.54.62.2]:59173: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Dec 10 13:36:19 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<XP3VgJRFLG1BMQHo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-12-10 13:36:21 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:50562: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-10 13:36:25 dovecot_plain authenticator failed for (hialae) [92.62.243.174]:60760: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-10 13:39:24 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:38202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-10 13:39:46 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:39760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 13:40:55 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 10 13:41:43 host2 sshd[2235592]: Disconnected from invalid user frontend 154.124.97.102 port 50050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:41:48 host2 sshd[2235664]: Disconnected from invalid user ftproot 156.236.75.64 port 43600 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 13:43:42 host2 sshd[2237409]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.212.105.138
country_id: 6252001
description:
[2025-12-10 13:43:59 +0530] info [cpaneld] 108.212.105.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.143.181.253
country_id: 6252001
description:
[2025-12-10 13:44:03 +0530] info [cpaneld] 76.143.181.253 - manaharasupercenter "GET /login/?login_only=1&user=manaharasupercenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.164.210.196
country_id: 6252001
description:
[2025-12-10 13:44:01 +0530] info [cpaneld] 97.164.210.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.118.198.199
country_id: 6252001
description:
[2025-12-10 13:44:04 +0530] info [whostmgrd] 24.118.198.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.29.254.24
country_id: 6252001
description:
[2025-12-10 13:44:14 +0530] info [cpaneld] 207.29.254.24 - manaharasuperce "GET /login/?login_only=1&user=manaharasuperce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuperce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.147.32.30
country_id: 6252001
description:
[2025-12-10 13:44:06 +0530] info [cpaneld] 35.147.32.30 - manaharasupercenterlk "GET /login/?login_only=1&user=manaharasupercenterlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercenterlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-10 13:44:09 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:50838: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.215.227.218
country_id: 6252001
description:
[2025-12-10 13:44:08 +0530] info [cpaneld] 74.215.227.218 - manaharasupercente "GET /login/?login_only=1&user=manaharasupercente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.55.137.33
country_id: 6252001
description:
[2025-12-10 13:44:10 +0530] info [cpaneld] 69.55.137.33 - manaharasupercent "GET /login/?login_only=1&user=manaharasupercent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.137.68
country_id: 6252001
description:
[2025-12-10 13:44:12 +0530] info [cpaneld] 172.251.137.68 - manaharasupercen "GET /login/?login_only=1&user=manaharasupercen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercen (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-10 13:44:22 dovecot_login authenticator failed for (broadband.actcorp.in) [49.204.232.244]:39732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.209.109.12
country_id: 6252001
description:
[2025-12-10 13:44:31 +0530] info [cpaneld] 69.209.109.12 - manaharasu "GET /login/?login_only=1&user=manaharasu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-12-10 13:44:44 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:52617: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.74.196.148
country_id: 6252001
description:
[2025-12-10 13:44:46 +0530] info [cpaneld] 24.74.196.148 - manaha "GET /login/?login_only=1&user=manaha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.155.45.112
country_id: 6252001
description:
[2025-12-10 13:44:52 +0530] info [cpaneld] 99.155.45.112 - mana "GET /login/?login_only=1&user=mana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.9.250.67
country_id: 6252001
description:
[2025-12-10 13:44:59 +0530] info [cpaneld] 204.9.250.67 - manahar1 "GET /login/?login_only=1&user=manahar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.87.239.16
country_id: 6252001
description:
[2025-12-10 13:44:27 +0530] info [cpaneld] 23.87.239.16 - manaharasup "GET /login/?login_only=1&user=manaharasup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasup (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.144.205.2
country_id: 6252001
description:
[2025-12-10 13:44:35 +0530] info [cpaneld] 98.144.205.2 - manaharas "GET /login/?login_only=1&user=manaharas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.233.2
country_id: 6252001
description:
[2025-12-10 13:44:58 +0530] info [cpaneld] 35.151.233.2 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.15.158.243
country_id: 6252001
description:
[2025-12-10 13:45:03 +0530] info [cpaneld] 75.15.158.243 - manahar2 "GET /login/?login_only=1&user=manahar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.230.11.224
country_id: 6252001
description:
[2025-12-10 13:44:17 +0530] info [cpaneld] 104.230.11.224 - manaharasuperc "GET /login/?login_only=1&user=manaharasuperc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuperc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.76.148
country_id: 6252001
description:
[2025-12-10 13:44:21 +0530] info [cpaneld] 76.37.76.148 - manaharasupe "GET /login/?login_only=1&user=manaharasupe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.237.113.90
country_id: 6252001
description:
[2025-12-10 13:44:41 +0530] info [cpaneld] 68.237.113.90 - manahar "GET /login/?login_only=1&user=manahar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.111.28.85
country_id: 6252001
description:
[2025-12-10 13:44:56 +0530] info [cpaneld] 76.111.28.85 - man "GET /login/?login_only=1&user=man&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user man (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.69.44.68
country_id: 6252001
description:
[2025-12-10 13:44:19 +0530] info [cpaneld] 99.69.44.68 - manaharasuper "GET /login/?login_only=1&user=manaharasuper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuper (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-10 13:44:30 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:45879: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.26.169.174
country_id: 6252001
description:
[2025-12-10 13:44:37 +0530] info [cpaneld] 108.26.169.174 - manahara "GET /login/?login_only=1&user=manahara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.42.224.245
country_id: 6252001
description:
[2025-12-10 13:44:49 +0530] info [cpaneld] 73.42.224.245 - manah "GET /login/?login_only=1&user=manah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manah (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-12-10 13:45:27 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:51080: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:45:41 host2 sshd[2239753]: Disconnected from invalid user info 156.236.75.64 port 45184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-12-10 13:45:48 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:65146: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.122.207
country_id: 6252001
description:
Dec 10 13:46:07 host2 pure-ftpd[2240318]: (?@172.202.122.207) [INFO] New connection from 172.202.122.207


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 2.59.22.234
country_id: 2782113
description:
Dec 10 13:46:35 host2 dovecot[1766329]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 4 secs): user=<>, rip=2.59.22.234, lip=66.85.158.91, session=<rsiMpZRFAOcCOxbq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 2.59.22.234
country_id: 2782113
description:
Dec 10 13:46:37 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=2.59.22.234, lip=66.85.158.91, session=<yBCzpZRFfIQCOxbq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:46:58 host2 sshd[2241078]: Disconnected from invalid user ubuntu 156.236.75.64 port 46128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 10 13:47:19 host2 sshd[2241418]: Disconnected from invalid user vhserver 154.124.97.102 port 51372 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.248.168.120
country_id: 6252001
description:
[2025-12-10 13:48:54 +0530] info [cpaneld] 172.248.168.120 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.33.133.188
country_id: 6252001
description:
[2025-12-10 13:48:58 +0530] info [whostmgrd] 64.33.133.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.206.210.27
country_id: 6252001
description:
[2025-12-10 13:49:06 +0530] info [cpaneld] 97.206.210.27 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.144.18.61
country_id: 6252001
description:
[2025-12-10 13:49:09 +0530] info [cpaneld] 47.144.18.61 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.100.26.113
country_id: 6252001
description:
[2025-12-10 13:49:02 +0530] info [cpaneld] 174.100.26.113 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.173.115.166
country_id: 6252001
description:
[2025-12-10 13:49:04 +0530] info [cpaneld] 104.173.115.166 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-10 13:49:07 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:54076: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.123.255.91
country_id: 6252001
description:
[2025-12-10 13:48:55 +0530] info [cpaneld] 99.123.255.91 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.25.184.21
country_id: 6252001
description:
[2025-12-10 13:48:59 +0530] info [cpaneld] 98.25.184.21 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-10 13:49:14 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:49954: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.76.147.108
country_id: 6252001
description:
[2025-12-10 13:49:13 +0530] info [cpaneld] 99.76.147.108 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.190.87.229
country_id: 6252001
description:
[2025-12-10 13:48:50 +0530] info [cpaneld] 71.190.87.229 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.160.79
country_id: 6252001
description:
[2025-12-10 13:49:11 +0530] info [cpaneld] 76.33.160.79 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.141.148.221
country_id: 6252001
description:
[2025-12-10 13:49:20 +0530] info [cpaneld] 140.141.148.221 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Dec 10 13:51:14 host2 dovecot[1766329]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<NvsxtpRFdoRHBobn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-10 13:50:20 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:36818: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-10 13:50:51 dovecot_login authenticator failed for (cm-178.232.153.184.get.no) [178.232.153.184]:48341: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-10 13:50:59 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:40232: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-10 13:51:05 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:42936: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 10 13:50:16 host2 sshd[2244275]: Disconnected from invalid user shree 154.124.97.102 port 37919 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:50:45 host2 sshd[2244822]: Disconnected from invalid user simon 156.236.75.64 port 53454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-10 13:51:20 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:33584: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:51:59 host2 sshd[2245718]: Disconnected from invalid user teste1 156.236.75.64 port 46904 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.136.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.120.136.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.83.59.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.83.59.116 - sobaherbalcom "GET /login/?login_only=1&user=sobaherbalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.6.6.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.6.6.130 - sobaherb "GET /login/?login_only=1&user=sobaherb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.202.144.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.202.144.75 - sobaherba "GET /login/?login_only=1&user=sobaherba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.213.236.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.213.236.57 - sobahe "GET /login/?login_only=1&user=sobahe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobahe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.137.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.207.137.100 - sobaher "GET /login/?login_only=1&user=sobaher&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.84.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 129.222.84.171 - sobah "GET /login/?login_only=1&user=sobah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.241.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.128.241.40 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.12.72.199
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.12.72.199 - sobaherbal "GET /login/?login_only=1&user=sobaherbal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.177.178.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.177.178.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.105.142.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.105.142.56 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.200.183
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.157.200.183 - sobaher1 "GET /login/?login_only=1&user=sobaher1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.128.61.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.128.61.209 - sobaher2 "GET /login/?login_only=1&user=sobaher2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 13:53:22 host2 sshd[2246571]: Disconnected from invalid user  62.60.131.157 port 33268 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.103.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.170.103.53 - soba "GET /login/?login_only=1&user=soba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.220.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.220.178 - sob "GET /login/?login_only=1&user=sob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sob (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 10 13:54:53 host2 sshd[2247982]: Disconnected from invalid user zhl 154.124.97.102 port 60100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-12-10 13:54:57 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:46809: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 13:54:24 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sones) [87.103.126.54]:17729: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-10 13:54:32 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:49905: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 13:57:25 host2 sshd[2250100]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 13:57:55 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<fnf5zZRFDMwXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.26.21.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.26.21.230 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.180.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.187.180.60 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.21.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.117.21.186 - ay "GET /login/?login_only=1&user=ay&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ay (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.139.241
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 45.50.139.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.34.133.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.34.133.181 - ayuzonelank "GET /login/?login_only=1&user=ayuzonelank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.146.249.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.146.249.127 - ayuzonela "GET /login/?login_only=1&user=ayuzonela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.180.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.187.180.60 - ayuzo "GET /login/?login_only=1&user=ayuzo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.31.52
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.241.31.52 - ayuz "GET /login/?login_only=1&user=ayuz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.119.87.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.119.87.105 - ayuzonelankacom "GET /login/?login_only=1&user=ayuzonelankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.142.227.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.142.227.230 - ayuzonelan "GET /login/?login_only=1&user=ayuzonelan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.201.31.115
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.201.31.115 - ayu "GET /login/?login_only=1&user=ayu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.80.160.137
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.80.160.137 - ayuzone1 "GET /login/?login_only=1&user=ayuzone1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.85.193.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.85.193.218 - ayuzone "GET /login/?login_only=1&user=ayuzone&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.159.59
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.4.159.59 - ayuzonelanka "GET /login/?login_only=1&user=ayuzonelanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.44.137.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.44.137.217 - ayuzonel "GET /login/?login_only=1&user=ayuzonel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.52.169.78
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.52.169.78 - ayuzon "GET /login/?login_only=1&user=ayuzon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.94.239.27
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.94.239.27 - ayuzone2 "GET /login/?login_only=1&user=ayuzone2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-10 13:59:49 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:33535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-10 13:59:52 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (bernslity) [81.225.30.107]:53797: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-10 14:00:03 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:49309: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.55
country_id: 6252001
description:
2025-12-10 14:01:14 dovecot_login authenticator failed for ([72.214.133.55]) [72.214.133.55]:46751: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.168.92
country_id: 6252001
description:
2025-12-10 14:01:26 dovecot_login authenticator failed for 64-251-168-92.ip4.gwtc.net [64.251.168.92]:44970: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-10 14:02:50 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:47956: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-10 14:02:59 dovecot_login authenticator failed for ([84.211.24.143]) [84.211.24.143]:56257: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-10 14:03:02 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:44558: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-10 14:03:05 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:59769: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-12-10 14:03:15 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:53880: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.28
country_id: 6252001
description:
2025-12-10 14:02:45 dovecot_login authenticator failed for ([98.181.46.28]) [98.181.46.28]:58311: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.58.147.227
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.58.147.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.175.61.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.175.61.50 - melanifinefood "GET /login/?login_only=1&user=melanifinefood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.14.48.125
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.14.48.125 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.192.140.247
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.192.140.247 - melanifinefoo "GET /login/?login_only=1&user=melanifinefoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinefoo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.190.44.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.190.44.4 - melanifinef "GET /login/?login_only=1&user=melanifinef&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinef (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.47.202.63
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 199.47.202.63 - melanifine "GET /login/?login_only=1&user=melanifine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.126.146.227
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.126.146.227 - melanifin "GET /login/?login_only=1&user=melanifin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.73.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.141.73.18 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.20.73.148
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.20.73.148 - melanif "GET /login/?login_only=1&user=melanif&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.205.213.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.205.213.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.98.234.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.98.234.40 - melanifi "GET /login/?login_only=1&user=melanifi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.101.212.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.101.212.212 - melan "GET /login/?login_only=1&user=melan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.137.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.160.137.225 - mel "GET /login/?login_only=1&user=mel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.69.169.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.69.169.181 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.97.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.157.97.80 - melanifinefoodcom "GET /login/?login_only=1&user=melanifinefoodcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinefoodcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.14.144.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.14.144.48 - melanif2 "GET /login/?login_only=1&user=melanif2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.160.110
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.141.160.110 - melani "GET /login/?login_only=1&user=melani&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melani (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.44.139.187
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.44.139.187 - mela "GET /login/?login_only=1&user=mela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.209.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.209.155 - melanif1 "GET /login/?login_only=1&user=melanif1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif1 (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 212.104.231.194
country_id: 1227603
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.104.231.194 - fhbhealt "GET /cpsess9557747597/frontend/jupiter/raw/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [112.135.215.146] != Current IP Address [212.104.231.194]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.235.129.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.235.129.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.70.96.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.70.96.177 - melanifinefo "GET /login/?login_only=1&user=melanifinefo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinefo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.160.120.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.160.120.154 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.104.53.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.104.53.100 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.62.154.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.62.154.123 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.117.139.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.117.139.195 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-10 14:05:10 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:36728: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.110.170.88
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 70.110.170.88 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.213.18.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.213.18.36 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.60.57.211
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 139.60.57.211 - kamecholk "GET /login/?login_only=1&user=kamecholk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecholk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.255.201.69
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.255.201.69 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-10 14:04:54 dovecot_login authenticator failed for ([125.19.174.244]) [128.185.201.138]:44190: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.253.95.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.253.95.100 - drag "GET /login/?login_only=1&user=drag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.156.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.117.156.202 - drago "GET /login/?login_only=1&user=drago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.16.223
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.16.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.165.254
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.165.254 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.41.241.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.41.241.210 - dragon "GET /login/?login_only=1&user=dragon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.129.21.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 65.129.21.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.8.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.8.37 - dragonlk "GET /login/?login_only=1&user=dragonlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dragonlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.56.210.242
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.56.210.242 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-12-10 14:06:14 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:58976: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.49.155.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.49.155.177 - dra "GET /login/?login_only=1&user=dra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dra (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.222.252.199
country_id: 2750405
description:
Dec 10 14:07:05 host2 sshd[2258545]: Disconnected from invalid user sina 168.222.252.199 port 34922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.90
country_id: 1269750
description:
2025-12-10 14:06:38 dovecot_login authenticator failed for ([182.95.228.90]) [182.95.228.90]:60132: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 14:08:15 host2 sshd[2259250]: Disconnected from invalid user user 2.57.121.25 port 36628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 10 14:08:54 host2 sshd[2259760]: Disconnected from invalid user luis 189.112.0.11 port 34006 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-10 14:09:59 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:55199: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 10 14:10:05 host2 sshd[2260713]: Disconnected from invalid user sammy 189.112.0.11 port 51172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.66.12
country_id: 6252001
description:
2025-12-10 14:10:09 dovecot_login authenticator failed for ([98.181.66.12]) [98.181.66.12]:37459: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 6252001
description:
Dec 10 14:09:54 host2 sshd[2260455]: Disconnected from invalid user splunk 144.31.126.21 port 39852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.222.252.199
country_id: 2750405
description:
Dec 10 14:10:55 host2 sshd[2261237]: Disconnected from invalid user user123 168.222.252.199 port 40822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 6252001
description:
Dec 10 14:11:03 host2 sshd[2261363]: Disconnected from invalid user user123 144.31.126.21 port 39126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-12-10 14:10:39 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:47844: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Dec 10 14:10:44 host2 sshd[2261145]: Disconnected from invalid user ubuntu 34.22.66.183 port 40918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 14:11:14 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Qc6b/ZRFmN4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-10 14:10:20 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:53974: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-10 14:11:19 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:56873: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 6252001
description:
Dec 10 14:11:41 host2 sshd[2261706]: Disconnected from invalid user node 144.31.126.21 port 59310 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-12-10 14:12:14 dovecot_login authenticator failed for ([49.124.151.56]) [49.124.151.56]:43850: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 10 14:11:21 host2 sshd[2261537]: Disconnected from invalid user guest 209.141.33.240 port 56836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Dec 10 14:11:30 host2 sshd[2261605]: Disconnected from invalid user ubuntu 106.51.1.63 port 52468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 10 14:11:31 host2 sshd[2261616]: Disconnected from invalid user yy 189.112.0.11 port 47278 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.14.137.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.14.137.145 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.11.146
country_id: 3996063
description:
Dec 10 14:16:29 host2 sshd[2266095]: Disconnected from invalid user yunpeng 47.87.11.146 port 54152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Dec 10 14:16:14 host2 sshd[2265799]: Disconnected from invalid user yy 62.3.56.187 port 35848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.56
country_id: 1643084
description:
Dec 10 14:16:24 host2 sshd[2265930]: Disconnected from invalid user mcserver 103.67.78.56 port 41678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 10 14:17:08 host2 sshd[2266575]: Disconnected from invalid user luis 185.121.0.2 port 50318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.222.252.199
country_id: 2750405
description:
Dec 10 14:17:19 host2 sshd[2266764]: Disconnected from invalid user test 168.222.252.199 port 49038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.11.146
country_id: 3996063
description:
Dec 10 14:17:43 host2 sshd[2267032]: Disconnected from invalid user tecnopos 47.87.11.146 port 48776 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.222.252.199
country_id: 2750405
description:
Dec 10 14:17:53 host2 sshd[2267111]: Disconnected from invalid user node 168.222.252.199 port 58230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-10 14:17:07 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:51290: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 10 14:17:56 host2 sshd[2267123]: Disconnected from invalid user luis 152.32.190.168 port 37654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.56
country_id: 1643084
description:
Dec 10 14:18:08 host2 sshd[2267265]: Disconnected from invalid user canvas 103.67.78.56 port 51242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.111.234.222
country_id: 130758
description:
Dec 10 14:18:20 host2 sshd[2267348]: Disconnected from invalid user test 193.111.234.222 port 41582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 10 14:19:13 host2 sshd[2268046]: Disconnected from invalid user teamspeak 185.121.0.2 port 56196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 10 14:20:48 host2 sshd[2269556]: Disconnected from invalid user blog 152.32.190.168 port 43822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 10 14:20:05 host2 sshd[2268927]: Disconnected from invalid user sammy 152.32.190.168 port 47828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 14:21:20 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (inadaeous) [51.195.117.220]:34050: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.132.164.17
country_id: 2635167
description:
Dec 10 14:25:39 host2 sshd[2273439]: Disconnected from invalid user surubu 23.132.164.17 port 49116 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 10 14:25:28 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<9v2mMJVFXJosyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.51.221.132
country_id: 3175395
description:
2025-12-10 14:26:52 dovecot_login authenticator failed for 93-51-221-132.ip268.fastwebnet.it [93.51.221.132]:54269: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.14.178.19
country_id: 6252001
description:
Dec 10 14:26:22 host2 sshd[2274320]: Disconnected from invalid user administrator 72.14.178.19 port 53218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-10 14:26:40 dovecot_login authenticator failed for (nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:42794: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Dec 10 14:27:04 host2 sshd[2275147]: Disconnected from invalid user rustserver 69.49.246.176 port 49172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 10 14:27:24 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<XSqMN5VFdIo26lCA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Dec 10 14:28:54 host2 sshd[2276826]: Disconnected from invalid user sdbadmin 69.49.246.176 port 53710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Dec 10 14:29:31 host2 sshd[2277458]: Disconnected from invalid user david 69.49.246.176 port 36404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-10 14:31:02 dovecot_login authenticator failed for ([182.73.193.249]) [122.187.41.18]:54464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 14:32:04 host2 sshd[2280135]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Dec 10 14:32:14 host2 sshd[2280275]: Disconnected from invalid user luis 103.248.43.99 port 53422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.14.178.19
country_id: 6252001
description:
Dec 10 14:32:26 host2 sshd[2280494]: Disconnected from invalid user david 72.14.178.19 port 42392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.14.178.19
country_id: 6252001
description:
Dec 10 14:33:32 host2 sshd[2281650]: Disconnected from invalid user william 72.14.178.19 port 34988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 10 14:33:06 host2 sshd[2281316]: Disconnected from invalid user odoo 103.174.114.50 port 47046 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.96
country_id: 6252001
description:
Dec 10 14:33:22 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=44.220.185.96, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+vTfTJVFhpUs3Llg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Dec 10 14:34:12 host2 sshd[2282208]: Disconnected from invalid user tt 103.248.43.99 port 39446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-10 14:35:53 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:44174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.67.39
country_id: 3996063
description:
2025-12-10 14:35:53 dovecot_login authenticator failed for ([201.160.67.39]) [201.160.67.39]:51344: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 10 14:35:07 host2 sshd[2283101]: Disconnected from invalid user toor 198.46.207.98 port 45480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-12-10 14:35:39 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:35782: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Dec 10 14:35:45 host2 sshd[2283555]: Disconnected from invalid user administrador 103.174.115.5 port 36922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-12-10 14:36:26 dovecot_login authenticator failed for ([49.124.152.172]) [49.124.152.172]:57126: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.222.23.164
country_id: 3017382
description:
Dec 10 14:36:32 host2 sshd[2284089]: Disconnected from invalid user app 92.222.23.164 port 46350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 10 14:36:32 host2 sshd[2284087]: Disconnected from invalid user test 58.98.199.45 port 46557 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 10 14:36:45 host2 sshd[2284223]: Disconnected from invalid user thiago 103.174.114.50 port 52170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-10 14:36:48 dovecot_login authenticator failed for (177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:60066: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Dec 10 14:36:50 host2 sshd[2284290]: Disconnected from invalid user oficina 103.174.115.5 port 40588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 10 14:37:37 host2 sshd[2284777]: Disconnected from invalid user colin 103.174.114.50 port 59384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.222.23.164
country_id: 3017382
description:
Dec 10 14:37:42 host2 sshd[2284869]: Disconnected from invalid user omm 92.222.23.164 port 47782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 14:37:06 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:61591: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 10 14:37:29 host2 sshd[2284700]: Disconnected from invalid user wow 198.46.207.98 port 56776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 10 14:38:26 host2 sshd[2285634]: Disconnected from invalid user zyx 202.157.177.33 port 37066 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 10 14:39:40 host2 sshd[2286532]: Disconnected from invalid user intern 198.46.207.98 port 59072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.62
country_id: 1643084
description:
Dec 10 14:39:04 host2 sshd[2286195]: Disconnected from invalid user ftpuser 103.59.94.62 port 39366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Dec 10 14:39:24 host2 sshd[2286378]: Disconnected from invalid user vpn 103.174.115.5 port 52222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 10 14:39:30 host2 sshd[2286422]: Disconnected from invalid user developer 58.98.199.45 port 41110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.62
country_id: 1643084
description:
Dec 10 14:41:05 host2 sshd[2287851]: Disconnected from invalid user testadmin 103.59.94.62 port 59036 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 92.222.23.164
country_id: 3017382
description:
Dec 10 14:41:28 host2 sshd[2288219]: Received disconnect from 92.222.23.164 port 52628:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.222.23.164
country_id: 3017382
description:
Dec 10 14:41:28 host2 sshd[2288219]: Disconnected from invalid user testuser 92.222.23.164 port 52628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-10 14:41:39 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:34054: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.90
country_id: 1733045
description:
2025-12-10 14:41:56 dovecot_login authenticator failed for ([49.125.201.90]) [49.125.201.90]:56284: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 10 14:42:17 host2 sshd[2289057]: Disconnected from invalid user vps 58.98.199.45 port 37314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Dec 10 14:42:32 host2 sshd[2289227]: Disconnected from invalid user ubuntu 103.174.115.5 port 57642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-12-10 14:42:56 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:42134: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-10 14:42:16 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:59997: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Dec 10 14:44:08 host2 sshd[2291059]: Disconnected from invalid user yy 103.248.43.99 port 41678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 14:45:00 host2 sshd[2291942]: Disconnected from invalid user admin1 62.60.131.157 port 22985 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Dec 10 14:46:11 host2 sshd[2293314]: Disconnected from invalid user ubuntu 103.248.43.99 port 47748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-10 14:48:00 dovecot_plain authenticator failed for (calar) [24.187.213.29]:47348: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.207
country_id: 953987
description:
Dec 10 14:50:49 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.64.42.207, lip=66.85.158.91, TLS, session=<EloHipVFKrBmQCrP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.10
country_id: 690791
description:
Dec 10 14:51:07 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=176.103.5.10, lip=66.85.158.91, TLS, session=<emNXi5VF/YawZwUK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2025-12-10 14:51:52 dovecot_login authenticator failed for ([197.219.208.38]) [197.219.208.38]:41128: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-12-10 14:52:05 dovecot_login authenticator failed for (171.140.212.218.starhub.net.sg) [218.212.140.171]:30141: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 14:53:43 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (babsublie) [87.103.126.54]:63227: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 14:54:20 host2 sshd[2300715]: Disconnected from invalid user zjw 189.194.140.170 port 60502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-10 14:55:51 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:54462: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-12-10 14:56:10 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:60423: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.131.163.217
country_id: 6252001
description:
Dec 10 14:57:03 host2 pure-ftpd[2303738]: (?@130.131.163.217) [INFO] New connection from 130.131.163.217


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 14:57:31 host2 sshd[2304132]: Disconnected from invalid user wilson 189.194.140.170 port 54276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 14:58:09 host2 sshd[2304825]: Disconnected from invalid user deploy 189.194.140.170 port 38598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 15:00:01 host2 sshd[2306573]: Disconnected from invalid user ftpupload 189.194.140.170 port 48032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-10 15:00:48 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:56086: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-10 15:01:04 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:38171: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-10 15:01:14 dovecot_login authenticator failed for 61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:40230: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-10 15:01:25 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:59782: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 15:01:27 host2 sshd[2308497]: Disconnected from invalid user admin 189.194.140.170 port 44918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-10 15:02:59 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:38341: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.74.255.237
country_id: 3625428
description:
2025-12-10 15:05:32 dovecot_plain authenticator failed for ([89.116.164.85]) [38.74.255.237]:9824: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.192.250.124
country_id: 1527747
description:
2025-12-10 15:05:46 dovecot_plain authenticator failed for ([89.116.164.85]) [31.192.250.124]:46442: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.111
country_id: 3865483
description:
Dec 10 15:06:38 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.250.111, lip=66.85.158.91, TLS, session=<op+0wpVFGZWzAPpv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.223.203.78
country_id: 3469034
description:
2025-12-10 15:06:00 dovecot_plain authenticator failed for ([89.116.164.85]) [179.223.203.78]:26986: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.44
country_id: 1269750
description:
Dec 10 15:07:01 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=103.207.4.44, lip=66.85.158.91, TLS, session=<uzILxJVFzddnzwQs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-10 15:07:06 dovecot_login authenticator failed for (187.161.136.37-clientes-izzi.mx) [187.161.136.37]:38270: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-10 15:07:29 dovecot_login authenticator failed for ([182.95.123.46]) [182.95.123.46]:35352: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-10 15:07:52 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:33965: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-10 15:08:13 dovecot_login authenticator failed for (201.173.56.28-clientes-izzi.mx) [201.173.56.28]:47317: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 10 15:10:55 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<jzsu05VFmM0DWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 15:11:07 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (podat) [51.195.117.220]:41883: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-10 15:17:40 dovecot_plain authenticator failed for (tervy) [24.104.225.201]:43743: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-10 15:17:42 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:38512: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-10 15:17:57 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:47761: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-10 15:21:36 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:49848: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 15:22:53 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (koine) [51.195.117.220]:46429: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-12-10 15:22:07 dovecot_login authenticator failed for ([125.23.202.194]) [125.23.202.194]:33110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-10 15:26:56 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:54270: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-10 15:26:55 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:37449: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-10 15:27:12 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:39466: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-10 15:27:33 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:53234: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-10 15:28:30 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:39296: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-10 15:28:48 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:41012: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-12-10 15:32:11 dovecot_login authenticator failed for ([122.187.234.56]) [122.187.234.56]:54205: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
country_id: 6252001
description:
2025-12-10 15:32:25 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:58533: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-10 15:32:55 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:37958: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-10 15:33:13 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:38545: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-12-10 15:33:48 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:35470: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.70
country_id: 2750405
description:
Dec 10 15:34:24 host2 sshd[2341668]: Disconnected from invalid user sol 41.216.181.70 port 42638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-10 15:34:01 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:42400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.70
country_id: 2750405
description:
Dec 10 15:35:51 host2 sshd[2343232]: Disconnected from invalid user alireza 41.216.181.70 port 36626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.42.3
country_id: 3895114
description:
2025-12-10 15:35:17 dovecot_plain authenticator failed for ([89.116.164.85]) [190.114.42.3]:55382: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.234.167.188
country_id: 3573591
description:
2025-12-10 15:35:29 dovecot_plain authenticator failed for ([89.116.164.85]) [45.234.167.188]:54862: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.227
country_id: 6252001
description:
Dec 10 15:36:51 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.227, lip=66.85.158.92, session=<VFvvL5ZFgc7DuEzj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 10 15:36:24 host2 sshd[2343799]: Disconnected from invalid user guest 154.91.81.224 port 47550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:36:29 host2 sshd[2343872]: Disconnected from invalid user user 41.128.181.199 port 43446 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.5
country_id: 6252001
description:
Dec 10 15:36:33 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.5, lip=66.85.158.92, session=<PBTeLpZFncPDuEwF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.7
country_id: 6252001
description:
Dec 10 15:36:45 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.7, lip=66.85.158.92, session=<wqOML5ZFC77DuEwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.0
country_id: 6252001
description:
Dec 10 15:36:55 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.0, lip=66.85.158.92, session=<l0YfMJZFDY3DuEwA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.181.70
country_id: 2750405
description:
Dec 10 15:36:55 host2 sshd[2344426]: Disconnected from invalid user ubuntu 41.216.181.70 port 33592 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 15:37:43 host2 sshd[2345366]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 10 15:37:26 host2 sshd[2345006]: Disconnected from invalid user milad 70.54.182.130 port 43213 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.70
country_id: 2750405
description:
Dec 10 15:37:25 host2 sshd[2344995]: Disconnected from invalid user telegram 41.216.181.70 port 46186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-10 15:38:36 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:55416: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:38:40 host2 sshd[2346521]: Disconnected from invalid user milad 41.128.181.199 port 55692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-10 15:38:46 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:53460: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Dec 10 15:38:51 host2 sshd[2346750]: Disconnected from invalid user mqm 154.221.22.203 port 44584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.175.56
country_id: 3017382
description:
Dec 10 15:38:10 host2 sshd[2345997]: Disconnected from invalid user user 51.68.175.56 port 39182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 10 15:38:17 host2 sshd[2346151]: Disconnected from invalid user haproxy 154.91.81.224 port 58120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-10 15:39:03 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:50294: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 10 15:39:08 host2 sshd[2347104]: Disconnected from invalid user imran 196.92.7.249 port 34880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 10 15:39:31 host2 sshd[2347524]: Disconnected from invalid user db2inst1 154.91.81.224 port 55690 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.175.56
country_id: 3017382
description:
Dec 10 15:39:46 host2 sshd[2347948]: Disconnected from invalid user alireza 51.68.175.56 port 47422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:39:56 host2 sshd[2348173]: Disconnected from invalid user installer 41.128.181.199 port 41056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 10 15:40:09 host2 sshd[2348573]: Disconnected from invalid user uat 154.91.81.224 port 40680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 10 15:41:53 host2 sshd[2350261]: Disconnected from invalid user acs 196.92.7.246 port 58038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:42:30 host2 sshd[2351007]: Disconnected from invalid user test4 41.128.181.199 port 43880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 15:42:34 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kgY+RJZFcM4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-10 15:42:50 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:36334: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-10 15:43:01 dovecot_login authenticator failed for (cm-84.211.6.119.get.no) [84.211.6.119]:60427: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:43:07 host2 sshd[2351896]: Disconnected from invalid user alireza 41.128.181.199 port 38630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 10 15:43:17 host2 sshd[2352145]: Disconnected from invalid user andy 196.92.7.249 port 42166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-10 15:46:50 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:46878: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-10 15:47:11 dovecot_login authenticator failed for (broadband.actcorp.in) [49.204.232.244]:37968: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Dec 10 15:47:46 host2 sshd[2357100]: Disconnected from invalid user ansadmin 154.144.225.226 port 33462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Dec 10 15:48:57 host2 sshd[2358198]: Disconnected from invalid user trade 154.221.22.203 port 54130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 10 15:49:45 host2 sshd[2359130]: Disconnected from invalid user ubuntu 196.92.7.246 port 36020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 15:49:22 host2 sshd[2358747]: Disconnected from invalid user admin 2.57.121.112 port 58756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.22.203
country_id: 1819730
description:
Dec 10 15:49:39 host2 sshd[2359008]: Disconnected from invalid user dev 154.221.22.203 port 38454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Dec 10 15:50:23 host2 sshd[2359978]: Disconnected from invalid user testuser 154.221.22.203 port 51012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 10 15:50:50 host2 sshd[2360534]: Disconnected from invalid user alireza 70.54.182.130 port 60495 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 15:51:20 host2 sshd[2360966]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 10 15:51:03 host2 sshd[2360752]: Disconnected from invalid user sol 196.92.7.246 port 32780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 10 15:51:42 host2 sshd[2361271]: Disconnected from invalid user milad 196.92.7.249 port 49392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-10 15:51:44 dovecot_login authenticator failed for ([149.54.15.90]) [149.54.15.90]:34189: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-10 15:51:48 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:34859: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-12-10 15:51:56 dovecot_login authenticator failed for ([154.118.162.194]) [154.118.162.194]:26802: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.153.239
country_id: 6252001
description:
Dec 10 15:52:33 host2 sshd[2362037]: Disconnected from invalid user jarservice 103.101.153.239 port 39510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2025-12-10 15:52:59 dovecot_login authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:60901: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.24
country_id: 2186224
description:
2025-12-10 15:52:12 dovecot_login authenticator failed for ([121.73.163.24]) [121.73.163.24]:55344: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 10 15:52:59 host2 sshd[2362458]: Disconnected from invalid user installer 196.92.7.246 port 38472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-10 15:53:35 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:45197: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 10 15:53:44 host2 sshd[2362996]: Disconnected from invalid user ansadmin 70.54.182.130 port 41607 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.125
country_id: 1643084
description:
Dec 10 15:53:59 host2 sshd[2363214]: Disconnected from invalid user cheng 103.176.79.125 port 48270 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.3.203
country_id: 1269750
description:
Dec 10 15:55:48 host2 sshd[2365640]: Disconnected from invalid user qbtuser 36.255.3.203 port 39097 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Dec 10 15:55:00 host2 sshd[2364693]: Disconnected from invalid user test4 154.144.225.226 port 55232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 10 15:55:25 host2 sshd[2365222]: Disconnected from invalid user es 103.136.200.241 port 56092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.138.65
country_id: 2542007
description:
Dec 10 15:55:40 host2 sshd[2365466]: Disconnected from invalid user firefart 81.192.138.65 port 56684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 10 15:56:10 host2 sshd[2365997]: Disconnected from invalid user irfan 103.136.200.241 port 52852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.61.17.65
country_id: 6252001
description:
Dec 10 15:56:19 host2 sshd[2366106]: Disconnected from invalid user cheng 34.61.17.65 port 53114 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.112.120
country_id: 6252001
description:
Dec 10 15:56:53 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.223.112.120, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<eOGOd5ZF7pyf33B4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.205.123
country_id: 6252001
description:
Dec 10 15:56:53 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=69.164.205.123, lip=66.85.158.91, TLS: Connection closed, session=<pRKVd5ZFwoBFpM17>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.68.83
country_id: 6252001
description:
Dec 10 15:56:59 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.68.83, lip=66.85.158.92, TLS: Connection closed, session=<N8zpd5ZFTqQtIURT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 10 15:57:30 host2 sshd[2367099]: Disconnected from invalid user rustserver 103.136.200.241 port 41250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 10 15:57:37 host2 sshd[2367225]: Disconnected from invalid user alireza 196.92.7.246 port 47152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-12-10 15:57:46 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:35237: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.144.186
country_id: 6252001
description:
Dec 10 15:56:59 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.172.144.186, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kGvpd5ZFapWnrJC6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-10 15:58:55 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:46290: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.136.200.241
country_id: 1210997
description:
Dec 10 15:58:09 host2 sshd[2367846]: Disconnected from invalid user cheng 103.136.200.241 port 36964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-10 15:58:14 dovecot_login authenticator failed for ([203.193.147.41]) [203.193.147.37]:59153: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.123
country_id: 6252001
description:
2025-12-10 15:58:31 dovecot_login authenticator failed for wsip-184-191-250-123.fv.ks.cox.net [184.191.250.123]:36902: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-10 15:58:49 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:56964: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.125
country_id: 1643084
description:
Dec 10 15:59:38 host2 sshd[2369795]: Disconnected from invalid user artem 103.176.79.125 port 56408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.153.239
country_id: 6252001
description:
Dec 10 15:59:31 host2 sshd[2369661]: Disconnected from invalid user juan 103.101.153.239 port 40808 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 36.255.3.203
country_id: 1269750
description:
Dec 10 16:00:08 host2 sshd[2370692]: Received disconnect from 36.255.3.203 port 55473:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.153.239
country_id: 6252001
description:
Dec 10 16:00:08 host2 sshd[2370714]: Disconnected from invalid user ghostcms 103.101.153.239 port 53208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.125
country_id: 1643084
description:
Dec 10 16:00:34 host2 sshd[2371174]: Disconnected from invalid user jarservice 103.176.79.125 port 49098 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.101.153.239
country_id: 6252001
description:
Dec 10 16:00:49 host2 sshd[2371544]: Disconnected from invalid user ts 103.101.153.239 port 37742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.125
country_id: 1643084
description:
Dec 10 16:01:28 host2 sshd[2372140]: Disconnected from invalid user abhishek 103.176.79.125 port 52618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.153.239
country_id: 6252001
description:
Dec 10 16:01:30 host2 sshd[2372264]: Disconnected from invalid user cheng 103.101.153.239 port 50582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.61.17.65
country_id: 6252001
description:
Dec 10 16:02:46 host2 sshd[2373892]: Disconnected from invalid user juan 34.61.17.65 port 35896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.214.239
country_id: 6252001
description:
Dec 10 16:02:51 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.197.214.239, lip=66.85.158.92, TLS, session=<20zrjJZFwJ6Kxdbv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 16:03:02 host2 sshd[2373924]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.61.17.65
country_id: 6252001
description:
Dec 10 16:03:43 host2 sshd[2375430]: Disconnected from invalid user gg 34.61.17.65 port 45164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.133.160
country_id: 2635167
description:
Dec 10 16:04:13 host2 sshd[2376192]: Disconnected from invalid user odoo 149.102.133.160 port 42210 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.67.127
country_id: 6252001
description:
Dec 10 16:04:29 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.79.67.127, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<p5a5kpZFMtktT0N/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.81.6.40
country_id: 6252001
description:
Dec 10 16:04:38 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=206.81.6.40, lip=66.85.158.91, TLS, session=<rcdLk5ZFnu3OUQYo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.97.44
country_id: 3469034
description:
Dec 10 16:05:43 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 18 secs): user=<info>, method=LOGIN, rip=186.224.97.44, lip=66.85.158.91, session=<1ssYlpZF9Mi64GEs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 10 16:05:21 host2 sshd[2377326]: Disconnected from invalid user user 70.54.182.130 port 46590 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.32
country_id: 2510769
description:
Dec 10 16:05:22 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=139.28.190.32, lip=66.85.158.91, TLS, session=<NlndlJZF2b+LHL4g>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.133.160
country_id: 2635167
description:
Dec 10 16:05:24 host2 sshd[2377369]: Disconnected from invalid user infra 149.102.133.160 port 51028 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 100.30.80.53
country_id: 6252001
description:
Dec 10 16:06:09 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=100.30.80.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<x0SsmJZFJrdkHlA1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 149.102.133.160
country_id: 2635167
description:
Dec 10 16:06:42 host2 sshd[2378453]: Disconnected from invalid user wifi 149.102.133.160 port 35774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.146
country_id: 3865483
description:
Dec 10 16:05:58 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 12 secs): user=<info>, method=PLAIN, rip=179.0.250.146, lip=66.85.158.91, TLS, session=<2ppNl5ZF8IuzAPqS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-10 16:08:32 +0530] info [cpaneld] 89.249.55.106 - casa18vi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa18vi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.136
country_id: 6252001
description:
2025-12-10 16:08:00 dovecot_login authenticator failed for wsip-184-191-250-136.fv.ks.cox.net [184.191.250.136]:57663: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.133.160
country_id: 2635167
description:
Dec 10 16:09:52 host2 sshd[2380719]: Disconnected from invalid user admin 149.102.133.160 port 51016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.133.160
country_id: 2635167
description:
Dec 10 16:10:30 host2 sshd[2381371]: Disconnected from invalid user ubuntu 149.102.133.160 port 58070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-12-10 16:12:14 dovecot_login authenticator failed for ([120.157.80.73]) [120.157.80.73]:51664: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-10 16:12:34 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:52396: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.243.111
country_id: 3469034
description:
Dec 10 16:12:40 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.243.111, lip=66.85.158.91, TLS, session=<kRDyrpZFwr660fNv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-10 16:17:30 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:45221: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-10 16:17:43 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:59053: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-10 16:17:54 dovecot_login authenticator failed for (cm-84.215.110.96.get.no) [84.215.110.96]:55235: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2025-12-10 16:17:16 dovecot_login authenticator failed for ([203.192.97.23]) [203.192.97.23]:49964: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.144.27
country_id: 6252001
description:
2025-12-10 16:19:06 dovecot_login authenticator failed for ([15.218.144.27]) [15.218.144.27]:53815: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-10 16:22:58 dovecot_login authenticator failed for a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:48360: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2025-12-10 16:23:13 dovecot_login authenticator failed for ([125.18.67.17]) [182.95.112.146]:34296: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 16:23:25 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Cy9F1pZFOq4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-10 16:23:51 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:52060: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.155
country_id: 6252001
description:
2025-12-10 16:24:03 dovecot_login authenticator failed for ([70.174.167.155]) [70.174.167.155]:51387: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 16:24:20 host2 sshd[2395827]: Disconnected from invalid user admin 62.60.131.157 port 39158 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 10 16:26:10 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<ccdK4JZFLr+LonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.96
country_id: 6252001
description:
Dec 10 16:27:07 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.96, lip=66.85.158.92, session=<Ke6p45ZFp9xb5qhg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.225
country_id: 6252001
description:
Dec 10 16:27:17 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.225, lip=66.85.158.92, session=<5/RN5JZFqa1b5qjh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.224
country_id: 6252001
description:
Dec 10 16:27:32 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.224, lip=66.85.158.92, session=<Qe8o5ZZFd9Nb5qjg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.100
country_id: 6252001
description:
Dec 10 16:27:35 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.100, lip=66.85.158.92, session=<SdpX5ZZFjdZb5qhk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 16:28:15 host2 sshd[2400355]: Disconnected from invalid user user 2.57.121.25 port 32929 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-10 16:34:15 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:55657: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-10 16:34:33 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:36871: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-10 16:34:52 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:35110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-10 16:34:58 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:46400: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-10 16:35:27 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:39097: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-10 16:36:02 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:38987: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-10 16:37:42 dovecot_login authenticator failed for ([172.82.64.201]) [172.82.64.201]:48772: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-10 16:37:28 dovecot_login authenticator failed for ([182.79.136.105]) [122.187.60.126]:33532: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-10 16:41:00 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:46982: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-10 16:41:31 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:39536: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-10 16:41:41 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:49928: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.74.192.200
country_id: 2186224
description:
2025-12-10 16:41:44 dovecot_login authenticator failed for ([202.74.192.200]) [202.74.192.200]:55251: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.197.200.26
country_id: 1269750
description:
2025-12-10 16:42:11 dovecot_login authenticator failed for (abts-north-dynamic-014.127.163.122.airtelbroadband.in) [117.197.200.26]:31453: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-10 16:42:51 dovecot_login authenticator failed for ([149.54.62.26]) [149.54.62.26]:59972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-10 16:42:55 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:29742: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-10 16:43:36 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:46069: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-10 16:43:51 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:40656: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-10 16:43:06 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:32916: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-10 16:43:18 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:44444: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-10 16:49:06 dovecot_login authenticator failed for a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:39322: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-10 16:49:23 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:59154: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Dec 10 16:52:38 host2 sshd[2422897]: Disconnected from invalid user xu 46.24.47.94 port 46976 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-10 16:52:46 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:60386: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-10 16:52:06 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:34950: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-10 16:52:06 dovecot_login authenticator failed for ([182.95.227.70]) [182.95.227.70]:35364: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-10 16:52:21 dovecot_login authenticator failed for ([116.72.9.151]) [116.72.9.151]:55568: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec 10 16:53:14 host2 pure-ftpd[2423414]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec 10 16:53:14 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kv8NQZdFtrszn+p2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.82.126.193
country_id: 1269750
description:
Dec 10 16:53:37 host2 sshd[2423658]: Disconnected from invalid user kamil 183.82.126.193 port 48072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.24.47.94
country_id: 2510769
description:
Dec 10 16:53:52 host2 sshd[2423863]: Disconnected from invalid user odoo15 46.24.47.94 port 44374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.82.126.193
country_id: 1269750
description:
Dec 10 16:54:17 host2 sshd[2424581]: Disconnected from invalid user guest 183.82.126.193 port 34408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.186.133.164
country_id: 298795
description:
Dec 10 16:54:34 host2 sshd[2424873]: Disconnected from invalid user user001 78.186.133.164 port 42644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.82.126.193
country_id: 1269750
description:
Dec 10 16:55:36 host2 sshd[2425781]: Disconnected from invalid user king 183.82.126.193 port 35290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Dec 10 16:55:49 host2 sshd[2425987]: Disconnected from invalid user server 46.24.47.94 port 54594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.186.133.164
country_id: 298795
description:
Dec 10 16:55:53 host2 sshd[2426096]: Disconnected from invalid user ubuntu 78.186.133.164 port 55537 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.82.126.193
country_id: 1269750
description:
Dec 10 16:56:16 host2 sshd[2426496]: Disconnected from invalid user donald 183.82.126.193 port 49852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Dec 10 16:56:29 host2 sshd[2426691]: Disconnected from invalid user bot-user 46.24.47.94 port 39176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Dec 10 16:56:04 host2 sshd[2426361]: Disconnected from invalid user phil 198.46.249.175 port 54944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Dec 10 16:57:14 host2 sshd[2427326]: Disconnected from invalid user remote 198.46.249.175 port 42572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.103.243
country_id: 3469034
description:
2025-12-10 16:57:34 dovecot_login authenticator failed for ([191.102.75.65]) [38.43.103.243]:40914: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.186.133.164
country_id: 298795
description:
Dec 10 16:57:48 host2 sshd[2427796]: Disconnected from invalid user hz 78.186.133.164 port 18380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-10 16:57:53 dovecot_login authenticator failed for ([218.156.93.206]) [182.95.222.202]:38222: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-10 16:58:33 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:42318: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-10 16:58:09 dovecot_login authenticator failed for ([27.123.111.110]) [27.123.111.110]:55684: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.249.175
country_id: 6252001
description:
Dec 10 16:58:19 host2 sshd[2428281]: Disconnected from invalid user md 198.46.249.175 port 57026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.186.133.164
country_id: 298795
description:
Dec 10 16:58:25 host2 sshd[2428375]: Disconnected from invalid user userroot 78.186.133.164 port 24828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-10 16:58:36 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:54470: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-10 16:58:49 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:58672: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.21
country_id: 6252001
description:
2025-12-10 16:58:50 dovecot_login authenticator failed for ([98.181.44.21]) [98.181.44.21]:32991: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.46.249.175
country_id: 6252001
description:
Dec 10 17:00:28 host2 sshd[2430703]: Received disconnect from 198.46.249.175 port 33888:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Dec 10 17:01:30 host2 sshd[2431528]: Disconnected from invalid user user1 198.46.249.175 port 47436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-10 17:02:48 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:46799: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-12-10 17:03:22 dovecot_login authenticator failed for ([207.188.158.216]) [207.188.158.216]:7455: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.224
country_id: 1880251
description:
Dec 10 17:03:36 host2 sshd[2433318]: Disconnected from invalid user vncuser 45.78.228.224 port 38562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 17:04:22 host2 sshd[2434077]: Disconnected from invalid user admin 2.57.121.112 port 64766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-10 17:04:26 dovecot_plain authenticator failed for (frevis) [62.73.121.209]:42807: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-10 17:04:28 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (noming) [73.129.57.71]:44198: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-10 17:05:18 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:36748: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-10 17:05:41 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:39884: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Dec 10 17:05:53 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, TLS, session=<ReBWbpdFaMgDU5En>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.224
country_id: 1880251
description:
Dec 10 17:06:59 host2 sshd[2436356]: Disconnected from invalid user xu 45.78.228.224 port 47552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-10 17:07:59 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:3481: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-10 17:08:18 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:48538: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-10 17:08:25 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:60772: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-10 17:08:38 dovecot_login authenticator failed for ([102.38.3.179]) [102.38.3.179]:51880: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 17:09:40 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (reaceily) [51.195.117.220]:21639: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-10 17:10:07 dovecot_login authenticator failed for (abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:54224: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-10 17:11:19 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (glize) [69.142.126.37]:43296: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.224
country_id: 1880251
description:
Dec 10 17:12:49 host2 sshd[2441173]: Disconnected from invalid user testuser 45.78.228.224 port 57600 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.38
country_id: 3996063
description:
2025-12-10 17:14:15 dovecot_login authenticator failed for (187.161.136.38-clientes-izzi.mx) [187.161.136.38]:53194: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-12-10 17:14:41 dovecot_login authenticator failed for ([36.64.211.93]) [191.59.214.168]:55492: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-10 17:15:08 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:32873: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-12-10 17:17:09 dovecot_plain authenticator failed for (bimous) [87.121.76.190]:50172: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-10 17:24:51 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:55942: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-12-10 17:24:36 dovecot_login authenticator failed for ([152.52.197.174]) [152.52.197.174]:49024: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-10 17:25:50 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (supped) [73.213.237.28]:54068: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 17:26:46 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (pingarati) [51.195.117.220]:18048: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-10 17:29:05 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:39332: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-10 17:28:51 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:37863: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-10 17:29:39 dovecot_plain authenticator failed for (propherate) [24.93.140.162]:42767: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-10 17:30:36 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:38524: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-10 17:30:56 dovecot_login authenticator failed for ([128.185.243.163]) [182.95.119.118]:57948: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 17:31:59 host2 sshd[2458765]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.9
country_id: 2750405
description:
Dec 10 17:31:41 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.9, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2vCTypdF4pRV2YwJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-10 17:32:19 dovecot_plain authenticator failed for (fausle) [65.20.133.208]:44408: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.103.23.6
country_id: 3077311
description:
2025-12-10 17:32:23 dovecot_plain authenticator failed for 88-103-23-6.rci.o2.cz (behelly) [88.103.23.6]:35376: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.226.61.95
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.226.61.95: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-10 17:33:21 dovecot_plain authenticator failed for (clene) [102.53.15.17]:44200: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-10 17:33:32 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:43688: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-10 17:33:41 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:52096: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-12-10 17:33:55 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:34630: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2025-12-10 17:33:57 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:49772: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2025-12-10 17:34:52 dovecot_login authenticator failed for ([125.21.200.57]) [128.185.219.54]:42874: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-10 17:35:06 dovecot_login authenticator failed for ([125.20.245.194]) [125.20.245.194]:51532: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 17:35:54 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (feudord) [96.230.65.90]:51722: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-10 17:36:34 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53254: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 17:39:57 host2 sshd[2465930]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-10 17:39:37 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:36355: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-10 17:40:01 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:38442: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-10 17:39:23 dovecot_plain authenticator failed for (dipingst) [24.93.140.162]:49856: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.103.23.6
country_id: 3077311
description:
2025-12-10 17:39:27 dovecot_plain authenticator failed for 88-103-23-6.rci.o2.cz (vocon) [88.103.23.6]:57922: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-12-10 17:40:38 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:45410: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-10 17:41:15 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:42968: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.197.68
country_id: 6252001
description:
Dec 10 17:43:01 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.255.197.68, lip=66.85.158.91, TLS: Connection closed, session=<lGof85dFnt6t/8VE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.195.215.176
country_id: 6252001
description:
Dec 10 17:44:39 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=194.195.215.176, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<dvL8+JdFFoHCw9ew>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 17:45:44 host2 sshd[2472056]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.152.144.183
country_id: 6252001
description:
2025-12-10 17:46:15 dovecot_plain authenticator failed for ([89.116.164.85]) [47.152.144.183]:45610: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.71.45.80
country_id: 3469034
description:
2025-12-10 17:46:27 dovecot_plain authenticator failed for 201-71-45-80.static.sumicity.net.br ([89.116.164.85]) [201.71.45.80]:54748: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.20.240.65
country_id: 3895114
description:
2025-12-10 17:46:40 dovecot_plain authenticator failed for 190-20-240-65.fo.baf.movistar.cl ([89.116.164.85]) [190.20.240.65]:56442: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2025-12-10 17:49:59 dovecot_login authenticator failed for ([103.130.207.227]) [103.130.207.227]:35092: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-10 17:49:59 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:45076: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-12-10 17:50:04 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:35850: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-10 17:50:11 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:47935: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-10 17:50:13 dovecot_login authenticator failed for ([125.17.205.185]) [182.95.178.122]:55414: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-12-10 17:50:16 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:55126: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2025-12-10 17:50:29 dovecot_login authenticator failed for ([49.124.152.247]) [49.124.152.247]:56308: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.105
country_id: 3017382
description:
Dec 10 17:51:13 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=91.231.89.105, lip=66.85.158.92, session=<x1ZtEJhFWeNb51lp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.2
country_id: 3017382
description:
Dec 10 17:51:38 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.2, lip=66.85.158.92, session=<HiDwEZhFEY9b51kC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.0
country_id: 3017382
description:
Dec 10 17:51:41 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.0, lip=66.85.158.92, session=<TpUiEphFmclb51kA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.143.206
country_id: 690791
description:
Dec 10 17:52:18 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=37.221.143.206, lip=66.85.158.91, TLS, session=<QPJLE5hFEq4l3Y/O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.223
country_id: 3469034
description:
Dec 10 17:52:39 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=186.209.249.223, lip=66.85.158.91, TLS, session=<TZpwFJhFrb+60fnf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 17:53:39 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:30798: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-12-10 17:53:54 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:35680: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-10 17:55:56 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (tichenclas) [174.166.153.20]:60174: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-10 17:56:24 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:52922: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-10 17:58:05 dovecot_plain authenticator failed for (tainish) [102.53.15.18]:57929: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-10 17:58:46 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (unmaze) [68.193.149.88]:58310: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.143
country_id: 3996063
description:
2025-12-10 17:58:51 dovecot_login authenticator failed for (201.173.216.143-clientes-izzi.mx) [201.173.216.143]:59473: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-10 17:59:20 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:55428: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-10 17:59:24 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:50549: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-12-10 17:59:21 dovecot_login authenticator failed for ([125.23.125.209]) [122.187.59.26]:54112: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-12-10 18:00:21 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:59939: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-12-10 18:00:33 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:48728: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-10 18:04:57 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:53534: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 50.116.26.161
country_id: 6252001
description:
Dec 10 18:05:12 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=50.116.26.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<G291QphFKrQydBqh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2025-12-10 18:05:27 dovecot_login authenticator failed for ([102.23.242.223]) [102.23.242.223]:48941: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2025-12-10 18:05:42 dovecot_login authenticator failed for (184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:34854: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-10 18:05:57 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:35956: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 10 18:08:25 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xBHxTZhFdsnUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-10 18:09:06 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (duatiggele) [98.40.101.10]:50336: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.236.199.102
country_id: 6252001
description:
2025-12-10 18:10:12 dovecot_plain authenticator failed for ec2-54-236-199-102.compute-1.amazonaws.com (EC2AMAZ-SNCQLK3.ec2.internal) [54.236.199.102]:60990: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.205.164.120
country_id: 6252001
description:
Dec 10 18:11:31 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=67.205.164.120, lip=66.85.158.92, TLS: Connection closed, session=<gFkQWZhFhsZDzaR4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.101.99
country_id: 2635167
description:
Dec 10 18:12:38 host2 sshd[2496832]: Disconnected from invalid user ftpadmin 92.27.101.99 port 42132 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.98
country_id: 1643084
description:
Dec 10 18:13:12 host2 sshd[2497356]: Disconnected from invalid user vpn 202.51.214.98 port 54034 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.179.97
country_id: 6252001
description:
Dec 10 18:13:20 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=147.182.179.97, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<eRyRX5hFJJKTtrNh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.101.99
country_id: 2635167
description:
Dec 10 18:13:50 host2 sshd[2497961]: Disconnected from invalid user flw 92.27.101.99 port 39360 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-10 18:14:34 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (prosesing) [76.97.155.25]:36112: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.197.200.26
country_id: 1269750
description:
2025-12-10 18:16:02 dovecot_login authenticator failed for (abts-north-dynamic-014.127.163.122.airtelbroadband.in) [117.197.200.26]:9756: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.187.244.59
country_id: 3017382
description:
Dec 10 18:16:08 host2 sshd[2500340]: Disconnected from invalid user username 37.187.244.59 port 54964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-10 18:16:21 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:35978: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.187.244.59
country_id: 3017382
description:
Dec 10 18:17:51 host2 sshd[2502060]: Disconnected from invalid user flw 37.187.244.59 port 36106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.27.101.99
country_id: 2635167
description:
Dec 10 18:17:48 host2 sshd[2502017]: Disconnected from invalid user bvpn 92.27.101.99 port 43784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.101.99
country_id: 2635167
description:
Dec 10 18:18:20 host2 sshd[2502570]: Disconnected from invalid user chen 92.27.101.99 port 56514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
country_id: 3175395
description:
2025-12-10 18:19:07 dovecot_login authenticator failed for ([151.3.178.94]) [151.3.178.94]:55676: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.3.21.236
country_id: 1269750
description:
2025-12-10 18:19:18 dovecot_login authenticator failed for ([61.3.21.236]) [61.3.21.236]:54911: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2025-12-10 18:19:37 dovecot_login authenticator failed for (host-129.0.111.246.mtn.cm) [129.0.111.246]:51757: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.187.244.59
country_id: 3017382
description:
Dec 10 18:19:42 host2 sshd[2503899]: Disconnected from invalid user bvpn 37.187.244.59 port 36888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-10 18:20:19 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:48115: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-10 18:21:01 dovecot_plain authenticator failed for (sumance) [199.192.123.12]:58804: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.38.193.48
country_id: 3017382
description:
Dec 10 18:21:45 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=54.38.193.48, lip=66.85.158.91, TLS: Connection closed, session=<5T+mfZhFt8Q2JsEw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 10 18:21:38 host2 sshd[2505878]: Disconnected from invalid user admin 192.210.233.234 port 39238 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.38.193.48
country_id: 3017382
description:
Dec 10 18:22:10 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=54.38.193.48, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DzAff5hFLoI2JsEw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-10 18:23:05 dovecot_plain authenticator failed for (phantus) [5.31.15.108]:37555: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.28.101.14
country_id: 3865483
description:
Dec 10 18:24:28 host2 sshd[2508429]: Disconnected from invalid user test 181.28.101.14 port 49406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-10 18:24:45 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:36298: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 10 18:24:18 host2 sshd[2508282]: Disconnected from invalid user rodrigo 78.89.154.59 port 55410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-12-10 18:24:33 dovecot_login authenticator failed for ([217.26.194.79]) [217.26.194.79]:55568: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 10 18:24:47 host2 sshd[2508702]: Disconnected from invalid user olivier 192.210.233.234 port 33098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-12-10 18:24:52 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:60596: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.28.101.14
country_id: 3865483
description:
Dec 10 18:25:12 host2 sshd[2509258]: Disconnected from invalid user admin 181.28.101.14 port 48786 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.16
country_id: 2750405
description:
Dec 10 18:25:20 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.16, lip=66.85.158.91, TLS: Connection closed, session=<8pp0iphF15lV2YwQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-10 18:25:23 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:43464: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 10 18:25:55 host2 sshd[2510036]: Disconnected from invalid user kafka 192.210.233.234 port 46766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-10 18:26:15 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:40725: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-10 18:26:17 dovecot_plain authenticator failed for (sentid) [65.20.164.137]:41000: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 10 18:26:27 host2 sshd[2510587]: Disconnected from invalid user db2inst1 192.210.233.234 port 51616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.28.101.14
country_id: 3865483
description:
Dec 10 18:26:38 host2 sshd[2510741]: Disconnected from invalid user xg 181.28.101.14 port 59578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-10 18:27:15 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:56180: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.28.101.14
country_id: 3865483
description:
Dec 10 18:27:21 host2 sshd[2511577]: Disconnected from invalid user kafka 181.28.101.14 port 38150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-10 18:27:38 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:38995: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.83.174.27
country_id: 6252001
description:
2025-12-10 18:28:01 dovecot_plain authenticator failed for ([89.116.164.85]) [75.83.174.27]:35576: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.83.174.27
country_id: 6252001
description:
2025-12-10 18:28:07 dovecot_login authenticator failed for ([89.116.164.85]) [75.83.174.27]:35576: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.137.82.143
country_id: 1643084
description:
2025-12-10 18:28:14 dovecot_plain authenticator failed for ([89.116.164.85]) [110.137.82.143]:3313: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.234.72.252
country_id: 2661886
description:
2025-12-10 18:28:27 dovecot_plain authenticator failed for c-5eea48fc-74736162.cust.telenor.se ([89.116.164.85]) [94.234.72.252]:11055: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 18:28:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (phluatol) [87.103.126.54]:20540: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 10 18:29:11 host2 sshd[2513281]: Disconnected from invalid user a 78.89.154.59 port 48308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.206
country_id: 1269750
description:
2025-12-10 18:30:54 dovecot_login authenticator failed for (nsg-static-113.51.72.182.airtel.in) [182.95.63.206]:46874: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 10 18:30:59 host2 sshd[2515154]: Disconnected from invalid user spring 78.89.154.59 port 54506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-10 18:31:09 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:53470: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-10 18:31:21 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:46620: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-12-10 18:31:38 dovecot_login authenticator failed for (c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:48342: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-12-10 18:31:41 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:63211: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Dec 10 18:31:54 host2 sshd[2516093]: Disconnected from invalid user vishal 78.89.154.59 port 53206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 18:31:57 host2 sshd[2516122]: Disconnected from invalid user admin 2.57.121.112 port 37739 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.54
country_id: 2186224
description:
2025-12-10 18:32:02 dovecot_login authenticator failed for ([121.73.162.54]) [121.73.162.54]:48916: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-12-10 18:32:16 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:55806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-10 18:32:40 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:49302: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 10 18:32:49 host2 sshd[2517021]: Disconnected from invalid user master 78.89.154.59 port 48510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 10 18:33:14 host2 sshd[2517526]: Disconnected from invalid user alex 20.123.146.92 port 56624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 10 18:37:22 host2 sshd[2521258]: Disconnected from invalid user test 4.210.186.201 port 19468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Dec 10 18:40:18 host2 sshd[2524002]: Disconnected from invalid user kafka 20.123.146.95 port 31634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 10 18:41:13 host2 sshd[2524859]: Disconnected from invalid user ekp 4.210.186.201 port 30446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-10 18:41:48 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:36464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-10 18:42:01 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:55734: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 10 18:42:11 host2 sshd[2525465]: Disconnected from invalid user olivier 4.210.186.201 port 64937 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 10 18:43:05 host2 sshd[2526229]: Disconnected from invalid user admin 20.123.146.92 port 11456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 10 18:44:01 host2 sshd[2526837]: Disconnected from invalid user db2inst1 20.123.146.92 port 4529 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.99.80.133
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 118.99.80.133 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-10 18:44:59 dovecot_plain authenticator failed for (atiouncary) [12.150.243.22]:19844: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.39.230
country_id: 3202326
description:
2025-12-10 18:45:27 dovecot_login authenticator failed for ([5.59.39.230]) [5.59.39.230]:56832: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-10 18:46:00 dovecot_plain authenticator failed for (nonsfing) [12.150.243.22]:61836: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-10 18:46:19 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:52282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-10 18:47:16 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:34552: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.176.50
country_id: 1861060
description:
2025-12-10 18:48:10 dovecot_login authenticator failed for p388051-obmd01.tokyo.ocn.ne.jp [60.45.176.50]:60409: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.81.222
country_id: 732800
description:
Dec 10 18:48:25 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=109.107.81.222, lip=66.85.158.91, TLS, session=<jKoD3JhFMetta1He>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.134
country_id: 798544
description:
Dec 10 18:48:43 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.228.33.134, lip=66.85.158.91, TLS, session=<XOIX3ZhFeLZb5CGG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Dec 10 18:48:57 host2 sshd[2531753]: Disconnected from invalid user qadmin 20.123.146.94 port 8539 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-10 18:49:56 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:48382: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-10 18:50:49 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:51278: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-10 18:51:00 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:54930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-10 18:50:13 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:51971: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-10 18:50:26 dovecot_login authenticator failed for (88.255.189.21.static.ttnet.com.tr) [88.255.189.21]:58380: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-12-10 18:50:40 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:58827: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.198.85.153
country_id: 1168579
description:
2025-12-10 18:51:07 dovecot_plain authenticator failed for ([192.168.43.99]) [154.198.85.153]:41546: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Dec 10 18:51:45 host2 sshd[2534216]: Disconnected from invalid user ubuntu 20.123.146.95 port 34700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-10 18:52:38 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:34143: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-12-10 18:52:12 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:44106: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 10 18:52:30 host2 sshd[2534883]: Disconnected from invalid user pentaho 4.210.186.201 port 36864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 18:53:44 host2 sshd[2535810]: Disconnected from invalid user guest 62.60.131.157 port 50225 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Dec 10 18:53:58 host2 sshd[2536043]: Disconnected from invalid user eric 20.123.146.94 port 42700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-10 18:57:47 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:39070: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.153.179
country_id: 3469034
description:
2025-12-10 18:57:57 dovecot_plain authenticator failed for ([89.116.164.85]) [45.182.153.179]:55504: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-10 18:58:10 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:54773: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 18:57:33 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<x3qP/ZhFqqIXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.143.20.110
country_id: 6252001
description:
2025-12-10 18:57:38 dovecot_login authenticator failed for ([89.116.164.85]) [24.143.20.110]:47088: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.74.148.101
country_id: 2802361
description:
2025-12-10 18:57:44 dovecot_plain authenticator failed for 101.148-74-193.fia-dyn.isp.proximus.be ([89.116.164.85]) [193.74.148.101]:52422: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Dec 10 18:59:27 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.92, TLS, session=<0m57BJlFlBKs7ORz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-10 19:02:21 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (subly) [174.169.224.27]:38610: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-10 19:04:29 dovecot_login authenticator failed for ([180.94.76.126]) [103.67.152.201]:35510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.159.132
country_id: 3865483
description:
2025-12-10 19:05:13 dovecot_login authenticator failed for ([72.37.217.1]) [190.185.159.132]:41560: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-10 19:07:04 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:55244: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-12-10 19:07:24 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:57298: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.252
country_id: 1733045
description:
2025-12-10 19:07:43 dovecot_login authenticator failed for ([49.124.150.252]) [49.124.150.252]:56764: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 19:07:42 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<dpzWIZlFjo0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-10 19:08:00 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:35618: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 10 19:10:19 host2 sshd[2552533]: Disconnected from invalid user ampal 107.174.41.51 port 50620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.155.28
country_id: 1643084
description:
2025-12-10 19:11:57 dovecot_login authenticator failed for ([103.87.155.27]) [103.87.155.28]:55215: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-10 19:12:05 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:46908: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.198.35.3
country_id: 1694008
description:
2025-12-10 19:12:13 dovecot_login authenticator failed for ([112.198.35.3]) [112.198.35.3]:39308: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-10 19:11:37 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3749: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-10 19:11:40 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:55315: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-10 19:11:42 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:56218: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-10 19:11:52 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:32826: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-10 19:12:38 dovecot_login authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:33301: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-10 19:12:48 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:39598: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.78.2.19
country_id: 1269750
description:
2025-12-10 19:13:04 dovecot_plain authenticator failed for (648A5DR0V5VM) [106.78.2.19]:6680: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.163.8.156
country_id: 798544
description:
Dec 10 19:15:04 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=81.163.8.156, lip=66.85.158.91, TLS, session=<BjhZO5lF1ttRowic>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 10 19:15:22 host2 sshd[2556346]: Disconnected from invalid user ismail 107.174.41.51 port 50748 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.104
country_id: 3469034
description:
Dec 10 19:15:24 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=138.186.197.104, lip=66.85.158.91, TLS, session=<MEpuPJlFitqKusVo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 10 19:15:34 host2 sshd[2556437]: Disconnected from invalid user ismail 146.59.95.254 port 32818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-10 19:15:35 dovecot_plain authenticator failed for (brour) [65.20.148.194]:54780: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.52.221.61
country_id: 3508796
description:
Dec 10 19:15:37 host2 sshd[2556489]: Disconnected from invalid user palworld 177.52.221.61 port 59190 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 10 19:16:00 host2 sshd[2556650]: Disconnected from invalid user admin 107.174.41.51 port 50804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.52.221.61
country_id: 3508796
description:
Dec 10 19:17:03 host2 sshd[2557269]: Disconnected from invalid user admin 177.52.221.61 port 43172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-10 19:17:12 dovecot_login authenticator failed for ([27.123.113.10]) [27.123.113.10]:52856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.41.51
country_id: 6252001
description:
Dec 10 19:16:39 host2 sshd[2557054]: Disconnected from invalid user audit 107.174.41.51 port 50858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 10 19:16:52 host2 sshd[2557136]: Disconnected from invalid user vnc 146.59.95.254 port 54392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-10 19:17:24 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:37986: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 10 19:17:29 host2 sshd[2557527]: Disconnected from invalid user wesley 146.59.95.254 port 37064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-10 19:17:40 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:52488: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.52.221.61
country_id: 3508796
description:
Dec 10 19:17:42 host2 sshd[2557739]: Disconnected from invalid user administrator 177.52.221.61 port 35814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-10 19:18:29 dovecot_login authenticator failed for (201.173.92.229-clientes-izzi.mx) [201.173.92.229]:60618: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 10 19:18:40 host2 sshd[2558699]: Disconnected from invalid user elise 146.59.95.254 port 60092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2025-12-10 19:19:00 dovecot_login authenticator failed for ([41.59.99.40]) [41.59.99.40]:37494: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.132.164.17
country_id: 2635167
description:
Dec 10 19:22:03 host2 sshd[2561313]: Disconnected from invalid user admin 23.132.164.17 port 43292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-10 19:24:13 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:49714: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-10 19:23:51 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:38576: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2025-12-10 19:24:24 dovecot_login authenticator failed for ([147.235.226.154]) [147.235.226.154]:58852: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.44
country_id: 6252001
description:
2025-12-10 19:24:36 dovecot_login authenticator failed for ([98.181.46.44]) [98.181.46.44]:52294: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 19:24:38 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (difixic) [87.103.126.54]:6417: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 19:27:03 host2 sshd[2565206]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Dec 10 19:32:27 host2 sshd[2568861]: Disconnected from invalid user soporte 24.199.117.9 port 58778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Dec 10 19:34:21 host2 sshd[2569907]: Disconnected from invalid user support 24.199.117.9 port 54550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-10 19:34:10 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:44258: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.179.36
country_id: 2510769
description:
2025-12-10 19:34:20 dovecot_login authenticator failed for 36.red-80-29-179.dynamicip.rima-tde.net [80.29.179.36]:57313: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.199.117.9
country_id: 6252001
description:
Dec 10 19:35:34 host2 sshd[2570752]: Disconnected from invalid user confluence 24.199.117.9 port 60392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Dec 10 19:37:46 host2 sshd[2571989]: Disconnected from invalid user mayuri 24.199.117.9 port 59516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-10 19:38:22 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:54684: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 10 19:39:11 host2 sshd[2573054]: Disconnected from invalid user gemini 35.237.94.18 port 33182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.7.34
country_id: 2464461
description:
2025-12-10 19:38:42 dovecot_login authenticator failed for ([102.110.7.34]) [102.110.7.34]:4463: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-10 19:39:27 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (gueternes) [73.224.171.101]:54496: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 19:40:50 host2 sshd[2574217]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 10 19:42:15 host2 sshd[2575080]: Disconnected from invalid user administrator 35.237.94.18 port 58744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-10 19:42:18 dovecot_plain authenticator failed for (grate) [65.20.191.12]:59591: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.7
country_id: 3996063
description:
2025-12-10 19:43:17 dovecot_login authenticator failed for (201.172.26.7-clientes-izzi.mx) [201.172.26.7]:47204: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 10 19:42:46 host2 sshd[2575342]: Disconnected from invalid user odoo 210.79.142.221 port 51230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 10 19:42:53 host2 sshd[2575423]: Disconnected from invalid user postgres 35.237.94.18 port 44396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-12-10 19:43:03 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:59780: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-10 19:43:08 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:51026: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-12-10 19:43:27 dovecot_login authenticator failed for cable-84-43-254-214.mnet.bg [84.43.254.214]:59775: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-12-10 19:43:40 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:43630: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-10 19:43:46 dovecot_login authenticator failed for ([182.95.63.10]) [182.95.63.10]:48800: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 10 19:44:06 host2 sshd[2576227]: Disconnected from invalid user andrey 35.237.94.18 port 43964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 10 19:44:13 host2 sshd[2576294]: Disconnected from invalid user quinn 210.79.142.221 port 43686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2025-12-10 19:44:28 dovecot_plain authenticator failed for c-98-196-209-55.hsd1.tx.comcast.net (enentarch) [98.196.209.55]:43614: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.206.98
country_id: 1269750
description:
2025-12-10 19:44:48 dovecot_login authenticator failed for ([103.148.206.98]) [103.148.206.98]:42249: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-10 19:44:27 dovecot_login authenticator failed for ([182.95.63.50]) [182.95.63.50]:46136: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 10 19:45:36 host2 sshd[2577332]: Disconnected from invalid user erp 210.79.142.221 port 41242 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Dec 10 19:46:11 host2 dovecot[1766329]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.92, TLS, session=<xuifq5lFUK/CpGsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.132
country_id: 3469034
description:
Dec 10 19:47:25 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.250.132, lip=66.85.158.91, TLS, session=<JPbfrplF7t660fqE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.216.30
country_id: 99237
description:
Dec 10 19:47:45 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=65.20.216.30, lip=66.85.158.91, TLS, session=<WocfsJlF0tNBFNge>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-10 19:49:32 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:50154: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-10 19:50:18 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (hypor) [81.225.30.107]:52662: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-10 19:50:20 dovecot_login authenticator failed for ([149.54.15.42]) [149.54.15.42]:45910: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-10 19:50:45 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:45552: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-10 19:51:00 dovecot_plain authenticator failed for (chete) [102.53.15.17]:46378: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.107.226.240
country_id: 3865483
description:
Dec 10 19:52:28 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=200.107.226.240, lip=66.85.158.91, TLS, session=<GO3xwJlFv5rIa+Lw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.224
country_id: 3175395
description:
Dec 10 19:52:48 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=185.15.170.224, lip=66.85.158.91, TLS, session=<ugk8wplFiOy5D6rg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.196.141
country_id: 1819730
description:
2025-12-10 19:59:44 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:52698: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-10 19:59:56 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:45038: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-10 20:00:05 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:44795: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-10 20:00:11 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:55092: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-10 20:00:35 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:55960: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.131.20
country_id: 99237
description:
Dec 10 20:00:49 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=65.20.131.20, lip=66.85.158.91, TLS, session=<56fx3plFVeVBFIMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.196
country_id: 3996063
description:
Dec 10 20:01:07 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=138.122.97.196, lip=66.85.158.91, TLS, session=<mf8G4JlFCZeKemHE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.250.78.191
country_id: 3686110
description:
2025-12-10 20:03:39 dovecot_login authenticator failed for (static-adsl190-250-78-191.une.net.co) [190.250.78.191]:65438: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-10 20:04:00 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:36393: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-10 20:07:06 dovecot_plain authenticator failed for (theed) [64.72.74.162]:42694: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.15.37
country_id: 1880251
description:
Dec 10 20:08:37 host2 sshd[2595821]: Disconnected from invalid user mininet 43.156.15.37 port 52978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2025-12-10 20:08:46 dovecot_login authenticator failed for ([87.200.93.86]) [87.200.93.86]:35352: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-10 20:08:51 dovecot_plain authenticator failed for (swanterges) [24.187.213.29]:52782: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.49
country_id: 3996063
description:
2025-12-10 20:08:58 dovecot_login authenticator failed for (187.161.198.49-clientes-izzi.mx) [187.161.198.49]:52596: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2025-12-10 20:09:07 dovecot_login authenticator failed for ([5.11.161.152]) [5.11.161.152]:36323: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-10 20:09:31 dovecot_login authenticator failed for ([182.79.136.105]) [122.187.60.126]:56402: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-10 20:09:30 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:34720: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-10 20:09:57 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.179]:53174: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 10 20:09:51 host2 sshd[2596637]: Disconnected from invalid user dev 103.243.27.122 port 57634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-10 20:10:02 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:53272: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.181
country_id: 3144096
description:
2025-12-10 20:10:09 dovecot_login authenticator failed for (181-162-97-62.cust.smartcall.no) [62.97.162.181]:40323: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 10 20:10:17 host2 sshd[2597157]: Disconnected from invalid user drcomadmin 107.172.146.104 port 57322 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 10 20:10:29 host2 sshd[2597267]: Disconnected from invalid user testmail 103.243.27.122 port 42142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.138
country_id: 1880251
description:
Dec 10 20:10:48 host2 sshd[2597729]: Disconnected from invalid user mininet 101.47.48.138 port 42676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-10 20:11:28 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (traterotic) [72.241.202.216]:49329: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 10 20:11:31 host2 sshd[2598474]: Disconnected from invalid user website 182.93.7.194 port 58146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 10 20:11:59 host2 sshd[2598789]: Disconnected from invalid user test 103.84.236.222 port 57980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 10 20:12:11 host2 sshd[2598995]: Disconnected from invalid user website 107.172.146.104 port 52204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 10 20:12:52 host2 sshd[2599493]: Disconnected from invalid user paul 103.243.27.122 port 36468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 10 20:13:00 host2 sshd[2599598]: Disconnected from invalid user intel 20.123.120.169 port 38982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 10 20:13:15 host2 sshd[2599865]: Disconnected from invalid user admin 182.93.7.194 port 36154 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 10 20:13:20 host2 sshd[2599943]: Disconnected from invalid user hamza 107.172.146.104 port 36790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 10 20:12:46 host2 sshd[2599421]: Disconnected from invalid user erp 107.172.146.104 port 45268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Dec 10 20:14:13 host2 sshd[2600618]: Disconnected from invalid user user01 89.216.92.113 port 52094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.23.199.85
country_id: 2029969
description:
Dec 10 20:13:44 host2 sshd[2600224]: Disconnected from invalid user dev 203.23.199.85 port 38935 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 10 20:13:54 host2 sshd[2600348]: Disconnected from invalid user newuser 107.172.146.104 port 44134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 10 20:14:06 host2 sshd[2600418]: Disconnected from invalid user guest 103.84.236.222 port 54358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Dec 10 20:14:50 host2 sshd[2600957]: Disconnected from invalid user wireguard 89.216.92.113 port 54596 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2025-12-10 20:15:16 dovecot_login authenticator failed for ([188.59.19.112]) [188.59.19.112]:33499: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Dec 10 20:15:17 host2 sshd[2601356]: Disconnected from invalid user sr 164.92.140.160 port 34090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.23.199.85
country_id: 2029969
description:
Dec 10 20:14:22 host2 sshd[2600694]: Disconnected from invalid user testmail 203.23.199.85 port 45224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 10 20:14:23 host2 sshd[2600703]: Disconnected from invalid user pay 160.242.96.43 port 35868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.97
country_id: 6252001
description:
Dec 10 20:15:13 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=162.216.149.97, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<vRpoE5pFXM6i2JVh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 10 20:14:30 host2 sshd[2600755]: Disconnected from invalid user wireguard 182.93.7.194 port 47922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.155
country_id: 1605651
description:
Dec 10 20:14:52 host2 sshd[2600969]: Disconnected from invalid user jasper 103.13.215.155 port 45550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.15.37
country_id: 1880251
description:
Dec 10 20:15:07 host2 sshd[2601227]: Disconnected from invalid user admin 43.156.15.37 port 56652 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.97
country_id: 6252001
description:
Dec 10 20:16:15 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.97, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IkUiF5pFWu2i2JVh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Dec 10 20:16:21 host2 sshd[2602140]: Disconnected from invalid user wireguard 164.92.140.160 port 33704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-10 20:15:46 dovecot_login authenticator failed for ([187.8.120.90]) [187.8.120.90]:54496: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-10 20:15:55 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:44827: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-12-10 20:15:55 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:17775: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-10 20:16:06 dovecot_login authenticator failed for ([178.150.135.19]) [178.150.135.19]:19732: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 10 20:15:49 host2 sshd[2601826]: Disconnected from invalid user wpyan 182.93.7.194 port 63260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 20:15:41 host2 sshd[2601588]: Disconnected from invalid user user 2.57.121.25 port 46161 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.67.39
country_id: 3996063
description:
2025-12-10 20:16:07 dovecot_login authenticator failed for ([201.160.67.39]) [201.160.67.39]:52045: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.216.92.113
country_id: 6290252
description:
Dec 10 20:15:24 host2 sshd[2601453]: Disconnected from invalid user deploy 89.216.92.113 port 42314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.155
country_id: 1605651
description:
Dec 10 20:15:37 host2 sshd[2601554]: Disconnected from invalid user mininet 103.13.215.155 port 43274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.236.222
country_id: 1269750
description:
Dec 10 20:16:57 host2 sshd[2602410]: Disconnected from invalid user jay 103.84.236.222 port 34810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Dec 10 20:16:59 host2 sshd[2602436]: Disconnected from invalid user test 89.216.92.113 port 44402 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Dec 10 20:16:39 host2 pure-ftpd[2602279]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.155
country_id: 1605651
description:
Dec 10 20:17:08 host2 sshd[2602527]: Disconnected from invalid user vpn 103.13.215.155 port 54270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.97
country_id: 6252001
description:
Dec 10 20:16:28 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.149.97, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<gk3kF5pFDOOi2JVh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Dec 10 20:17:59 host2 sshd[2603051]: Disconnected from invalid user user01 164.92.140.160 port 43244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 10 20:17:38 host2 sshd[2602874]: Disconnected from invalid user dspace 160.242.96.43 port 42668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Dec 10 20:18:29 host2 sshd[2603309]: Disconnected from invalid user erp 164.92.140.160 port 46900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 10 20:20:21 host2 sshd[2604512]: Disconnected from invalid user drcomadmin 64.227.176.54 port 58716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-12-10 20:21:08 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:40047: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 20:21:20 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (untumbromy) [51.195.117.220]:23948: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-10 20:20:49 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:52171: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-10 20:21:46 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:42810: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.48.138
country_id: 1880251
description:
Dec 10 20:22:04 host2 sshd[2605449]: Disconnected from invalid user marina 101.47.48.138 port 44676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.109.189.167
country_id: 6252001
description:
2025-12-10 20:22:29 dovecot_plain authenticator failed for (matess) [75.109.189.167]:60800: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.97
country_id: 6252001
description:
Dec 10 20:24:24 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.97, lip=66.85.158.91, TLS, session=<aJlENJpFdvGi2JVh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.56.146.136
country_id: 1269750
description:
2025-12-10 20:25:49 dovecot_plain authenticator failed for (CUF28CYXYG583UI9) [152.56.146.136]:27962: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-12-10 20:26:06 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:45740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-10 20:26:39 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:56108: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-10 20:26:30 dovecot_login authenticator failed for ([182.95.20.28]) [182.95.228.10]:40592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-10 20:27:26 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:52298: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.244
country_id: 6252001
description:
2025-12-10 20:27:43 dovecot_login authenticator failed for wsip-184-191-242-244.fv.ks.cox.net [184.191.242.244]:40792: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-12-10 20:27:49 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:33200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-10 20:29:05 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:60048: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.47.135.155
country_id: 2510769
description:
2025-12-10 20:29:18 dovecot_login authenticator failed for 155.red-83-47-135.dynamicip.rima-tde.net [83.47.135.155]:50671: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 10 20:29:22 host2 sshd[2610241]: Disconnected from invalid user system 202.165.22.246 port 56186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-10 20:28:29 dovecot_plain authenticator failed for (feroing) [65.20.160.107]:60037: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.80
country_id: 3017382
description:
Dec 10 20:28:38 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.80, lip=66.85.158.92, session=<J/JlQ5pFP89bxJhQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2025-12-10 20:28:56 dovecot_login authenticator failed for ([149.54.62.66]) [149.54.62.66]:45218: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.62
country_id: 3017382
description:
Dec 10 20:28:57 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.62, lip=66.85.158.92, session=<htWFRJpFP6xbxJg+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.63
country_id: 3017382
description:
Dec 10 20:28:26 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.63, lip=66.85.158.92, session=<Xm20QppFAYBbxJg/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.235.7.1
country_id: 3077311
description:
2025-12-10 20:28:32 dovecot_plain authenticator failed for customer7-1.airweb.cz (chmode) [109.235.7.1]:60782: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.86
country_id: 3017382
description:
Dec 10 20:28:53 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.86, lip=66.85.158.92, session=<zY1TRJpFm+pbxJhW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Dec 10 20:29:04 host2 pure-ftpd[2610090]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.96.169.244
country_id: 6252001
description:
2025-12-10 20:29:16 dovecot_login authenticator failed for ([192.96.169.244]) [192.96.169.244]:55003: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-10 20:29:36 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:50250: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-10 20:29:57 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:45862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 10 20:30:07 host2 sshd[2610899]: Disconnected from invalid user vpn 202.165.22.246 port 42218 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.47
country_id: 3017382
description:
Dec 10 20:30:18 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.47, lip=66.85.158.92, session=<UQNfSZpFs81bxJgv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-10 20:30:21 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:47455: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.100.255
country_id: 1269750
description:
2025-12-10 20:29:30 dovecot_login authenticator failed for ([113.193.53.56]) [103.181.100.255]:46414: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.66
country_id: 3017382
description:
Dec 10 20:30:30 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.66, lip=66.85.158.92, session=<lIAaSppFBcpbxJhC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.67
country_id: 3017382
description:
Dec 10 20:30:54 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.67, lip=66.85.158.92, session=<0+WCS5pFx9NbxJhD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.64
country_id: 3017382
description:
Dec 10 20:30:57 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.64, lip=66.85.158.92, session=<CS21S5pFGexbxJhA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 10 20:31:12 host2 sshd[2611960]: Disconnected from invalid user lorena 103.250.10.42 port 55380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.25.35.70
country_id: 732800
description:
Dec 10 20:31:49 host2 sshd[2612335]: Disconnected from invalid user admin 212.25.35.70 port 36710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 10 20:31:52 host2 sshd[2612309]: Disconnected from invalid user ak 202.165.22.246 port 42524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 10 20:33:12 host2 sshd[2613111]: Disconnected from invalid user student10 45.78.220.142 port 36302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.25.35.70
country_id: 732800
description:
Dec 10 20:32:32 host2 sshd[2612805]: Disconnected from invalid user rishabh 212.25.35.70 port 47376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 20:32:37 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<LOKGUZpFBpYXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.152.37
country_id: 1269750
description:
Dec 10 20:32:47 host2 sshd[2612950]: Disconnected from invalid user lorena 106.51.152.37 port 57694 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.152.37
country_id: 1269750
description:
Dec 10 20:34:17 host2 sshd[2613913]: Disconnected from invalid user oracle 106.51.152.37 port 34352 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-10 20:35:09 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:39827: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-10 20:35:13 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:49675: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.25.35.70
country_id: 732800
description:
Dec 10 20:34:26 host2 sshd[2614027]: Disconnected from invalid user postgres 212.25.35.70 port 50704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 20:34:45 host2 sshd[2614231]: Disconnected from invalid user  62.60.131.157 port 50010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-10 20:34:47 dovecot_login authenticator failed for (nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:39156: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.53.220.26
country_id: 1605651
description:
Dec 10 20:34:53 host2 sshd[2614313]: Disconnected from invalid user user 182.53.220.26 port 40286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-12-10 20:35:38 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:43384: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 10 20:35:47 host2 sshd[2615061]: Disconnected from invalid user rishabh 202.165.22.246 port 57378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-12-10 20:36:17 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:42510: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.25.35.70
country_id: 732800
description:
Dec 10 20:37:03 host2 sshd[2616224]: Disconnected from invalid user lorena 212.25.35.70 port 60708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.152.37
country_id: 1269750
description:
Dec 10 20:36:26 host2 sshd[2615678]: Disconnected from invalid user user01 106.51.152.37 port 51622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-10 20:36:37 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:49360: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-10 20:37:35 dovecot_plain authenticator failed for (mousole) [96.85.104.2]:55268: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 10 20:38:00 host2 sshd[2616869]: Disconnected from invalid user ak 103.250.10.42 port 46250 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.234
country_id: 6252001
description:
Dec 10 20:38:46 host2 pure-ftpd[2617323]: (?@198.235.24.234) [INFO] New connection from 198.235.24.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-10 20:40:55 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:51922: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.142
country_id: 1880251
description:
Dec 10 20:41:12 host2 sshd[2619394]: Disconnected from invalid user ubuntu 45.78.220.142 port 60854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-10 20:41:17 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:34805: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.25
country_id: 6252001
description:
2025-12-10 20:41:42 dovecot_login authenticator failed for ([72.214.133.25]) [72.214.133.25]:34105: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-10 20:41:54 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:47302: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.53.220.26
country_id: 1605651
description:
Dec 10 20:42:50 host2 sshd[2620319]: Disconnected from invalid user ftp1 182.53.220.26 port 45362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 10 20:44:08 host2 sshd[2621068]: Disconnected from invalid user publico 123.58.209.224 port 50648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.241.146
country_id: 6252001
description:
Dec 10 20:50:10 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.118.241.146, lip=66.85.158.92, session=<DIhtkJpFNocUdvGS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 10 20:49:56 host2 sshd[2625047]: Disconnected from invalid user csserver 123.58.209.224 port 52872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-10 20:51:18 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:49532: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 10 20:50:31 host2 sshd[2625592]: Disconnected from invalid user deployer 123.58.209.224 port 38704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-10 20:51:45 dovecot_login authenticator failed for (ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:39950: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.157
country_id: 6252001
description:
Dec 10 20:53:49 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.80.105.157, lip=66.85.158.91, session=<tKBznZpFcL4UUGmd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-10 20:55:50 dovecot_login authenticator failed for ([27.123.111.110]) [27.123.111.110]:47784: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-12-10 20:56:04 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:52210: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-12-10 21:00:35 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:60482: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-10 21:00:36 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:48216: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 21:00:37 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Qm6mtZpFPNIXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-10 21:00:47 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:44268: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-10 21:00:51 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:44058: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.142.55.40
country_id: 1861060
description:
2025-12-10 21:02:10 dovecot_login authenticator failed for 40.55.142.133.rev.iijmobile.jp [133.142.55.40]:34025: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-10 21:01:50 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:37202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-10 21:03:21 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:40944: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-10 21:02:55 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:51302: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-10 21:04:03 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:33786: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.142
country_id: 6252001
description:
Dec 10 21:06:17 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=162.216.149.142, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<c0MKyppF6Mii2JWO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-10 21:06:52 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:53298: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.142
country_id: 6252001
description:
Dec 10 21:07:12 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.142, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<X/xQzZpFFOGi2JWO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-10 21:06:37 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:42275: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-10 21:07:27 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:41087: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.142
country_id: 6252001
description:
Dec 10 21:07:31 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.142, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<oJZxzppF/POi2JWO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2025-12-10 21:07:44 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:55565: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.106.206.77
country_id: 6252001
description:
Dec 10 21:10:04 host2 pure-ftpd[2642499]: (?@20.106.206.77) [INFO] New connection from 20.106.206.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.124.173.207
country_id: 3996063
description:
2025-12-10 21:10:07 dovecot_plain authenticator failed for ([89.116.164.85]) [201.124.173.207]:41856: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.35
country_id: 798544
description:
Dec 10 21:10:22 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=178.216.28.35, lip=66.85.158.91, TLS, session=<BDew15pFCsey2Bwj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.148.42.126
country_id: 290291
description:
2025-12-10 21:09:44 dovecot_plain authenticator failed for ([89.116.164.85]) [89.148.42.126]:32243: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.69.1.98
country_id: 6252001
description:
2025-12-10 21:09:56 dovecot_plain authenticator failed for ([89.116.164.85]) [66.69.1.98]:38112: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.155
country_id: 798544
description:
Dec 10 21:10:39 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<info>, method=PLAIN, rip=109.125.244.155, lip=66.85.158.91, TLS, session=<uXXC2JpFgcVtffSb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-10 21:11:09 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:57806: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-10 21:11:57 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34986: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-10 21:12:15 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (carblest) [73.196.144.25]:48034: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-10 21:11:54 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:34765: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-12-10 21:17:20 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:60118: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-10 21:17:40 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:50823: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-10 21:21:32 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:51602: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2025-12-10 21:21:47 dovecot_login authenticator failed for ([125.19.220.30]) [125.19.220.30]:60478: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 21:21:58 host2 sshd[2654503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 21:23:47 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (stinge) [96.230.65.90]:42992: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 21:24:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (zounrapok) [87.103.126.54]:5165: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-10 21:26:27 dovecot_login authenticator failed for ([113.193.187.154]) [113.193.187.154]:43428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-10 21:26:40 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:39471: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-10 21:26:49 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:56973: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-10 21:26:56 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:34684: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-10 21:27:26 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:45588: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2025-12-10 21:27:49 dovecot_login authenticator failed for ([94.207.30.137]) [94.207.30.137]:56110: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-10 21:28:00 dovecot_login authenticator failed for (201.173.250.36-clientes-izzi.mx) [201.173.250.36]:58233: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-10 21:28:05 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:35412: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 21:30:35 host2 sshd[2663554]: Disconnected from invalid user user 2.57.121.25 port 9317 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-10 21:33:05 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (tomma) [68.82.141.145]:35582: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-10 21:33:08 dovecot_login authenticator failed for ([201.173.250.136]) [201.173.250.136]:53523: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-10 21:33:24 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:49732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-10 21:33:45 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:50934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-10 21:32:56 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:40636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 21:35:42 host2 sshd[2666987]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-12-10 21:39:45 dovecot_login authenticator failed for (2-55-68-141.orange.net.il) [2.55.68.141]:40394: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-10 21:39:50 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:39614: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 10 21:40:05 host2 sshd[2670878]: Disconnected from invalid user ubuntu 51.38.224.114 port 45184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-10 21:40:08 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:47954: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-12-10 21:40:17 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:37029: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-10 21:40:18 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:43429: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 10 21:40:59 host2 dovecot[2672060]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-10 21:41:26 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (momic) [73.168.136.150]:39678: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 21:41:29 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (listomist) [96.230.65.90]:34622: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-10 21:43:08 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:39848: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-10 21:43:22 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:34468: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 10 21:44:27 host2 sshd[2674475]: Disconnected from invalid user tunnel 45.197.145.10 port 47906 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 21:44:56 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JygsVJtFNOwXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 10 21:46:40 host2 sshd[2676254]: Disconnected from invalid user admin 51.38.224.114 port 55896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-12-10 21:47:14 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:39751: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 10 21:48:24 host2 sshd[2677947]: Disconnected from invalid user postgres 51.38.224.114 port 58294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 10 21:47:44 host2 sshd[2677099]: Disconnected from invalid user transfer 51.38.224.114 port 54364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 10 21:47:51 host2 sshd[2677179]: Disconnected from invalid user hadi 45.197.145.10 port 48170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-12-10 21:47:57 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:35542: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 10 21:48:55 host2 sshd[2678562]: Disconnected from invalid user niti 103.172.20.218 port 45406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.193.139
country_id: 1733045
description:
2025-12-10 21:51:48 dovecot_plain authenticator failed for ([89.116.164.85]) [124.13.193.139]:37097: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-10 21:52:00 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:59862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.185.133.139
country_id: 1269750
description:
2025-12-10 21:52:10 dovecot_plain authenticator failed for ([89.116.164.85]) [223.185.133.139]:23635: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.224.14.214
country_id: 99237
description:
2025-12-10 21:52:21 dovecot_plain authenticator failed for ([89.116.164.85]) [169.224.14.214]:64111: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-12-10 21:52:29 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:54619: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 10 21:52:32 host2 sshd[2694097]: Disconnected from invalid user ossadm 45.197.145.10 port 51322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.191.118
country_id: 3144096
description:
2025-12-10 21:52:33 dovecot_login authenticator failed for (cm-178.232.191.118.get.no) [178.232.191.118]:35076: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-12-10 21:53:02 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:41596: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-10 21:54:05 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (pentily) [73.145.107.251]:46058: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Dec 10 21:54:26 host2 sshd[2696060]: Disconnected from invalid user liyang 45.197.145.10 port 60724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 10 21:53:59 host2 sshd[2695245]: Disconnected from invalid user liyang 103.172.20.218 port 38882 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 10 21:55:01 host2 sshd[2696434]: Disconnected from invalid user prod 103.172.20.218 port 56608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-10 21:55:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65110: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 10 21:56:07 host2 sshd[2697519]: Disconnected from invalid user singh 103.172.20.218 port 46112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-10 21:58:07 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:50727: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-10 21:59:28 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:47062: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-10 21:58:46 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:37206: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-10 21:58:50 dovecot_login authenticator failed for ([95.164.177.6]) [95.164.177.6]:40588: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-10 21:59:05 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:54252: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-10 21:59:07 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:44977: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-10 21:59:41 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:57802: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.87.13.247
country_id: 1227603
description:
[2025-12-10 22:07:35 +0530] info [cpaneld] 103.87.13.247 - mathsmot "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2025-12-10 22:08:34 dovecot_login authenticator failed for (syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:38740: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-10 22:09:18 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:38148: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-10 22:12:53 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:36812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-10 22:13:09 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:37686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-10 22:15:43 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (trabilln) [68.82.141.145]:38446: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-10 22:15:54 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:59693: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-10 22:15:33 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:35052: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-12-10 22:17:48 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61971: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.21
country_id: 3996063
description:
2025-12-10 22:18:08 dovecot_login authenticator failed for (187.161.173.21-clientes-izzi.mx) [187.161.173.21]:52557: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2025-12-10 22:18:23 dovecot_login authenticator failed for ([182.95.226.138]) [182.95.226.138]:42420: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-10 22:18:35 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:59887: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-10 22:19:42 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:58831: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 22:19:49 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (arder) [51.195.117.220]:44042: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2025-12-10 22:20:05 dovecot_login authenticator failed for ([49.124.152.222]) [49.124.152.222]:39540: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.221.198.244
country_id: 6290252
description:
2025-12-10 22:21:14 dovecot_plain authenticator failed for 178-221-198-244.dynamic.isp.telekom.rs ([89.116.164.85]) [178.221.198.244]:59750: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.185.53.11
country_id: 1269750
description:
2025-12-10 22:20:54 dovecot_plain authenticator failed for ([89.116.164.85]) [223.185.53.11]:7382: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-10 22:21:07 dovecot_plain authenticator failed for (dismiac) [65.20.129.28]:37488: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-10 22:24:09 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 22:23:50 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (aciades) [87.103.126.54]:48783: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-10 22:23:55 dovecot_login authenticator failed for ([182.73.193.249]) [122.187.41.18]:46148: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.241
country_id: 6252001
description:
2025-12-10 22:24:52 dovecot_login authenticator failed for ([208.69.161.241]) [208.69.161.241]:44938: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-10 22:29:54 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (pologs) [174.166.153.20]:48896: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.132.164.17
country_id: 2635167
description:
Dec 10 22:33:33 host2 sshd[2729828]: Disconnected from invalid user admin 23.132.164.17 port 36644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-10 22:34:49 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:60009: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-10 22:35:09 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:47626: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-10 22:38:50 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:41610: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-10 22:39:09 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:43075: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-10 22:39:41 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:49164: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.78.163
country_id: 3469034
description:
Dec 10 22:42:04 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=177.190.78.163, lip=66.85.158.91, TLS, session=<dql5H5xFkbexvk6j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.64
country_id: 3996063
description:
2025-12-10 22:42:08 dovecot_login authenticator failed for (201.173.97.64-clientes-izzi.mx) [201.173.97.64]:35034: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.143
country_id: 798544
description:
Dec 10 22:42:22 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=178.219.105.143, lip=66.85.158.91, TLS, session=<uTetIJxFBOmy22mP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-10 22:41:47 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:33140: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-10 22:43:56 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:33389: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.196.80
country_id: 3996063
description:
2025-12-10 22:44:07 dovecot_login authenticator failed for ([201.173.196.80]) [201.173.196.80]:55380: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 22:45:00 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (bless) [51.195.117.220]:10428: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.16
country_id: 3996063
description:
2025-12-10 22:45:07 dovecot_login authenticator failed for (201.166.222.16-clientes-izzi.mx) [201.166.222.16]:51124: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-10 22:45:25 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:37706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-10 22:44:34 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:43412: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-12-10 22:44:52 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:58583: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.53
country_id: 1282988
description:
Dec 10 22:46:52 host2 sshd[2738588]: Disconnected from invalid user sonar 103.104.235.53 port 43569 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:48:15 host2 sshd[2739387]: Disconnected from invalid user taiko 91.240.15.18 port 57726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.20
country_id: 1643084
description:
Dec 10 22:47:36 host2 sshd[2739050]: Disconnected from invalid user david 103.250.11.20 port 34182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-10 22:48:09 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (gumudarres) [73.197.236.163]:43380: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Dec 10 22:49:42 host2 sshd[2740205]: Disconnected from invalid user deploy 154.72.233.36 port 44974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 10 22:49:45 host2 sshd[2740217]: Disconnected from invalid user dmdba 185.216.119.134 port 60396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-10 22:50:08 dovecot_login authenticator failed for (dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:55244: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-10 22:51:01 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:47306: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-12-10 22:50:29 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:40487: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-12-10 22:50:49 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:55972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Dec 10 22:50:48 host2 sshd[2741266]: Disconnected from invalid user taiko 154.72.233.36 port 44558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Dec 10 22:53:04 host2 sshd[2743135]: Disconnected from invalid user user 154.72.233.36 port 44654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 10 22:52:39 host2 sshd[2742800]: Disconnected from invalid user admin 193.187.148.79 port 44090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:52:52 host2 sshd[2742937]: Disconnected from invalid user mailtest 91.240.15.18 port 40056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:54:05 host2 sshd[2744029]: Disconnected from invalid user newuser 91.240.15.18 port 51642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 10 22:54:14 host2 sshd[2744236]: Disconnected from invalid user bitwarden 193.187.148.79 port 45492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.20
country_id: 1643084
description:
Dec 10 22:54:25 host2 sshd[2744391]: Disconnected from invalid user sonar 103.250.11.20 port 47126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-10 22:54:47 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (sconis) [73.13.220.220]:45052: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.20
country_id: 1643084
description:
Dec 10 22:55:00 host2 sshd[2745002]: Disconnected from invalid user deploy 103.250.11.20 port 50234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:55:19 host2 sshd[2745344]: Disconnected from invalid user deploy 91.240.15.18 port 59646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.11.20
country_id: 1643084
description:
Dec 10 22:56:14 host2 sshd[2746034]: Disconnected from invalid user user 103.250.11.20 port 48234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Dec 10 22:55:54 host2 sshd[2745752]: Disconnected from invalid user user 91.240.15.18 port 32830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.53
country_id: 1282988
description:
Dec 10 22:58:41 host2 sshd[2747557]: Disconnected from invalid user admin 103.104.235.53 port 58102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.53
country_id: 1282988
description:
Dec 10 23:00:00 host2 sshd[2748305]: Disconnected from invalid user taiko 103.104.235.53 port 42452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-10 23:00:59 dovecot_login authenticator failed for ([182.95.181.62]) [182.95.181.62]:48548: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.103.243
country_id: 3469034
description:
2025-12-10 23:01:20 dovecot_login authenticator failed for ([38.43.103.243]) [38.43.103.243]:43427: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.71
country_id: 6252001
description:
Dec 10 23:01:27 host2 pure-ftpd[2750014]: (?@198.235.24.71) [INFO] New connection from 198.235.24.71


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.104.235.53
country_id: 1282988
description:
Dec 10 23:03:50 host2 sshd[2752028]: Disconnected from invalid user mailtest 103.104.235.53 port 51841 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Dec 10 23:04:21 host2 sshd[2752379]: Disconnected from invalid user elk 197.248.8.33 port 38616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-10 23:05:00 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:57887: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-10 23:04:33 dovecot_login authenticator failed for ([182.95.228.110]) [182.95.228.110]:45630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 10 23:04:36 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, session=<+64ycZxFzt/Y2s5E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-10 23:06:04 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:50739: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.8.33
country_id: 192950
description:
Dec 10 23:07:15 host2 sshd[2755037]: Disconnected from invalid user paula 197.248.8.33 port 39938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Dec 10 23:06:30 host2 sshd[2754309]: Disconnected from invalid user connect 197.248.8.33 port 53732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Dec 10 23:08:45 host2 sshd[2755948]: Disconnected from invalid user aluno 197.248.8.33 port 40576 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 10 23:09:33 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS: Connection closed, session=<jDnegpxFOhRChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.174.85
country_id: 1643084
description:
2025-12-10 23:09:39 dovecot_login authenticator failed for ([36.92.174.85]) [36.92.174.85]:62086: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-12-10 23:09:42 dovecot_login authenticator failed for ([37.142.173.63]) [37.142.173.63]:58607: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-10 23:10:02 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:59850: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-12-10 23:10:02 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:46553: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-10 23:11:14 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:49460: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-10 23:11:27 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:50735: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 23:14:36 host2 sshd[2760336]: Disconnected from invalid user admin 2.57.121.112 port 64999 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:15:34 host2 sshd[2761166]: Disconnected from invalid user bench 146.190.112.196 port 47162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.60.13
country_id: 3469034
description:
2025-12-10 23:16:17 dovecot_login authenticator failed for clientes-60.13.dbug.com.br [177.10.60.13]:52072: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 23:16:51 host2 sshd[2762459]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-10 23:17:23 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (sardsorium) [98.204.134.124]:47830: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-10 23:16:31 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:3551: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-10 23:16:44 dovecot_login authenticator failed for 14-0-142-131.static.pccw-hkt.com [14.0.142.131]:32439: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-10 23:16:49 dovecot_plain authenticator failed for (demish) [65.20.147.45]:54991: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-10 23:16:55 dovecot_plain authenticator failed for (drutic) [65.20.160.107]:51475: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-12-10 23:17:03 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:46958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.214.74.238
country_id: 2750405
description:
Dec 10 23:19:49 host2 sshd[2764198]: Disconnected from invalid user mani 185.214.74.238 port 51384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:20:35 host2 sshd[2764903]: Disconnected from invalid user wang 146.190.112.196 port 37800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:21:41 host2 sshd[2765987]: Disconnected from invalid user mani 146.190.112.196 port 50368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:22:40 host2 sshd[2766810]: Disconnected from invalid user xq 146.190.112.196 port 35976 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-10 23:23:11 dovecot_plain authenticator failed for (auxing) [64.72.74.162]:49906: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.214.74.238
country_id: 2750405
description:
Dec 10 23:24:03 host2 sshd[2767770]: Disconnected from invalid user app 185.214.74.238 port 39764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 10 23:24:48 host2 sshd[2768245]: Disconnected from invalid user free 146.190.112.196 port 40210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-10 23:25:01 dovecot_plain authenticator failed for (wepsed) [24.187.213.29]:36894: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-12-10 23:26:49 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:50082: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-10 23:27:32 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:46046: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 10 23:29:45 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, session=<MJUjy5xFMNXY2s5D>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 23:30:34 host2 sshd[2772311]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-10 23:30:42 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:46412: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-10 23:35:24 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:34439: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-10 23:35:28 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:61257: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2025-12-10 23:35:42 dovecot_login authenticator failed for ([182.95.226.138]) [182.95.226.138]:56586: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.59
country_id: 6252001
description:
2025-12-10 23:35:57 dovecot_login authenticator failed for wsip-184-191-250-59.fv.ks.cox.net [184.191.250.59]:36106: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 23:35:59 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (surene) [87.103.126.54]:21101: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-10 23:36:39 dovecot_login authenticator failed for ([84.210.151.158]) [84.210.151.158]:38591: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-10 23:36:50 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:44706: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 23:37:47 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pyrest) [87.103.126.54]:27318: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-10 23:41:03 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:36634: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-10 23:41:54 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:51536: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-12-10 23:41:57 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:34014: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-10 23:42:19 dovecot_login authenticator failed for ([178.239.238.23]) [178.239.238.23]:52836: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-10 23:43:39 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (waudge) [37.150.8.174]:39847: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 23:45:22 host2 sshd[2783831]: Disconnected from invalid user  62.60.131.157 port 61354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2025-12-10 23:51:06 dovecot_login authenticator failed for ([110.172.147.190]) [110.172.147.190]:44439: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-10 23:51:44 dovecot_login authenticator failed for ([49.124.154.160]) [49.124.154.160]:43052: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 23:54:52 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (parophrall) [87.103.126.54]:20004: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-10 23:55:06 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:41804: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.187
country_id: 1733045
description:
2025-12-10 23:55:26 dovecot_login authenticator failed for ([49.124.148.187]) [49.124.148.187]:37556: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 23:58:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (gaschum) [87.103.126.54]:36668: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2025-12-10 23:59:45 dovecot_login authenticator failed for ([152.52.227.94]) [152.52.227.94]:39604: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.167.82.206
country_id: 6252001
description:
2025-12-10 23:59:55 dovecot_login authenticator failed for (syn-024-167-082-206.res.spectrum.com) [24.167.82.206]:47941: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-11 00:00:05 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:53186: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-11 00:00:16 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:54090: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-11 00:01:02 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:42746: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.167
country_id: 6252001
description:
Dec 11 00:01:06 host2 pure-ftpd[2796394]: (?@64.62.197.167) [INFO] New connection from 64.62.197.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-11 00:01:29 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:46958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 11 00:03:28 host2 pure-ftpd[2797866]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 11 00:03:29 host2 pure-ftpd[2797902]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 11 00:03:57 host2 sshd[2798258]: Disconnected from invalid user user 139.59.188.13 port 37384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 00:04:34 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (unprox) [51.195.117.220]:14055: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-11 00:06:05 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:48553: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-11 00:06:22 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:48102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 11 00:06:49 host2 sshd[2800355]: Disconnected from invalid user oleg 139.59.188.13 port 58670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.105.69.45
country_id: 1643084
description:
2025-12-11 00:06:56 dovecot_login authenticator failed for ([103.87.155.27]) [103.105.69.45]:59274: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-11 00:07:26 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.74]:36879: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.16.124
country_id: 2300660
description:
Dec 11 00:08:09 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=41.211.16.124, lip=66.85.158.91, TLS, session=<1EE6U51FGuYp0xB8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec 11 00:08:31 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GXjGVZ1F6FPY2s5C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.66
country_id: 3469034
description:
Dec 11 00:08:38 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info>, method=PLAIN, rip=186.209.248.66, lip=66.85.158.91, TLS, session=<fQ64VJ1Fbbu60fhC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.112.9
country_id: 3469034
description:
Dec 11 00:10:27 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.39.112.9, lip=66.85.158.91, TLS, session=<iYCAW51FVbmxJ3AJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 00:10:32 host2 sshd[2802943]: Disconnected from invalid user user 2.57.121.25 port 45797 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.173
country_id: 798544
description:
Dec 11 00:10:44 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=178.219.98.173, lip=66.85.158.91, TLS, session=<FQbAXJ1Fj6uy22Kt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-12-11 00:16:33 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:41252: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.248.127.243
country_id: 3865483
description:
2025-12-11 00:16:37 dovecot_login authenticator failed for ([207.248.127.243]) [207.248.127.243]:47523: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.217.70
country_id: 1269750
description:
2025-12-11 00:17:03 dovecot_login authenticator failed for ([203.129.217.70]) [203.129.217.70]:56835: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-11 00:17:59 dovecot_login authenticator failed for (industrianaval.fla.gvt.net.br) [187.58.66.231]:54436: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-11 00:17:18 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:47438: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-12-11 00:17:25 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:44374: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-12-11 00:17:36 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:57719: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-12-11 00:18:13 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:39400: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-12-11 00:20:20 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:53109: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.238.200.135
country_id: 1819730
description:
Dec 11 00:20:39 host2 sshd[2810381]: Disconnected from invalid user ubuntu 47.238.200.135 port 45408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-11 00:21:18 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:42124: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.88
country_id: 6252001
description:
Dec 11 00:22:36 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.88, lip=66.85.158.91, TLS handshaking: Connection closed, session=</gMmiJ1F9bVAPsVY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Dec 11 00:22:54 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Hp45iZ1F2iFAPsVN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:22:56 host2 sshd[2812158]: Disconnected from invalid user richard 115.186.223.102 port 46828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 00:23:41 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (poodlerier) [51.195.117.220]:14853: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Dec 11 00:24:18 host2 sshd[2813172]: Disconnected from invalid user ubuntu 43.166.242.149 port 54222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 11 00:24:37 host2 sshd[2813347]: Disconnected from invalid user vpn 115.85.80.12 port 50624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:25:18 host2 sshd[2813957]: Disconnected from invalid user centos 115.186.223.102 port 57042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-11 00:25:35 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:59366: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-12-11 00:25:34 dovecot_login authenticator failed for ([128.185.70.193]) [125.19.157.158]:54130: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-11 00:25:50 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:37998: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-11 00:26:47 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:55159: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.6
country_id: 1269750
description:
2025-12-11 00:27:03 dovecot_login authenticator failed for ([182.66.251.185]) [182.95.124.6]:43810: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-11 00:27:07 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:47525: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-11 00:26:23 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:59432: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 00:26:45 host2 sshd[2814750]: Disconnected from invalid user admin 2.57.121.112 port 52326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 11 00:28:07 host2 sshd[2815610]: Disconnected from invalid user teamspeak 115.85.80.12 port 57812 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-11 00:27:17 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (qiste) [73.208.81.125]:57078: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-11 00:27:30 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:55713: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.211.56.214
country_id: 2750405
description:
Dec 11 00:28:03 host2 sshd[2815567]: Disconnected from invalid user rke 172.211.56.214 port 46258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.111.53.48
country_id: 6252001
description:
Dec 11 00:27:27 host2 sshd[2815153]: Disconnected from invalid user sysuser 174.111.53.48 port 60974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:27:31 host2 sshd[2815171]: Disconnected from invalid user devops 115.186.223.102 port 39016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:28:15 host2 sshd[2815665]: Disconnected from invalid user sammy 115.186.223.102 port 51832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.111.53.48
country_id: 6252001
description:
Dec 11 00:28:37 host2 sshd[2815843]: Disconnected from invalid user ahmet 174.111.53.48 port 34202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 11 00:29:40 host2 sshd[2816354]: Disconnected from invalid user jenkins 115.85.80.12 port 53642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.186.223.102
country_id: 2077456
description:
Dec 11 00:29:45 host2 sshd[2816397]: Disconnected from invalid user demo 115.186.223.102 port 49226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.111.53.48
country_id: 6252001
description:
Dec 11 00:29:50 host2 sshd[2816445]: Disconnected from invalid user jenkins 174.111.53.48 port 40222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.211.56.214
country_id: 2750405
description:
Dec 11 00:30:50 host2 sshd[2817366]: Disconnected from invalid user admin 172.211.56.214 port 37148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 11 00:31:10 host2 sshd[2817564]: Disconnected from invalid user postgres 115.85.80.12 port 48894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-11 00:31:49 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:35636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-11 00:32:05 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:59102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.61
country_id: 3865483
description:
Dec 11 00:33:05 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.251.61, lip=66.85.158.91, TLS, session=<lHRwrJ1FyLyzAPs9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-11 00:32:38 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:34413: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.166
country_id: 3175395
description:
Dec 11 00:32:42 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.63.132.166, lip=66.85.158.91, TLS, session=<vSNLq51FpKC5P4Sm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-11 00:32:49 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:48390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.241.249.27
country_id: 1643084
description:
2025-12-11 00:33:45 dovecot_plain authenticator failed for ([89.116.164.85]) [180.241.249.27]:49084: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.80.43.47
country_id: 102358
description:
2025-12-11 00:33:59 dovecot_plain authenticator failed for ([89.116.164.85]) [178.80.43.47]:44118: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.125.209.68
country_id: 718075
description:
2025-12-11 00:34:13 dovecot_plain authenticator failed for ([89.116.164.85]) [79.125.209.68]:44686: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Dec 11 00:34:27 host2 sshd[2819504]: Disconnected from invalid user wxg 43.166.242.149 port 58608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-11 00:42:07 dovecot_login authenticator failed for (aes-static-041.73.22.125.airtel.in) [122.186.201.62]:54386: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 11 00:42:24 host2 sshd[2824012]: Disconnected from invalid user steam 194.107.115.65 port 45978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-11 00:42:23 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:42706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:44:07 host2 sshd[2824868]: Disconnected from invalid user admini 38.105.25.194 port 42642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 11 00:43:28 host2 sshd[2824502]: Disconnected from invalid user dev 154.83.15.123 port 33620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 11 00:43:57 host2 sshd[2824751]: Disconnected from invalid user ubuntu 194.107.115.65 port 9318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 11 00:44:10 host2 sshd[2824887]: Disconnected from invalid user misha 154.83.15.123 port 47982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-11 00:44:27 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:35498: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-11 00:44:49 dovecot_login authenticator failed for (223-197-145-126.static.imsbiz.com) [223.197.145.126]:59271: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 11 00:45:14 host2 sshd[2826244]: Disconnected from invalid user azureuser 194.107.115.65 port 34180 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.113
country_id: 6252001
description:
2025-12-11 00:45:30 dovecot_login authenticator failed for wsip-184-191-250-113.fv.ks.cox.net [184.191.250.113]:57598: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-11 00:45:52 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:50548: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-11 00:46:08 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:36036: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-11 00:46:13 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:56120: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.48
country_id: 6252001
description:
Dec 11 00:46:38 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.48, lip=66.85.158.92, TLS: Connection closed, session=<kL0a3p1FQuWnXpIw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-11 00:46:43 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:54295: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:47:23 host2 sshd[2827925]: Disconnected from invalid user eric 38.105.25.194 port 38910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 11 00:47:27 host2 sshd[2827962]: Disconnected from invalid user devops 51.77.137.25 port 55966 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 11 00:47:35 host2 sshd[2828026]: Disconnected from invalid user s1 154.83.15.123 port 35074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Dec 11 00:48:59 host2 sshd[2828991]: Disconnected from invalid user deploy 43.166.242.149 port 47306 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:49:03 host2 sshd[2829078]: Received disconnect from 38.105.25.194 port 34632:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 11 00:48:07 host2 pure-ftpd[2828403]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 11 00:48:08 host2 pure-ftpd[2828417]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:48:29 host2 sshd[2828675]: Disconnected from invalid user admin 38.105.25.194 port 55796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 11 00:48:32 host2 sshd[2828708]: Disconnected from invalid user manager 51.77.137.25 port 39420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.105.25.194
country_id: 6252001
description:
Dec 11 00:49:35 host2 sshd[2829391]: Disconnected from invalid user aj 38.105.25.194 port 56090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.137.25
country_id: 3017382
description:
Dec 11 00:50:36 host2 sshd[2830418]: Disconnected from invalid user ismail 51.77.137.25 port 51540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-11 00:50:39 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:49280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.201
country_id: 1269750
description:
2025-12-11 00:51:02 dovecot_login authenticator failed for (nsg-corporate-201.229.187.122.airtel.in) [122.187.229.201]:35411: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-11 00:51:12 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:37936: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-11 00:51:16 dovecot_login authenticator failed for ([27.123.119.254]) [128.185.246.106]:46176: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 11 00:51:30 host2 sshd[2831052]: Disconnected from invalid user intern 45.232.73.84 port 41228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-11 00:51:32 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:57660: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-11 00:52:21 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:60934: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-11 00:52:28 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (chanagn) [98.227.25.115]:38310: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-12-11 00:52:32 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:40032: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 11 00:52:55 host2 sshd[2832261]: Disconnected from invalid user acct 45.232.73.84 port 33478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.92.15
country_id: 357994
description:
Dec 11 00:53:55 host2 sshd[2832993]: Disconnected from invalid user hadi 45.246.92.15 port 52888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 11 00:53:29 host2 sshd[2832717]: Disconnected from invalid user ubuntu 5.182.26.99 port 58652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 11 00:53:38 host2 sshd[2832818]: Disconnected from invalid user drcom 45.232.73.84 port 46122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-11 00:54:31 dovecot_plain authenticator failed for (pallic) [24.105.248.218]:42350: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-11 00:57:03 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:16592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-11 00:56:13 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (golowl) [98.222.93.199]:53752: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 11 00:56:22 host2 sshd[2835618]: Disconnected from invalid user postgres 45.232.73.84 port 40246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-11 00:56:52 dovecot_login authenticator failed for (089-101-036159.customer.vmie.ie) [89.101.36.159]:35936: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-11 00:57:32 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (marof) [174.161.27.82]:60527: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.218.240.181
country_id: 1819730
description:
Dec 11 00:58:35 host2 sshd[2837091]: Disconnected from invalid user vboxuser 103.218.240.181 port 43634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 11 00:58:45 host2 sshd[2837171]: Disconnected from invalid user z 5.182.26.99 port 58014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.26.99
country_id: 1512440
description:
Dec 11 01:00:05 host2 sshd[2838246]: Disconnected from invalid user william 5.182.26.99 port 48994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.144.5.61
country_id: 130758
description:
Dec 11 00:59:09 host2 sshd[2837476]: Disconnected from invalid user user1 2.144.5.61 port 34042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Dec 11 00:59:14 host2 sshd[2837514]: Disconnected from invalid user user1 103.218.240.181 port 60940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Dec 11 01:00:44 host2 sshd[2838747]: Disconnected from invalid user hadi 103.218.240.181 port 40078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.92.15
country_id: 357994
description:
Dec 11 01:01:55 host2 sshd[2839420]: Disconnected from invalid user xyx 45.246.92.15 port 34544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.14
country_id: 3996063
description:
2025-12-11 01:02:28 dovecot_login authenticator failed for (201.173.216.14-clientes-izzi.mx) [201.173.216.14]:41933: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.246.92.15
country_id: 357994
description:
Dec 11 01:02:44 host2 sshd[2839820]: Disconnected from invalid user acct 45.246.92.15 port 49428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.25.78
country_id: 298795
description:
2025-12-11 01:02:48 dovecot_login authenticator failed for ([188.59.25.78]) [188.59.25.78]:44624: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-11 01:05:02 dovecot_plain authenticator failed for (citrumble) [12.150.243.22]:14494: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-11 01:06:05 dovecot_plain authenticator failed for (adens) [154.144.243.93]:53504: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-11 01:07:22 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:41115: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-11 01:07:53 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:39333: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 01:11:19 host2 sshd[2846380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 01:11:06 host2 sshd[2846245]: Disconnected from invalid user user 2.57.121.25 port 34145 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-11 01:11:09 dovecot_login authenticator failed for ([27.123.111.110]) [27.123.111.110]:52884: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-11 01:12:08 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:38740: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2025-12-11 01:16:29 dovecot_login authenticator failed for ([149.54.51.230]) [149.54.51.230]:47221: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-11 01:16:29 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:45877: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-11 01:16:43 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:35720: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-11 01:16:14 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:34950: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.6
country_id: 1269750
description:
2025-12-11 01:17:20 dovecot_login authenticator failed for ([182.95.85.221]) [182.95.124.6]:33016: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.64
country_id: 1733045
description:
2025-12-11 01:17:59 dovecot_login authenticator failed for ([49.124.153.64]) [49.124.153.64]:38594: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 01:20:25 host2 sshd[2853067]: Disconnected from invalid user ubnt 62.60.131.157 port 25452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:20:52 host2 sshd[2853357]: Disconnected from invalid user sistema 103.160.37.151 port 60828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.190.44
country_id: 3017382
description:
Dec 11 01:21:10 host2 sshd[2853717]: Disconnected from invalid user power 57.128.190.44 port 39812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:22:08 host2 sshd[2854390]: Disconnected from invalid user power 103.160.37.151 port 51520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-11 01:22:57 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:46750: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.249
country_id: 6252001
description:
2025-12-11 01:23:08 dovecot_login authenticator failed for ([98.185.121.249]) [98.185.121.249]:50240: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-11 01:22:26 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:55292: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-11 01:24:02 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:38454: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:24:05 host2 sshd[2855742]: Disconnected from invalid user elasticsearch 103.160.37.151 port 33684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-11 01:23:47 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:52821: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.187
country_id: 1733045
description:
2025-12-11 01:23:57 dovecot_login authenticator failed for ([49.124.148.187]) [49.124.148.187]:42576: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2025-12-11 01:24:16 dovecot_login authenticator failed for ([5.11.161.152]) [5.11.161.152]:40402: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-11 01:24:20 dovecot_login authenticator failed for ([136.232.73.130]) [49.37.32.248]:33630: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-11 01:24:19 dovecot_login authenticator failed for (201.173.56.28-clientes-izzi.mx) [201.173.56.28]:47131: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-11 01:24:26 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:42552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-11 01:24:39 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:41472: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:24:43 host2 sshd[2856123]: Disconnected from invalid user server1 103.160.37.151 port 46684 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 01:25:14 host2 sshd[2856623]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.208
country_id: 1605651
description:
Dec 11 01:25:35 host2 sshd[2856996]: Disconnected from invalid user temp 49.49.231.208 port 49754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 01:26:00 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (cursing) [51.195.117.220]:51194: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.190.44
country_id: 3017382
description:
Dec 11 01:25:13 host2 sshd[2856611]: Disconnected from invalid user elasticsearch 57.128.190.44 port 36394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.37.151
country_id: 1643084
description:
Dec 11 01:25:21 host2 sshd[2856695]: Disconnected from invalid user reza 103.160.37.151 port 59674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.184.139
country_id: 1269750
description:
Dec 11 01:26:12 host2 sshd[2857682]: Disconnected from invalid user ubuntu 64.227.184.139 port 37572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.190.44
country_id: 3017382
description:
Dec 11 01:26:20 host2 sshd[2857832]: Disconnected from invalid user sistema 57.128.190.44 port 43476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 11 01:27:33 host2 sshd[2859238]: Disconnected from invalid user pzuser 95.85.114.218 port 60664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.230
country_id: 1733045
description:
Dec 11 01:27:31 host2 sshd[2859208]: Disconnected from invalid user deployer 202.165.17.230 port 48756 [preauth]


