# incident

plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 16:54:33 host2 pure-ftpd[1878990]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.235.135.97
country_id: 6252001
description:
2025-12-30 16:56:44 dovecot_plain authenticator failed for H=([89.116.164.85]) [68.235.135.97]:36974: 535 Incorrect authentication data (set_id=sales@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.194.50.226
country_id: 290291
description:
2025-12-30 16:56:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [82.194.50.226]:60440: 535 Incorrect authentication data (set_id=sales@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.232.10.196
country_id: 192950
description:
2025-12-30 16:56:32 dovecot_plain authenticator failed for H=([89.116.164.85]) [197.232.10.196]:57585: 535 Incorrect authentication data (set_id=sales@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 16:58:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<58rXqSlHmt8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 16:59:23 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<xuTKqylHEK4zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 16:59:26 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<WZvvqylH3pwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 16:59:52 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<vtSErSlHjqKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 17:00:34 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<llwGsClHDuqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 17:03:05 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<AaT/uClHyotn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 17:03:52 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<hnzUuylHutMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 17:04:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<KoiHvSlHZOlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 17:04:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<pHYhvylHKKWnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 17:06:40 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<1knTxSlHbOii8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-30 17:06:43 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:33302: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.142.154.110
country_id: 1819730
description:
Dec 30 17:06:49 host2 pure-ftpd[1889906]: (?@45.142.154.110) [INFO] New connection from 45.142.154.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.72.196
country_id: 6252001
description:
2025-12-30 17:06:51 dovecot_login authenticator failed for H=syn-074-218-072-196.biz.spectrum.com [74.218.72.196]:36087: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.118
country_id: 1149361
description:
2025-12-30 17:07:11 dovecot_login authenticator failed for H=([149.54.62.118]) [149.54.62.118]:40864: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 17:06:31 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<R3JPxSlHwo+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2025-12-30 17:07:42 dovecot_login authenticator failed for H=(TNtPqcCC6) [157.254.223.39]:49787: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2025-12-30 17:08:18 dovecot_login authenticator failed for H=(rO6JLTuoZ) [157.254.223.39]:53718: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 157.254.223.39
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[157.254.223.39] [Authentication Database]=[mail] [Username]=[inquire@lezzarotech.com] (5/5 failures) (blocked until [Tue Dec 30 11:53:34 2025 UTC/Tue Dec 30 17:23:34 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 17:09:09 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<MCCszilHKJIvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2025-12-30 17:11:37 dovecot_login authenticator failed for H=(wksBwjn) [157.254.223.39]:49602: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 17:12:10 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<gKR+2SlHgJVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 17:14:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<7jRX4ylHAM6YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 17:15:43 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<0IIp5ilH4NQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 17:16:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<M8xV6ClHeLkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 17:18:40 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<BP+R8ClHou2eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-30 17:19:34 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:43181: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-12-30 17:19:56 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:50668: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-30 17:20:03 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:62700: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 17:20:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ytiL+ClH7J4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 17:23:08 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<7NKxACpHVJZV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.172.1.254
country_id: 3469034
description:
2025-12-30 17:30:32 dovecot_plain authenticator failed for H=([89.116.164.85]) [45.172.1.254]:8930: 535 Incorrect authentication data (set_id=contact@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.8.246.4
country_id: 6252001
description:
2025-12-30 17:30:44 dovecot_plain authenticator failed for H=ip68-8-246-4.sd.sd.cox.net ([89.116.164.85]) [68.8.246.4]:48052: 535 Incorrect authentication data (set_id=contact@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.204.6.146
country_id: 6252001
description:
2025-12-30 17:30:20 dovecot_plain authenticator failed for H=76-204-6-146.lightspeed.livnmi.sbcglobal.net ([89.116.164.85]) [76.204.6.146]:52600: 535 Incorrect authentication data (set_id=contact@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.72.59
country_id: 3996063
description:
2025-12-30 17:32:36 dovecot_login authenticator failed for H=(201.173.72.59-clientes-izzi.mx) [201.173.72.59]:50161: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2025-12-30 17:32:49 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:59371: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 17:34:01 host2 sshd[1914839]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 30 17:34:10 host2 pure-ftpd[1914982]: (?@66.132.153.115) [INFO] New connection from 66.132.153.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.60.176
country_id: 1880251
description:
[2025-12-30 17:36:55 +0530] info [cpaneld] 138.199.60.176 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-30 17:41:07 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:36490: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-30 17:40:50 dovecot_login authenticator failed for H=([182.95.185.170]) [182.95.185.170]:44548: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 17:42:07 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<zUmVRCpH2O0jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 17:42:46 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<wnvsRipHzMR100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.14.32.198
country_id: 298795
description:
Dec 30 17:43:01 host2 sshd[1922149]: Disconnected from invalid user kim 213.14.32.198 port 65117 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-30 17:42:30 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:47491: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-12-30 17:42:41 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:53678: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 30 17:43:14 host2 sshd[1922316]: Disconnected from invalid user ry 34.66.72.251 port 53180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 17:44:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Cr4gTCpHKxVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.14.32.198
country_id: 298795
description:
Dec 30 17:44:40 host2 sshd[1923456]: Disconnected from invalid user simon 213.14.32.198 port 35019 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 17:45:29 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<gbCkUCpHPvBo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 30 17:45:56 host2 sshd[1924638]: Disconnected from invalid user simon 185.131.53.100 port 57324 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.14.32.198
country_id: 298795
description:
Dec 30 17:45:23 host2 sshd[1924268]: Disconnected from invalid user xiaoli 213.14.32.198 port 37402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.248.179
country_id: 1733045
description:
2025-12-30 17:47:52 dovecot_plain authenticator failed for H=([89.116.164.85]) [180.75.248.179]:40798: 535 Incorrect authentication data (set_id=contato@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.43.218.145
country_id: 3895114
description:
2025-12-30 17:47:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [181.43.218.145]:55070: 535 Incorrect authentication data (set_id=contato@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.5.29.194
country_id: 1643084
description:
2025-12-30 17:48:10 dovecot_plain authenticator failed for H=([89.116.164.85]) [61.5.29.194]:60752: 535 Incorrect authentication data (set_id=contato@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.5.29.194
country_id: 1643084
description:
2025-12-30 17:48:17 dovecot_login authenticator failed for H=([89.116.164.85]) [61.5.29.194]:60752: 535 Incorrect authentication data (set_id=contato@kamechotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 30 17:49:40 host2 sshd[1927077]: Disconnected from invalid user stage 34.66.72.251 port 42354 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.55.229.216
country_id: 6252001
description:
Dec 30 17:49:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.55.229.216, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<q005YCpHBpUtN+XY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.99.9.163
country_id: 1880251
description:
Dec 30 17:49:52 host2 sshd[1927254]: Disconnected from invalid user tao 139.99.9.163 port 50862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.137.5
country_id: 294640
description:
2025-12-30 17:49:23 dovecot_login authenticator failed for H=([84.111.137.5]) [84.111.137.5]:46959: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.34.139
country_id: 3144096
description:
2025-12-30 17:49:35 dovecot_login authenticator failed for H=([178.232.34.139]) [178.232.34.139]:34808: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.14.32.198
country_id: 298795
description:
Dec 30 17:50:13 host2 sshd[1927509]: Disconnected from invalid user me 213.14.32.198 port 55709 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.123
country_id: 3469034
description:
Dec 30 17:52:00 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=177.44.71.123, lip=66.85.158.91, TLS, session=<wCDwZipHNb6xLEd7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Dec 30 17:51:44 host2 dovecot[1836975]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=194.164.107.4, lip=66.85.158.91, TLS, session=<iDAlZypHcsvCpGsE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 17:52:12 host2 sshd[1929655]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.42
country_id: 3469034
description:
Dec 30 17:52:20 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=177.8.251.42, lip=66.85.158.91, TLS, session=<z7AxaCpHy72xCPsq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 30 17:52:21 host2 sshd[1929748]: Disconnected from invalid user nikita 34.66.72.251 port 59696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 17:52:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ZIQcaipHEMwyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.99.9.163
country_id: 1880251
description:
Dec 30 17:53:31 host2 sshd[1930493]: Disconnected from invalid user asdf 139.99.9.163 port 58312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 30 17:54:36 host2 sshd[1931373]: Disconnected from invalid user bitrix 185.131.53.100 port 56650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 30 17:55:55 host2 sshd[1932700]: Disconnected from invalid user git 185.131.53.100 port 49192 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.250
country_id: 2635167
description:
Dec 30 17:56:29 host2 dovecot[1836975]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.250, lip=66.85.158.92, TLS, session=<1WwbeCpHLapX7LD6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.127
country_id: 2635167
description:
Dec 30 17:56:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.127, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JCIoeCpHzaq594l/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-12-30 17:57:03 dovecot_login authenticator failed for H=89-67-5-135.dynamic.play.pl [89.67.5.135]:44962: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.128
country_id: 2635167
description:
Dec 30 17:57:03 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.128, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ZYcjeipHN8dX7LCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-30 17:57:51 dovecot_login authenticator failed for H=(mail.tataidc.com) [61.12.86.90]:43040: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.166
country_id: 3469034
description:
Dec 30 17:58:04 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.89.136.166, lip=66.85.158.91, TLS, session=<GCh+fCpH8Ka+WYim>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.138
country_id: 2635167
description:
Dec 30 17:58:10 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.138, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<tDUafipHp56594mK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 17:57:10 host2 pure-ftpd[1933770]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 17:57:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<k97xeipH9t8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.121
country_id: 2635167
description:
Dec 30 17:57:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.121, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<yvIefCpHueBX7LB5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.106.155.11
country_id: 798544
description:
Dec 30 17:58:22 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.106.155.11, lip=66.85.158.91, TLS, session=<pVjYfSpHerDBapsL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 17:58:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<taTZfypHnOmeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.125
country_id: 2635167
description:
Dec 30 17:58:44 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.125, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XkMlgCpHvY1X7LB9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 17:58:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<3IJKgCpHNO1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 17:58:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<4wB1gCpHwLKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 17:59:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<HNBXgSpH/q5n9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.126
country_id: 2635167
description:
Dec 30 17:59:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<waoegipHJblX7LB+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.114
country_id: 2635167
description:
Dec 30 17:59:50 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.114, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<3xUchCpHObBX7LBy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.135
country_id: 2635167
description:
Dec 30 18:00:57 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.135, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<eDETiCpHCaC594mH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-30 18:01:08 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (cless) [73.196.144.25]:55668: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.141
country_id: 2635167
description:
Dec 30 18:00:24 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.141, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Z8wZhipHZZ5X7LCN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.123
country_id: 2635167
description:
Dec 30 18:01:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.123, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<ToEOiipHTd+594l7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 18:02:07 host2 sshd[1937414]: Disconnected from invalid user admin 2.57.121.112 port 57134 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 18:03:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<nZBRjypHktAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 18:03:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lSVHjypHKLov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 18:04:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<kN0plipHSAei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 18:05:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=</rLFlipHCsqnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.195.192.223
country_id: 1694008
description:
2025-12-30 18:05:11 dovecot_plain authenticator failed for H=([89.116.164.85]) [180.195.192.223]:2100: 535 Incorrect authentication data (set_id=contacto@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.150.128.137
country_id: 2510769
description:
2025-12-30 18:05:24 dovecot_plain authenticator failed for H=137.red-79-150-128.dynamicip.rima-tde.net ([89.116.164.85]) [79.150.128.137]:59552: 535 Incorrect authentication data (set_id=contacto@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.27.236.207
country_id: 2635167
description:
2025-12-30 18:05:36 dovecot_plain authenticator failed for H=([89.116.164.85]) [176.27.236.207]:1450: 535 Incorrect authentication data (set_id=contacto@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 18:07:18 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<USKknipHTLszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 18:13:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<IpdOtCpHXp4v+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.246.4
country_id: 2264397
description:
[2025-12-30 18:13:15 +0530] info [cpaneld] 104.28.246.4 - kamechot "GET /json-api/cpanel?api.version=1&cpanel_jsonapi_module=Fileman&cpanel_jsonapi_func=listfiles HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 18:14:11 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<+bZBtypH+r9CdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.220.75.172
country_id: 6252001
description:
[2025-12-30 18:15:48 +0530] info [whostmgrd] 107.220.75.172 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.173
country_id: 2542007
description:
2025-12-30 18:15:53 dovecot_login authenticator failed for H=([105.73.93.173]) [105.73.93.173]:42374: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-30 18:15:20 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:42186: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 18:16:53 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<JgftwCpHAsueRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.116.98.38
country_id: 6252001
description:
[2025-12-30 18:16:59 +0530] info [whostmgrd] 98.116.98.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-12-30 18:17:31 dovecot_login authenticator failed for H=([103.230.176.152]) [103.230.176.152]:40466: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-30 18:17:50 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:34706: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 18:17:58 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Y+7MxCpHDIUvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:21:07 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lsMx0CpHzLADiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.13.115.139
country_id: 3865483
description:
2025-12-30 18:20:15 dovecot_plain authenticator failed for H=([89.116.164.85]) [186.13.115.139]:38890: 535 Incorrect authentication data (set_id=financeiro@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.215.253
country_id: 1733045
description:
2025-12-30 18:20:33 dovecot_plain authenticator failed for H=([89.116.164.85]) [113.211.215.253]:10318: 535 Incorrect authentication data (set_id=financeiro@kamechotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 30 18:20:47 host2 sshd[1951280]: Disconnected from invalid user test 201.124.168.139 port 56526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.20.187.190
country_id: 1605651
description:
2025-12-30 18:20:54 dovecot_plain authenticator failed for H=([89.116.164.85]) [1.20.187.190]:54926: 535 Incorrect authentication data (set_id=financeiro@kamechotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:21:15 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vtCm0CpHlrYDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 18:21:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<uwje0ipHrtUFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 18:22:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ZTWX0ypH8tqeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:22:25 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0TTY1CpHQIgDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 18:24:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=</xsu2ypHXscv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:24:35 host2 dovecot[1836975]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<squU3CpH7oIDiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.40.214.222
country_id: 6252001
description:
[2025-12-30 18:25:59 +0530] info [whostmgrd] 100.40.214.222 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:26:00 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<svqi4SpHEIwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:26:25 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Y0Mt4ypHDscDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 30 18:27:04 host2 sshd[1957087]: Disconnected from invalid user odoo 201.124.168.139 port 45530 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:27:42 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<w9y85ypH9IMDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 30 18:27:42 host2 sshd[1957634]: Disconnected from invalid user ubuntu 201.124.168.139 port 57270 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.143.74.95
country_id: 6252001
description:
[2025-12-30 18:29:34 +0530] info [whostmgrd] 71.143.74.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 18:30:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<EUi+8ipHkqeYNcU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.209.240.15
country_id: 6252001
description:
[2025-12-30 18:31:02 +0530] info [whostmgrd] 72.209.240.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:33:11 host2 sshd[1963177]: Disconnected from invalid user rustserver 197.211.55.20 port 33858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 18:34:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<xAP1/ypHIqmnrKy4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.223.98.97
country_id: 6252001
description:
[2025-12-30 18:34:29 +0530] info [whostmgrd] 75.223.98.97 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.125.94.71
country_id: 1643084
description:
Dec 30 18:35:30 host2 sshd[1965532]: Disconnected from invalid user git 202.125.94.71 port 46532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 18:35:59 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<QwVABStHNr+eRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.198.211.201
country_id: 6252001
description:
[2025-12-30 18:36:11 +0530] info [whostmgrd] 72.198.211.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.122.68
country_id: 6252001
description:
[2025-12-30 18:36:10 +0530] info [whostmgrd] 71.30.122.68 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.202.14.129
country_id: 6252001
description:
[2025-12-30 18:36:22 +0530] info [whostmgrd] 73.202.14.129 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 18:36:35 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ww9gBytH+kFniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.125.94.71
country_id: 1643084
description:
Dec 30 18:36:51 host2 sshd[1966727]: Disconnected from invalid user daisy 202.125.94.71 port 41988 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.20.123.32
country_id: 6252001
description:
[2025-12-30 18:37:07 +0530] info [whostmgrd] 50.20.123.32 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.83.52.20
country_id: 6252001
description:
[2025-12-30 18:36:42 +0530] info [whostmgrd] 74.83.52.20 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 18:37:01 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fivsCCtHhvh100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 30 18:37:26 host2 sshd[1967167]: Disconnected from invalid user wireguard 158.69.194.34 port 34016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:37:28 host2 sshd[1967175]: Disconnected from invalid user rise 197.211.55.20 port 34700 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.79.55.4
country_id: 6252001
description:
[2025-12-30 18:37:37 +0530] info [whostmgrd] 64.79.55.4 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.20.0.160
country_id: 6252001
description:
2025-12-30 18:37:49 dovecot_plain authenticator failed for H=([89.116.164.85]) [67.20.0.160]:45449: 535 Incorrect authentication data (set_id=comercial@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.75.130.182
country_id: 3895114
description:
2025-12-30 18:38:01 dovecot_plain authenticator failed for H=([89.116.164.85]) [181.75.130.182]:58695: 535 Incorrect authentication data (set_id=comercial@kamechotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 30 18:39:08 host2 sshd[1968559]: Disconnected from invalid user daisy 186.248.197.77 port 16658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.125.94.71
country_id: 1643084
description:
Dec 30 18:38:14 host2 sshd[1967747]: Disconnected from invalid user milad 202.125.94.71 port 37498 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.134.230.169
country_id: 6252001
description:
[2025-12-30 18:38:35 +0530] info [whostmgrd] 76.134.230.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.41.218.40
country_id: 6252001
description:
[2025-12-30 18:39:32 +0530] info [whostmgrd] 66.41.218.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.210.55.81
country_id: 2077456
description:
Dec 30 18:39:53 host2 sshd[1969156]: Disconnected from invalid user soc 13.210.55.81 port 51232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:39:58 host2 sshd[1969227]: Disconnected from invalid user bot 197.211.55.20 port 50210 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 18:40:29 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MSlQFStH0tsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2025-12-30 18:40:51 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:45326: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 30 18:41:10 host2 sshd[1970653]: Disconnected from invalid user webmaster 186.248.197.77 port 25986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:41:15 host2 sshd[1970698]: Disconnected from invalid user casaos 197.211.55.20 port 52446 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 30 18:41:57 host2 sshd[1971184]: Received disconnect from 158.69.194.34 port 48194:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-30 18:42:03 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:2493: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 30 18:42:55 host2 sshd[1971836]: Disconnected from invalid user postgres 158.69.194.34 port 55370 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:43:07 host2 sshd[1971979]: Disconnected from invalid user deployer 197.211.55.20 port 56082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-30 18:42:24 dovecot_login authenticator failed for H=(128.102.88.80.sta.ac-net.se) [80.88.102.128]:39752: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.229.72.68
country_id: 1605651
description:
Dec 30 18:43:14 host2 sshd[1972065]: Disconnected from invalid user kodi 49.229.72.68 port 59038 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.121.121.27
country_id: 6252001
description:
[2025-12-30 18:43:23 +0530] info [whostmgrd] 38.121.121.27 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 30 18:43:24 host2 sshd[1972196]: Disconnected from invalid user deploy 158.69.194.34 port 33930 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.60.242.234
country_id: 6252001
description:
[2025-12-30 18:43:39 +0530] info [whostmgrd] 184.60.242.234 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-30 18:44:27 dovecot_login authenticator failed for H=([182.95.20.28]) [182.95.228.10]:50804: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:45:08 host2 sshd[1973693]: Disconnected from invalid user oper 187.210.77.100 port 53000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-30 18:44:14 dovecot_login authenticator failed for H=([193.23.199.238]) [193.23.199.238]:38300: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.210.55.81
country_id: 2077456
description:
Dec 30 18:44:24 host2 sshd[1973014]: Disconnected from invalid user deploy 13.210.55.81 port 56656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 18:47:44 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<UhhILytHDhpo7MS0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.193.120.58
country_id: 6252001
description:
[2025-12-30 18:47:54 +0530] info [whostmgrd] 108.193.120.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.111.251.118
country_id: 6252001
description:
[2025-12-30 18:48:08 +0530] info [whostmgrd] 24.111.251.118 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:48:25 host2 sshd[1976809]: Disconnected from invalid user next 187.210.77.100 port 42288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2025-12-30 18:48:41 dovecot_login authenticator failed for H=([41.59.99.40]) [41.59.99.40]:56260: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-30 18:48:57 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:53621: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:49:49 host2 sshd[1977901]: Disconnected from invalid user storage 187.210.77.100 port 45846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:51:09 host2 sshd[1979100]: Disconnected from invalid user fabio 187.210.77.100 port 46720 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.131.144
country_id: 6252001
description:
[2025-12-30 18:52:11 +0530] info [whostmgrd] 216.49.131.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 18:51:14 host2 sshd[1979157]: Disconnected from invalid user nick 62.60.131.157 port 16752 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 18:51:47 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<fTCxPStHUuei8GQy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.112.126.121
country_id: 6252001
description:
[2025-12-30 18:51:51 +0530] info [whostmgrd] 23.112.126.121 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:52:27 host2 sshd[1980188]: Disconnected from invalid user bounce 187.210.77.100 port 46698 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.203.35
country_id: 2542007
description:
[2025-12-30 18:52:37 +0530] info [cpaneld] 197.147.203.35 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 197.147.203.35
country_id: 2542007
description:
[2025-12-30 18:52:46 +0530] info [cpaneld] 197.147.203.35 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user travel (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 197.147.203.35
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[197.147.203.35] [Remote Port]=[12445] [Authentication Database]=[system] [Username]=[travel] (5/5 failures) (blocked until [Tue Dec 30 13:37:42 2025 UTC/Tue Dec 30 19:07:42 2025 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.234.200
country_id: 6252001
description:
[2025-12-30 18:54:06 +0530] info [whostmgrd] 107.136.234.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.212.188
country_id: 1269750
description:
Dec 30 18:54:07 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=43.225.212.188, lip=66.85.158.91, TLS, session=<pTsWRStH0Jcr4dS8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 18:53:27 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fPeoQytHhJFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.202.96.252
country_id: 3865483
description:
Dec 30 18:53:46 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=143.202.96.252, lip=66.85.158.91, TLS, session=<HGDeQytHqs2PymD8>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.174.144.123
country_id: 6252001
description:
[2025-12-30 18:53:51 +0530] info [whostmgrd] 69.174.144.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.141.49.18
country_id: 2260494
description:
2025-12-30 18:55:10 dovecot_plain authenticator failed for H=([89.116.164.85]) [102.141.49.18]:47580: 535 Incorrect authentication data (set_id=hello@kamechotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 18:55:34 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<76pDSytHGIdn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.166.62.220
country_id: 298795
description:
2025-12-30 18:55:39 dovecot_plain authenticator failed for H=([89.116.164.85]) [78.166.62.220]:26366: 535 Incorrect authentication data (set_id=hello@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 18:55:44 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<CCToSytHapcjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.141.49.18
country_id: 2260494
description:
2025-12-30 18:55:17 dovecot_login authenticator failed for H=([89.116.164.85]) [102.141.49.18]:47580: 535 Incorrect authentication data (set_id=hello@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.234.221.192
country_id: 878675
description:
2025-12-30 18:55:24 dovecot_plain authenticator failed for H=([89.116.164.85]) [216.234.221.192]:16600: 535 Incorrect authentication data (set_id=hello@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-30 18:56:51 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (sivellency) [24.98.45.238]:54924: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-30 18:56:55 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (decting) [73.230.86.50]:40374: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 18:57:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<VfgkUStHEOyeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-30 18:57:42 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:36768: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.199
country_id: 2186224
description:
2025-12-30 18:58:15 dovecot_login authenticator failed for H=([121.73.166.199]) [121.73.166.199]:58396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.115.151.101
country_id: 6252001
description:
[2025-12-30 18:59:21 +0530] info [whostmgrd] 107.115.151.101 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 19:00:58 host2 pure-ftpd[1988970]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-30 19:01:06 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:35626: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.195.221.26
country_id: 934292
description:
Dec 30 19:00:37 host2 sshd[1988531]: Disconnected from invalid user bitrix 45.195.221.26 port 45926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 19:00:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<VzhqXitHNtUyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.27.97.172
country_id: 3439705
description:
Dec 30 19:01:49 host2 sshd[1989729]: Disconnecting invalid user admin 179.27.97.172 port 54042: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 179.27.97.172
country_id: 3439705
description:
Dec 30 19:01:34 host2 sshd[1989436]: Disconnecting authenticating user root 179.27.97.172 port 35950: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 179.27.97.172
country_id: 3439705
description:
Dec 30 19:01:34 host2 sshd[1989436]: error: maximum authentication attempts exceeded for root from 179.27.97.172 port 35950 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.122.72.90
country_id: 6252001
description:
[2025-12-30 19:02:34 +0530] info [whostmgrd] 76.122.72.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2025-12-30 19:02:50 +0530] info [cpaneld] 45.168.113.8 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.125.117.123
country_id: 6252001
description:
[2025-12-30 19:03:05 +0530] info [whostmgrd] 172.125.117.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 19:04:10 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<2moMaitHtCai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 19:05:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<bYEvbitHFOIzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.10
country_id: 1733045
description:
2025-12-30 19:05:45 dovecot_login authenticator failed for H=([49.124.151.10]) [49.124.151.10]:38578: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 19:05:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<UsA5cCtHpsIv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.184.121.111
country_id: 6252001
description:
[2025-12-30 19:06:05 +0530] info [whostmgrd] 209.184.121.111 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-30 19:06:09 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:43194: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-30 19:06:29 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (criony) [98.203.34.136]:48688: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-30 19:06:39 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:50334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-30 19:06:56 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:60434: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-30 19:07:18 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:49181: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.42
country_id: 3469034
description:
Dec 30 19:07:22 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.8.251.42, lip=66.85.158.91, TLS, session=<rpiGdCtHHtmxCPsq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.230
country_id: 2510769
description:
Dec 30 19:07:41 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.74.240.230, lip=66.85.158.91, TLS, session=<UqawdStHQ7W5SvDm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.246.106.59
country_id: 6252001
description:
[2025-12-30 19:09:11 +0530] info [whostmgrd] 64.246.106.59 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-30 19:09:33 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:53196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 19:09:38 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<oWqQfStHlJEzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-30 19:10:09 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:36584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-30 19:10:36 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [200.89.159.59]:38866: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Dec 30 19:10:38 host2 sshd[1997679]: Disconnected from invalid user userb 38.213.63.12 port 53650 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 19:11:26 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<BLUMhCtHHoIv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 30 19:13:55 host2 sshd[2000632]: Disconnected from invalid user deploy 143.198.85.84 port 34162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.242
country_id: 1269750
description:
Dec 30 19:13:51 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.70.126.242, lip=66.85.158.91, TLS, session=<5/heiytHzO1nRn7y>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 2750405
description:
Dec 30 19:14:31 host2 sshd[2001139]: Disconnected from invalid user runner 38.213.63.12 port 42140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 30 19:14:35 host2 sshd[2001124]: Disconnected from invalid user zimbra 103.132.243.250 port 37310 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.91
country_id: 3469034
description:
Dec 30 19:14:20 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<env_eng>, method=PLAIN, rip=187.120.73.91, lip=66.85.158.91, TLS, session=<DMMhjStHOZW7eElb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 30 19:14:23 host2 sshd[2000938]: Disconnected from invalid user usman 27.112.78.245 port 45770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.243.72
country_id: 1643084
description:
Dec 30 19:14:27 host2 sshd[2001056]: Disconnected from invalid user ospite 103.82.243.72 port 48058 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.107.192.144
country_id: 6252001
description:
[2025-12-30 19:14:29 +0530] info [whostmgrd] 73.107.192.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 19:15:43 host2 sshd[2002146]: Disconnected from invalid user admin 2.57.121.112 port 57312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 19:16:14 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<rdEslStHIsBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 19:15:27 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<PZtkkitHUtWeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 30 19:17:13 host2 sshd[2003225]: Disconnected from invalid user azureuser 143.198.85.84 port 55000 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.249.231.110
country_id: 6252001
description:
[2025-12-30 19:17:38 +0530] info [whostmgrd] 96.249.231.110 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.131.109.250
country_id: 6252001
description:
[2025-12-30 19:18:08 +0530] info [whostmgrd] 107.131.109.250 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.172.90.224
country_id: 6252001
description:
[2025-12-30 19:18:16 +0530] info [whostmgrd] 207.172.90.224 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 30 19:18:28 host2 sshd[2004017]: Disconnected from invalid user azureuser 27.112.78.245 port 34390 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.178.120
country_id: 6252001
description:
[2025-12-30 19:18:34 +0530] info [whostmgrd] 216.147.178.120 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 30 19:18:50 host2 sshd[2004231]: Disconnected from invalid user experiment 143.198.85.84 port 36252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 30 19:19:13 host2 sshd[2004485]: Disconnected from invalid user tester 103.132.243.250 port 46226 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.113.37.106
country_id: 6252001
description:
[2025-12-30 19:22:17 +0530] info [whostmgrd] 23.113.37.106 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.144.222.229
country_id: 6252001
description:
[2025-12-30 19:23:25 +0530] info [whostmgrd] 76.144.222.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Dec 30 19:23:31 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<lCxdrytHwk9BMRRC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.115.242.242
country_id: 6252001
description:
[2025-12-30 19:26:24 +0530] info [whostmgrd] 66.115.242.242 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 19:26:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<oyVluytH0LYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 19:27:43 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Fz88vitHtucvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 19:28:28 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<SD/qwCtHFpcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 19:29:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XVPExStHmyNniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.182.224.205
country_id: 3469034
description:
2025-12-30 19:29:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [179.182.224.205]:54798: 535 Incorrect authentication data (set_id=it@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.28.247.60
country_id: 248816
description:
2025-12-30 19:30:07 dovecot_plain authenticator failed for H=([89.116.164.85]) [176.28.247.60]:32949: 535 Incorrect authentication data (set_id=it@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.152.71.194
country_id: 6252001
description:
2025-12-30 19:30:19 dovecot_plain authenticator failed for H=c-73-152-71-194.hsd1.va.comcast.net ([89.116.164.85]) [73.152.71.194]:51254: 535 Incorrect authentication data (set_id=it@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 19:31:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ICAByitHnTd100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.23.82.219
country_id: 6252001
description:
[2025-12-30 19:33:34 +0530] info [whostmgrd] 98.23.82.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.214.133.90
country_id: 6252001
description:
[2025-12-30 19:34:53 +0530] info [whostmgrd] 206.214.133.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 19:36:03 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<3lEX3CtHctGnrKy4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.110.109.174
country_id: 6252001
description:
[2025-12-30 19:35:30 +0530] info [whostmgrd] 74.110.109.174 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.53.184.56
country_id: 6252001
description:
[2025-12-30 19:35:48 +0530] info [whostmgrd] 108.53.184.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.202.33.144
country_id: 6252001
description:
[2025-12-30 19:36:23 +0530] info [whostmgrd] 151.202.33.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:36:26 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<UXeL3StHRsCi2JU5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.222.45.110
country_id: 6252001
description:
[2025-12-30 19:36:44 +0530] info [whostmgrd] 73.222.45.110 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.77.56.10
country_id: 6252001
description:
[2025-12-30 19:36:54 +0530] info [whostmgrd] 38.77.56.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 19:38:39 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ZzpX5StHgI0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:38:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Ff7w5CtH7PKi2JU5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.39.147.217
country_id: 6252001
description:
[2025-12-30 19:38:31 +0530] info [whostmgrd] 108.39.147.217 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:39:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<K0MD6itH6uui2JU5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.165.64.150
country_id: 6252001
description:
[2025-12-30 19:41:18 +0530] info [whostmgrd] 98.165.64.150 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.186.156
country_id: 6252001
description:
Dec 30 19:41:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.186.156, lip=66.85.158.91, session=<hIkh7ytHnocofLqc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.66.55.131
country_id: 6252001
description:
[2025-12-30 19:41:27 +0530] info [whostmgrd] 72.66.55.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.148
country_id: 6252001
description:
[2025-12-30 19:42:21 +0530] info [whostmgrd] 172.58.212.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.57
country_id: 6252001
description:
Dec 30 19:43:01 host2 pure-ftpd[2023282]: (?@167.94.146.57) [INFO] New connection from 167.94.146.57


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 19:44:43 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<lcAP+ytHfrii8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.255.30
country_id: 1168579
description:
2025-12-30 19:44:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [103.163.255.30]:41062: 535 Incorrect authentication data (set_id=accounts@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.133.77.232
country_id: 3469034
description:
2025-12-30 19:45:09 dovecot_plain authenticator failed for H=([89.116.164.85]) [179.133.77.232]:57650: 535 Incorrect authentication data (set_id=accounts@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 19:45:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<pG3U/CtHaOSeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.133.77.232
country_id: 3469034
description:
2025-12-30 19:45:16 dovecot_login authenticator failed for H=([89.116.164.85]) [179.133.77.232]:57650: 535 Incorrect authentication data (set_id=accounts@kamechotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.216.27
country_id: 6252001
description:
[2025-12-30 19:45:56 +0530] info [whostmgrd] 172.59.216.27 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:46:02 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS, session=<ExDn/ytH3uWi2JU5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.182.41.53
country_id: 6252001
description:
[2025-12-30 19:47:06 +0530] info [whostmgrd] 104.182.41.53 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:47:08 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS, session=<i7HOAyxHKPKi2JU5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 19:47:32 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<QmUbBSxHvqmYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 19:48:43 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<IoxbCSxHWpFnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 19:50:30 host2 sshd[2034162]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-12-30 19:50:22 dovecot_login authenticator failed for H=(c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:34184: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-30 19:50:46 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:52620: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 19:50:46 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<G0uRECxHlj9o7MS0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.189.81.235
country_id: 6252001
description:
[2025-12-30 19:52:02 +0530] info [whostmgrd] 38.189.81.235 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 19:51:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<owWxFCxHAKNn9M4G>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.48.140.42
country_id: 6252001
description:
[2025-12-30 19:52:15 +0530] info [whostmgrd] 199.48.140.42 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.69.151.196
country_id: 6252001
description:
[2025-12-30 19:53:25 +0530] info [whostmgrd] 173.69.151.196 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 19:53:37 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IejoGixHBr0jupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.217.140.64
country_id: 6252001
description:
[2025-12-30 19:55:07 +0530] info [whostmgrd] 108.217.140.64 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 19:55:18 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<LQDOICxH/JSeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.242.198.163
country_id: 3017382
description:
Dec 30 19:57:59 host2 sshd[2056520]: Disconnected from invalid user oracle 38.242.198.163 port 53054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 30 19:58:04 host2 sshd[2056963]: Disconnected from invalid user ubuntu 207.154.247.4 port 57892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 19:59:27 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 10 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<es9JLyxHXL2eRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.16.134.232
country_id: 6252001
description:
[2025-12-30 20:02:34 +0530] info [whostmgrd] 70.16.134.232 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.189.14.214
country_id: 3469034
description:
2025-12-30 20:02:37 dovecot_plain authenticator failed for H=([89.116.164.85]) [200.189.14.214]:61412: 535 Incorrect authentication data (set_id=noreply@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.67.38.219
country_id: 3469034
description:
2025-12-30 20:02:42 dovecot_plain authenticator failed for H=177-67-38-219.static.newlifeinformatica.com.br ([89.116.164.85]) [177.67.38.219]:2287: 535 Incorrect authentication data (set_id=noreply@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Dec 30 20:02:24 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 36 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<BsBFOCxH0rDE+2YK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 20:02:27 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<6ZctOixH4B2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 20:03:45 host2 sshd[2065635]: Disconnected from invalid user ulysses 62.60.131.157 port 47638 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 20:05:15 host2 pure-ftpd[2067030]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.242.198.163
country_id: 3017382
description:
Dec 30 20:04:23 host2 sshd[2066019]: Disconnected from invalid user user1 38.242.198.163 port 40084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 30 20:05:45 host2 sshd[2067432]: Disconnected from invalid user oracle 12.156.67.18 port 36222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 20:06:04 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZPASRyxHMsOnrKy4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.222.100.203
country_id: 6252001
description:
[2025-12-30 20:06:35 +0530] info [whostmgrd] 47.222.100.203 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 30 20:06:38 host2 sshd[2067962]: Disconnected from invalid user tester 12.156.67.18 port 44542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-30 20:06:44 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (ratedonis) [73.13.220.220]:43762: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.113.119
country_id: 6252001
description:
[2025-12-30 20:06:54 +0530] info [whostmgrd] 129.212.113.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.79.87
country_id: 1643084
description:
Dec 30 20:07:32 host2 sshd[2068718]: Disconnected from invalid user user 27.112.79.87 port 43612 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 20:07:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Z3qhTSxHutozTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.220.199.120
country_id: 6252001
description:
[2025-12-30 20:07:31 +0530] info [whostmgrd] 73.220.199.120 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 20:08:48 host2 sshd[2069510]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 20:08:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<VPyLUSxHJNQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 20:09:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<gMbSVCxHYMIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 20:10:09 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<K/T/VSxHHNAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.242.198.163
country_id: 3017382
description:
Dec 30 20:10:29 host2 sshd[2070921]: Disconnected from invalid user ubuntu 38.242.198.163 port 60918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 20:12:07 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<k58QXSxHPIMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 20:13:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<AhvxYCxH0qyeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 30 20:15:22 host2 sshd[2073793]: Disconnected from invalid user ubuntu 12.156.67.18 port 37582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 20:18:07 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<bJtucixHJLRCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.39
country_id: 2635167
description:
Dec 30 20:18:36 host2 pure-ftpd[2076036]: (?@87.236.176.39) [INFO] New connection from 87.236.176.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2025-12-30 20:18:53 dovecot_login authenticator failed for H=([175.156.82.86]) [175.156.82.86]:51599: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.7.17
country_id: 3144096
description:
2025-12-30 20:19:10 dovecot_login authenticator failed for H=([84.211.7.17]) [84.211.7.17]:47454: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.10.162.239
country_id: 2464461
description:
2025-12-30 20:19:51 dovecot_plain authenticator failed for H=([89.116.164.85]) [197.10.162.239]:37790: 535 Incorrect authentication data (set_id=suporte@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.39.141.69
country_id: 3017382
description:
2025-12-30 20:20:03 dovecot_plain authenticator failed for H=31-39-141-69.abo.bbox.fr ([89.116.164.85]) [31.39.141.69]:59832: 535 Incorrect authentication data (set_id=suporte@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.182.249.84
country_id: 3686110
description:
2025-12-30 20:20:14 dovecot_plain authenticator failed for H=([89.116.164.85]) [201.182.249.84]:49603: 535 Incorrect authentication data (set_id=suporte@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.182.249.84
country_id: 3686110
description:
2025-12-30 20:20:20 dovecot_login authenticator failed for H=([89.116.164.85]) [201.182.249.84]:49603: 535 Incorrect authentication data (set_id=suporte@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 20:21:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<SBIbgCxHxkpniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 30 20:23:52 host2 sshd[2079772]: Disconnected from invalid user steam 207.154.247.4 port 50788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 20:25:59 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<EAiojixHUKF100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 20:28:53 host2 sshd[2083170]: Disconnected from invalid user admin 2.57.121.112 port 49241 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 20:28:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60299: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 20:29:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<P6F2nCxHdOkv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 30 20:31:54 host2 sshd[2085237]: Disconnected from invalid user ansible 205.185.115.224 port 32790 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-30 20:32:16 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:49950: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-30 20:32:31 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:42258: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 30 20:33:14 host2 sshd[2086225]: Disconnected from invalid user db2fenc 205.185.115.224 port 59390 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 20:35:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<00T0sSxH6G4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 20:36:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<i6ItsyxHDpQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 20:38:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pLdiuixHxNai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 20:38:18 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<H+C2uixHht0vWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 30 20:39:10 host2 sshd[2090532]: Disconnected from invalid user ftpuser 205.185.115.224 port 37920 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.221.255.205
country_id: 6252001
description:
[2025-12-30 20:39:25 +0530] info [cpaneld] 47.221.255.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.208.7.56
country_id: 6252001
description:
[2025-12-30 20:39:24 +0530] info [cpaneld] 152.208.7.56 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.77.59.127
country_id: 6252001
description:
[2025-12-30 20:39:25 +0530] info [cpaneld] 72.77.59.127 - jrdc "GET /login/?login_only=1&user=jrdc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrdc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.109.150.197
country_id: 6252001
description:
[2025-12-30 20:39:29 +0530] info [whostmgrd] 143.109.150.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.120.95.184
country_id: 6252001
description:
[2025-12-30 20:39:30 +0530] info [cpaneld] 23.120.95.184 - jrdclk "GET /login/?login_only=1&user=jrdclk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.100.167
country_id: 6252001
description:
[2025-12-30 20:39:33 +0530] info [cpaneld] 74.105.100.167 - jr "GET /login/?login_only=1&user=jr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.84.30
country_id: 6252001
description:
[2025-12-30 20:39:31 +0530] info [cpaneld] 129.222.84.30 - jrd "GET /login/?login_only=1&user=jrd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrd (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.66.246
country_id: 6252001
description:
Dec 30 20:41:10 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.221.66.246, lip=66.85.158.92, session=<zHYKxSxHgO0U3UL2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 20:43:46 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<W0c6zixHKt1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 20:46:09 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<fNXF1ixHHrdn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.91
country_id: 6252001
description:
Dec 30 20:46:40 host2 pure-ftpd[2096139]: (?@205.210.31.91) [INFO] New connection from 205.210.31.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-30 20:46:56 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (ingistufor) [98.204.134.124]:35466: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.211
country_id: 3017382
description:
Dec 30 20:48:00 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.211, lip=66.85.158.92, session=<AwR53SxH68NbxJjT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.210
country_id: 3017382
description:
Dec 30 20:48:13 host2 dovecot[1836975]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.210, lip=66.85.158.92, session=<h8pE3ixHW7ZbxJjS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.214
country_id: 3017382
description:
Dec 30 20:47:49 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.214, lip=66.85.158.92, session=<kcXb3CxHYZ1bxJjW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.177
country_id: 3017382
description:
Dec 30 20:48:16 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.177, lip=66.85.158.92, session=<GDh33ixHB4FbxJix>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2025-12-30 20:49:40 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:41010: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-30 20:49:51 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:54978: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec 30 20:51:13 host2 sshd[2099677]: Disconnected from invalid user tester 45.249.247.165 port 39770 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 20:50:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6sio5yxHyKEjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 30 20:51:10 host2 sshd[2099674]: Disconnected from invalid user user 103.144.247.233 port 47450 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.2.119.101
country_id: 6252001
description:
[2025-12-30 20:52:02 +0530] info [cpaneld] 104.2.119.101 - dandagamuwalk "GET /login/?login_only=1&user=dandagamuwalk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuwalk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.234.184
country_id: 6252001
description:
[2025-12-30 20:52:07 +0530] info [cpaneld] 45.31.234.184 - dand "GET /login/?login_only=1&user=dand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.89.221.240
country_id: 6252001
description:
[2025-12-30 20:52:09 +0530] info [cpaneld] 74.89.221.240 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.76.253
country_id: 6252001
description:
[2025-12-30 20:52:11 +0530] info [cpaneld] 129.222.76.253 - dandaga1 "GET /login/?login_only=1&user=dandaga1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 30 20:51:24 host2 sshd[2099846]: Disconnected from invalid user admin 52.237.80.79 port 53278 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.253.191.249
country_id: 6252001
description:
[2025-12-30 20:51:57 +0530] info [cpaneld] 73.253.191.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.98.143
country_id: 6252001
description:
[2025-12-30 20:52:06 +0530] info [cpaneld] 172.59.98.143 - danda "GET /login/?login_only=1&user=danda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user danda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.137.189.167
country_id: 6252001
description:
[2025-12-30 20:52:12 +0530] info [cpaneld] 73.137.189.167 - dandaga2 "GET /login/?login_only=1&user=dandaga2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.231.65.198
country_id: 6252001
description:
[2025-12-30 20:52:01 +0530] info [whostmgrd] 69.231.65.198 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.69.85.132
country_id: 6252001
description:
[2025-12-30 20:52:05 +0530] info [cpaneld] 68.69.85.132 - dandag "GET /login/?login_only=1&user=dandag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.2.254.71
country_id: 6252001
description:
[2025-12-30 20:52:04 +0530] info [cpaneld] 68.2.254.71 - dandaga "GET /login/?login_only=1&user=dandaga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.252.151.43
country_id: 6252001
description:
[2025-12-30 20:52:08 +0530] info [cpaneld] 73.252.151.43 - dan "GET /login/?login_only=1&user=dan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.113.251.51
country_id: 6252001
description:
[2025-12-30 20:51:56 +0530] info [cpaneld] 207.113.251.51 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.115.181
country_id: 6252001
description:
[2025-12-30 20:52:00 +0530] info [cpaneld] 108.66.115.181 - dandagamuwa "GET /login/?login_only=1&user=dandagamuwa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuwa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.197.204.218
country_id: 6252001
description:
[2025-12-30 20:52:03 +0530] info [cpaneld] 72.197.204.218 - dandagam "GET /login/?login_only=1&user=dandagam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 20:52:34 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<8Ye87SxH+qOeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 30 20:52:34 host2 sshd[2100593]: Disconnected from invalid user dell 52.237.80.79 port 49070 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 30 20:52:39 host2 sshd[2100654]: Received disconnect from 103.144.247.233 port 53874:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 20:52:39 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<iQsC7ixHwKdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Dec 30 20:54:16 host2 sshd[2102196]: Disconnected from invalid user sysadmin 102.211.152.138 port 41784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec 30 20:54:32 host2 sshd[2102387]: Disconnected from invalid user github 45.249.247.165 port 43914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.247.165
country_id: 1819730
description:
Dec 30 20:55:14 host2 sshd[2103056]: Disconnected from invalid user deployer 45.249.247.165 port 57014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.186
country_id: 226074
description:
Dec 30 20:56:45 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=196.0.119.186, lip=66.85.158.91, TLS, session=<f/Gw+yxHhLnEAHe6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.112.138
country_id: 3865483
description:
Dec 30 20:57:10 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=190.110.112.138, lip=66.85.158.91, TLS, session=<KVEE/SxHu9O+bnCK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-30 20:57:22 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:38619: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-30 20:57:55 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:51240: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 20:59:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<q+N+Bi1HRIWi8Jp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.165.104
country_id: 6252001
description:
[2025-12-30 21:01:01 +0530] info [cpaneld] 67.188.165.104 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.148
country_id: 6252001
description:
[2025-12-30 21:01:03 +0530] info [whostmgrd] 172.58.212.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.233.170
country_id: 6252001
description:
[2025-12-30 21:01:11 +0530] info [cpaneld] 68.7.233.170 - mon "GET /login/?login_only=1&user=mon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.255.92.255
country_id: 6252001
description:
[2025-12-30 21:01:00 +0530] info [cpaneld] 68.255.92.255 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.140.11
country_id: 6252001
description:
[2025-12-30 21:01:02 +0530] info [cpaneld] 108.66.140.11 - monarchdss "GET /login/?login_only=1&user=monarchdss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.34.10.131
country_id: 6252001
description:
[2025-12-30 21:01:08 +0530] info [cpaneld] 100.34.10.131 - monar "GET /login/?login_only=1&user=monar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.204.240.105
country_id: 6252001
description:
[2025-12-30 21:01:14 +0530] info [cpaneld] 162.204.240.105 - monarch2 "GET /login/?login_only=1&user=monarch2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.181.57.46
country_id: 6252001
description:
[2025-12-30 21:01:13 +0530] info [cpaneld] 73.181.57.46 - monarch1 "GET /login/?login_only=1&user=monarch1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.141.48
country_id: 6252001
description:
[2025-12-30 21:01:07 +0530] info [cpaneld] 184.179.141.48 - monarc "GET /login/?login_only=1&user=monarc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.182.214.174
country_id: 6252001
description:
[2025-12-30 21:01:09 +0530] info [cpaneld] 97.182.214.174 - mona "GET /login/?login_only=1&user=mona&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mona (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.165.13
country_id: 6252001
description:
[2025-12-30 21:01:12 +0530] info [cpaneld] 98.97.165.13 - mo "GET /login/?login_only=1&user=mo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.174.209.184
country_id: 6252001
description:
[2025-12-30 21:01:04 +0530] info [cpaneld] 140.174.209.184 - monarchdsscom "GET /login/?login_only=1&user=monarchdsscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarchdsscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.79.241.91
country_id: 6252001
description:
[2025-12-30 21:01:06 +0530] info [cpaneld] 108.79.241.91 - monarch "GET /login/?login_only=1&user=monarch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.138.49
country_id: 6252001
description:
[2025-12-30 21:01:05 +0530] info [cpaneld] 140.228.138.49 - monarchd "GET /login/?login_only=1&user=monarchd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarchd (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 21:06:04 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<PH73HS1HONSYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Dec 30 21:07:49 host2 sshd[2114920]: Disconnected from invalid user chaitanya 45.78.201.248 port 42320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 21:09:02 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<HlOfKC1HfpWnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.150.217.20
country_id: 3017382
description:
Dec 30 21:08:20 host2 sshd[2115388]: Disconnected from invalid user wanghao 83.150.217.20 port 42186 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 21:08:58 host2 pure-ftpd[2115924]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 21:09:40 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0aDiKi1HuLAv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2025-12-30 21:09:52 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:33512: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.180.151
country_id: 2802361
description:
Dec 30 21:09:55 host2 pure-ftpd[2117150]: (?@35.195.180.151) [INFO] New connection from 35.195.180.151


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 30 21:09:17 host2 sshd[2116268]: Disconnected from invalid user ai 38.137.11.10 port 10952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 21:10:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<cytVLS1HYrMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 21:10:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ZrPZLS1HdKCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.226
country_id: 798544
description:
Dec 30 21:10:57 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.231.121.226, lip=66.85.158.91, TLS, session=<gX2VLi1Ht6Zb53ni>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 21:10:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<hy9ALS1HlJGeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-30 21:10:23 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:44987: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.237
country_id: 3469034
description:
Dec 30 21:10:29 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.120.73.237, lip=66.85.158.91, TLS, session=<cgzaLC1HnKm7eEnt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 21:11:23 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<V7sEMS1Hpt8v/AU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:14:06 host2 sshd[2121600]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.230.102.130
country_id: 3996063
description:
Dec 30 21:13:27 host2 sshd[2120991]: Disconnected from invalid user flash 187.230.102.130 port 36362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:13:45 host2 sshd[2121429]: Disconnected from invalid user ubuntu 168.197.99.226 port 60894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 21:14:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7J2yOi1HTwtniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:14:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<2BG7Oy1HG8+i2JYl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.150.217.20
country_id: 3017382
description:
Dec 30 21:14:38 host2 sshd[2122314]: Disconnected from invalid user frappe 83.150.217.20 port 47362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 21:14:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<rn3QPC1HTLgzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:14:55 host2 sshd[2122690]: Disconnected from invalid user ai 168.197.99.226 port 52372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.28.8
country_id: 3017382
description:
Dec 30 21:15:12 host2 sshd[2123144]: Disconnected from invalid user bbs 51.178.28.8 port 38372 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:15:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<lHH+Pi1HYu6i2JYl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:15:29 host2 sshd[2123462]: Disconnected from invalid user ts 168.197.99.226 port 43152 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.119.29.137
country_id: 6252001
description:
Dec 30 21:16:14 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=40.119.29.137, lip=66.85.158.91, TLS, session=<oAZwQi1Hrooodx2J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.28.8
country_id: 3017382
description:
Dec 30 21:16:15 host2 sshd[2124294]: Disconnected from invalid user vpn 51.178.28.8 port 44266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 30 21:17:37 host2 sshd[2125962]: Disconnected from invalid user deploy 165.232.178.116 port 49434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 21:17:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<PDcGSC1HnoIyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-30 21:17:58 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:40138: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 30 21:17:59 host2 sshd[2126360]: Disconnected from invalid user ubuntu 38.137.11.10 port 36036 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.47.111
country_id: 6252001
description:
Dec 30 21:18:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.29.47.111, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<d+KmSy1HsKIUHS9v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-30 21:18:15 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:42801: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 30 21:18:17 host2 sshd[2126798]: Disconnected from invalid user cristian 165.232.178.116 port 45862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:19:54 host2 sshd[2128937]: Disconnected from invalid user soporte 189.217.130.86 port 36409 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 21:20:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<5zv4US1HlI9CdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.115.157.22
country_id: 6252001
description:
[2025-12-30 21:20:50 +0530] info [cpaneld] 99.115.157.22 - euroent "GET /login/?login_only=1&user=euroent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:20:17 host2 sshd[2129773]: Disconnected from invalid user akshay 159.198.32.61 port 49220 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.76.154.205
country_id: 6252001
description:
[2025-12-30 21:20:46 +0530] info [whostmgrd] 108.76.154.205 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.179.50.142
country_id: 6252001
description:
[2025-12-30 21:20:45 +0530] info [cpaneld] 71.179.50.142 - euroentertainmentlk "GET /login/?login_only=1&user=euroentertainmentlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.92.235.130
country_id: 6252001
description:
[2025-12-30 21:20:49 +0530] info [cpaneld] 168.92.235.130 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.26.30
country_id: 6252001
description:
[2025-12-30 21:20:56 +0530] info [cpaneld] 98.97.26.30 - euro "GET /login/?login_only=1&user=euro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euro (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:20:11 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS, session=<M+qVUC1HOvqi2JYl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.240.154
country_id: 6252001
description:
[2025-12-30 21:20:42 +0530] info [cpaneld] 140.186.240.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.251.185.32
country_id: 6252001
description:
[2025-12-30 21:20:43 +0530] info [cpaneld] 108.251.185.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.117.101.175
country_id: 6252001
description:
[2025-12-30 21:20:53 +0530] info [cpaneld] 75.117.101.175 - euroen "GET /login/?login_only=1&user=euroen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.138.96.170
country_id: 6252001
description:
[2025-12-30 21:20:58 +0530] info [cpaneld] 76.138.96.170 - eu "GET /login/?login_only=1&user=eu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.195.77.134
country_id: 6252001
description:
[2025-12-30 21:21:00 +0530] info [cpaneld] 206.195.77.134 - euroent2 "GET /login/?login_only=1&user=euroent2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.226.242
country_id: 6252001
description:
[2025-12-30 21:20:48 +0530] info [cpaneld] 172.59.226.242 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.238.51.162
country_id: 6252001
description:
[2025-12-30 21:20:54 +0530] info [cpaneld] 96.238.51.162 - euroe "GET /login/?login_only=1&user=euroe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.122.234.75
country_id: 6252001
description:
[2025-12-30 21:20:57 +0530] info [cpaneld] 76.122.234.75 - eur "GET /login/?login_only=1&user=eur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.235.5.116
country_id: 6252001
description:
[2025-12-30 21:20:59 +0530] info [cpaneld] 162.235.5.116 - euroent1 "GET /login/?login_only=1&user=euroent1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 21:21:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<sdYdVC1HjZx100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:21:22 host2 sshd[2130843]: Disconnected from invalid user automation 159.198.32.61 port 44204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:22:59 host2 sshd[2132072]: Disconnected from invalid user dev 57.128.237.234 port 48788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:23:31 host2 sshd[2132437]: Disconnected from invalid user soporte 159.198.32.61 port 34164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:23:36 host2 sshd[2132472]: Disconnected from invalid user user 194.233.74.228 port 42278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:23:43 host2 sshd[2132558]: Disconnected from invalid user pwserver 189.217.130.86 port 47512 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.143
country_id: 6252001
description:
Dec 30 21:24:04 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.188.143, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CBd7Xi1HcqEs3LyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 30 21:24:05 host2 sshd[2132821]: Disconnected from invalid user fy 51.89.166.236 port 55530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:24:19 host2 sshd[2132993]: Disconnected from invalid user ubuntu 189.217.130.86 port 26448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:24:57 host2 sshd[2133394]: Disconnected from invalid user ubuntu 189.217.130.86 port 16915 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 21:25:01 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<1cvEYS1HerSeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:26:09 host2 sshd[2134442]: Disconnected from invalid user minecraft 189.217.130.86 port 41965 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.137.92.76
country_id: 6252001
description:
[2025-12-30 21:26:24 +0530] info [whostmgrd] 107.137.92.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.173.110.145
country_id: 6252001
description:
[2025-12-30 21:26:33 +0530] info [cpaneld] 70.173.110.145 - aj "GET /login/?login_only=1&user=aj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.199.205.184
country_id: 6252001
description:
[2025-12-30 21:26:25 +0530] info [cpaneld] 71.199.205.184 - ajsstarlogcom "GET /login/?login_only=1&user=ajsstarlogcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarlogcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.234.145.171
country_id: 6252001
description:
[2025-12-30 21:26:27 +0530] info [cpaneld] 69.234.145.171 - ajsstar "GET /login/?login_only=1&user=ajsstar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.64.76.91
country_id: 6252001
description:
[2025-12-30 21:26:30 +0530] info [cpaneld] 108.64.76.91 - ajsst "GET /login/?login_only=1&user=ajsst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.242.122.25
country_id: 6252001
description:
[2025-12-30 21:26:33 +0530] info [cpaneld] 97.242.122.25 - ajs "GET /login/?login_only=1&user=ajs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajs (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.63.241.40
country_id: 6252001
description:
[2025-12-30 21:26:35 +0530] info [cpaneld] 96.63.241.40 - ajsstar2 "GET /login/?login_only=1&user=ajsstar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec 30 21:26:51 host2 sshd[2135116]: Disconnected from invalid user joao 45.144.233.139 port 46012 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.102.186.210
country_id: 6252001
description:
[2025-12-30 21:26:21 +0530] info [cpaneld] 199.102.186.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.224.188.153
country_id: 6252001
description:
[2025-12-30 21:26:22 +0530] info [cpaneld] 167.224.188.153 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.46.182.59
country_id: 6252001
description:
[2025-12-30 21:26:26 +0530] info [cpaneld] 75.46.182.59 - ajsstarl "GET /login/?login_only=1&user=ajsstarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.31.86.126
country_id: 6252001
description:
[2025-12-30 21:26:31 +0530] info [cpaneld] 75.31.86.126 - ajss "GET /login/?login_only=1&user=ajss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Dec 30 21:26:41 host2 sshd[2134987]: Disconnected from invalid user aman 45.169.128.70 port 55634 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.111.198.218
country_id: 6252001
description:
[2025-12-30 21:26:23 +0530] info [cpaneld] 98.111.198.218 - ajsstarlog "GET /login/?login_only=1&user=ajsstarlog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.161.142.65
country_id: 6252001
description:
[2025-12-30 21:26:30 +0530] info [cpaneld] 98.161.142.65 - ajssta "GET /login/?login_only=1&user=ajssta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.222.14.68
country_id: 6252001
description:
[2025-12-30 21:26:34 +0530] info [cpaneld] 162.222.14.68 - ajsstar1 "GET /login/?login_only=1&user=ajsstar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Dec 30 21:27:25 host2 sshd[2135534]: Disconnected from invalid user git 45.169.128.70 port 42164 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:27:58 host2 sshd[2135884]: Received disconnect from 57.128.237.234 port 45684:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 30 21:27:13 host2 sshd[2135384]: Disconnected from invalid user ai 51.89.166.236 port 53144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec 30 21:27:20 host2 sshd[2135479]: Disconnected from invalid user fy 45.144.233.139 port 39046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:27:31 host2 sshd[2135614]: Disconnected from invalid user tina 57.128.237.234 port 56302 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.95
country_id: 6252001
description:
Dec 30 21:27:58 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.95, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Y+F0bC1HZ+lAPsVf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:29:00 host2 sshd[2136620]: Disconnected from invalid user ironman 194.233.74.228 port 48672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.92
country_id: 6252001
description:
Dec 30 21:28:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.92, lip=66.85.158.91, TLS handshaking: Connection closed, session=<O6qDbS1HqoBAPsVc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:28:19 host2 sshd[2136171]: Disconnected from invalid user ubuntu 194.233.74.228 port 44614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:28:26 host2 sshd[2136233]: Disconnected from invalid user ftptest 57.128.237.234 port 49302 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 30 21:29:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<AXgHcS1HQJLE+2YV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 21:30:31 host2 sshd[2137840]: Disconnected from invalid user user 2.57.121.25 port 14651 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 21:31:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rHVLeS1H0OWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 21:32:08 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<X8c0ey1HHoUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 21:33:04 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<vX2Rfi1H7HojupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:36:24 host2 sshd[2143790]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 21:39:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<YfjKky1Hep1nmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:39:39 host2 sshd[2146233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 21:39:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<u0UIly1HPJunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-30 21:40:12 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:58724: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 21:40:23 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Gfy8mC1HkLxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.199
country_id: 2186224
description:
2025-12-30 21:40:32 dovecot_login authenticator failed for H=([121.73.166.199]) [121.73.166.199]:56608: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.82.9.177
country_id: 6252001
description:
[2025-12-30 21:41:29 +0530] info [cpaneld] 192.82.9.177 - greenta1 "GET /login/?login_only=1&user=greenta1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.114.56.3
country_id: 6252001
description:
[2025-12-30 21:41:28 +0530] info [cpaneld] 71.114.56.3 - gr "GET /login/?login_only=1&user=gr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.209.92.59
country_id: 6252001
description:
[2025-12-30 21:41:13 +0530] info [cpaneld] 97.209.92.59 - greentaraceylon "GET /login/?login_only=1&user=greentaraceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.84.11.203
country_id: 6252001
description:
[2025-12-30 21:41:18 +0530] info [cpaneld] 135.84.11.203 - greenta "GET /login/?login_only=1&user=greenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.107.206
country_id: 6252001
description:
[2025-12-30 21:41:24 +0530] info [cpaneld] 172.56.107.206 - green "GET /login/?login_only=1&user=green&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user green (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.48.136.53
country_id: 6252001
description:
[2025-12-30 21:41:27 +0530] info [cpaneld] 173.48.136.53 - gre "GET /login/?login_only=1&user=gre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.22.235
country_id: 6252001
description:
[2025-12-30 21:41:15 +0530] info [whostmgrd] 73.241.22.235 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.167.116.23
country_id: 6252001
description:
[2025-12-30 21:41:26 +0530] info [cpaneld] 73.167.116.23 - gree "GET /login/?login_only=1&user=gree&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.2.149.7
country_id: 6252001
description:
[2025-12-30 21:41:11 +0530] info [cpaneld] 172.2.149.7 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.11.122.165
country_id: 6252001
description:
[2025-12-30 21:41:12 +0530] info [cpaneld] 73.11.122.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.107.199
country_id: 6252001
description:
[2025-12-30 21:41:16 +0530] info [cpaneld] 50.5.107.199 - greentaraceyloncom "GET /login/?login_only=1&user=greentaraceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.52.122.124
country_id: 6252001
description:
[2025-12-30 21:41:22 +0530] info [cpaneld] 184.52.122.124 - greent "GET /login/?login_only=1&user=greent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.45.106.159
country_id: 6252001
description:
[2025-12-30 21:41:17 +0530] info [cpaneld] 108.45.106.159 - greentar "GET /login/?login_only=1&user=greentar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.104.175.64
country_id: 6252001
description:
[2025-12-30 21:41:30 +0530] info [cpaneld] 99.104.175.64 - greenta2 "GET /login/?login_only=1&user=greenta2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 21:44:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<6FwUqC1HVs8FhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:45:57 host2 sshd[2151496]: Disconnected from invalid user cherry 187.120.37.209 port 25458 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 30 21:47:17 host2 sshd[2152336]: Disconnected from invalid user deluge 103.52.115.25 port 59460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 21:47:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VvA0sy1HynYjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:48:27 host2 sshd[2154069]: Disconnected from invalid user test1 187.33.59.116 port 35666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-30 21:48:46 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:50600: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2025-12-30 21:49:04 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:48314: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 21:49:38 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<CwzIuS1HdtQvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:49:16 host2 sshd[2154928]: Disconnected from invalid user artur 187.120.37.209 port 24821 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 21:49:33 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<A4aCuS1HzoCeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:50:36 host2 sshd[2168044]: Disconnected from invalid user de 187.120.37.209 port 24677 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:51:24 host2 sshd[2168635]: Disconnected from invalid user elasticsearch 187.33.59.116 port 58121 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.175.2
country_id: 6252001
description:
[2025-12-30 21:52:46 +0530] info [whostmgrd] 67.187.175.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.75.103.249
country_id: 6252001
description:
[2025-12-30 21:52:50 +0530] info [cpaneld] 38.75.103.249 - neotechl "GET /login/?login_only=1&user=neotechl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.204.248.136
country_id: 6252001
description:
[2025-12-30 21:52:59 +0530] info [cpaneld] 104.204.248.136 - ne "GET /login/?login_only=1&user=ne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.90.45.189
country_id: 6252001
description:
[2025-12-30 21:52:58 +0530] info [cpaneld] 75.90.45.189 - neo "GET /login/?login_only=1&user=neo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.238.230.8
country_id: 6252001
description:
[2025-12-30 21:52:43 +0530] info [cpaneld] 76.238.230.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.98.152
country_id: 6252001
description:
[2025-12-30 21:52:47 +0530] info [cpaneld] 24.4.98.152 - neotechlkcom "GET /login/?login_only=1&user=neotechlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.39.155.2
country_id: 6252001
description:
[2025-12-30 21:52:41 +0530] info [cpaneld] 75.39.155.2 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.47.173
country_id: 6252001
description:
[2025-12-30 21:52:54 +0530] info [cpaneld] 73.158.47.173 - neote "GET /login/?login_only=1&user=neote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.55.255.21
country_id: 6252001
description:
[2025-12-30 21:52:55 +0530] info [cpaneld] 75.55.255.21 - neot "GET /login/?login_only=1&user=neot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.144.1.14
country_id: 6252001
description:
[2025-12-30 21:52:44 +0530] info [cpaneld] 24.144.1.14 - neotechlk "GET /login/?login_only=1&user=neotechlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.141.79
country_id: 6252001
description:
[2025-12-30 21:52:51 +0530] info [cpaneld] 108.46.141.79 - neotech "GET /login/?login_only=1&user=neotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.68.205.13
country_id: 6252001
description:
[2025-12-30 21:52:52 +0530] info [cpaneld] 99.68.205.13 - neotec "GET /login/?login_only=1&user=neotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 21:54:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cZuayi1H1mto7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:55:01 host2 sshd[2171604]: Disconnected from invalid user ftpuser 187.33.59.116 port 60595 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:55:44 host2 sshd[2172231]: Disconnected from invalid user deployer 187.33.59.116 port 38502 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 21:56:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<mgrx0C1Hjk6i8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:57:47 host2 sshd[2173562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.157
country_id: 1880251
description:
Dec 30 22:03:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.157, lip=66.85.158.92, session=<AAYU6i1HPYxe586d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.207
country_id: 1880251
description:
Dec 30 22:03:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=94.231.206.207, lip=66.85.158.92, session=<2oi26i1HKcFe587P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.153
country_id: 1880251
description:
Dec 30 22:03:33 host2 dovecot[1836975]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.153, lip=66.85.158.92, session=<rGm16y1Hd6le586Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.152
country_id: 1880251
description:
Dec 30 22:03:37 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.152, lip=66.85.158.92, session=<733s6y1Hr7Ve586Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 22:05:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<6xIG9C1HQi1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 22:07:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<BYje+C1HjI2eRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.122.47.228
country_id: 6252001
description:
[2025-12-30 22:08:29 +0530] info [cpaneld] 216.122.47.228 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.103.113.86
country_id: 6252001
description:
[2025-12-30 22:08:33 +0530] info [whostmgrd] 137.103.113.86 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.241.161.31
country_id: 6252001
description:
[2025-12-30 22:08:36 +0530] info [cpaneld] 173.241.161.31 - ahavafo "GET /login/?login_only=1&user=ahavafo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.101.43.114
country_id: 6252001
description:
[2025-12-30 22:08:38 +0530] info [cpaneld] 216.101.43.114 - ahavaf "GET /login/?login_only=1&user=ahavaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavaf (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 22:08:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<2AaZ/C1H0pAv+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.154.2.144
country_id: 6252001
description:
[2025-12-30 22:08:30 +0530] info [cpaneld] 149.154.2.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.5.149
country_id: 6252001
description:
[2025-12-30 22:08:43 +0530] info [cpaneld] 38.194.5.149 - ah "GET /login/?login_only=1&user=ah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.39.108
country_id: 6252001
description:
[2025-12-30 22:08:45 +0530] info [cpaneld] 98.97.39.108 - ahavafo2 "GET /login/?login_only=1&user=ahavafo2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.255.11.99
country_id: 6252001
description:
[2025-12-30 22:08:39 +0530] info [cpaneld] 96.255.11.99 - ahava "GET /login/?login_only=1&user=ahava&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahava (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.228.165.100
country_id: 6252001
description:
[2025-12-30 22:08:40 +0530] info [cpaneld] 162.228.165.100 - ahav "GET /login/?login_only=1&user=ahav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.126.247
country_id: 6252001
description:
[2025-12-30 22:08:31 +0530] info [cpaneld] 129.222.126.247 - ahavafoundation "GET /login/?login_only=1&user=ahavafoundation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.43.71.191
country_id: 6252001
description:
[2025-12-30 22:08:34 +0530] info [cpaneld] 149.43.71.191 - ahavafoundationlk "GET /login/?login_only=1&user=ahavafoundationlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafoundationlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.68.191
country_id: 6252001
description:
[2025-12-30 22:08:35 +0530] info [cpaneld] 67.209.68.191 - ahavafou "GET /login/?login_only=1&user=ahavafou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.244.188
country_id: 6252001
description:
[2025-12-30 22:08:41 +0530] info [cpaneld] 69.181.244.188 - aha "GET /login/?login_only=1&user=aha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.225.203.227
country_id: 6252001
description:
[2025-12-30 22:08:44 +0530] info [cpaneld] 173.225.203.227 - ahavafo1 "GET /login/?login_only=1&user=ahavafo1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-30 22:11:44 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:53382: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.49
country_id: 3144096
description:
2025-12-30 22:11:54 dovecot_login authenticator failed for H=([84.211.13.49]) [84.211.13.49]:44646: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 22:12:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<h+qtDC5HCrczTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 22:12:24 host2 pure-ftpd[2185374]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 22:13:33 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lhhZDy5HVr4v/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.180.191.252
country_id: 6252001
description:
[2025-12-30 22:14:18 +0530] info [cpaneld] 135.180.191.252 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.79.96.252
country_id: 6252001
description:
[2025-12-30 22:14:22 +0530] info [cpaneld] 173.79.96.252 - lezzarot "GET /login/?login_only=1&user=lezzarot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.118.40
country_id: 6252001
description:
[2025-12-30 22:14:24 +0530] info [cpaneld] 107.216.118.40 - lezzar "GET /login/?login_only=1&user=lezzar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.213.243.74
country_id: 6252001
description:
[2025-12-30 22:14:25 +0530] info [cpaneld] 74.213.243.74 - lezza "GET /login/?login_only=1&user=lezza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.238.82.194
country_id: 6252001
description:
[2025-12-30 22:14:29 +0530] info [cpaneld] 24.238.82.194 - lezzaro1 "GET /login/?login_only=1&user=lezzaro1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.195.4
country_id: 6252001
description:
[2025-12-30 22:14:30 +0530] info [cpaneld] 70.170.195.4 - lezzaro2 "GET /login/?login_only=1&user=lezzaro2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.13.170.221
country_id: 6252001
description:
[2025-12-30 22:14:27 +0530] info [cpaneld] 172.13.170.221 - lez "GET /login/?login_only=1&user=lez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.237.35.92
country_id: 6252001
description:
[2025-12-30 22:14:19 +0530] info [cpaneld] 68.237.35.92 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.29.126
country_id: 6252001
description:
[2025-12-30 22:14:21 +0530] info [whostmgrd] 167.248.29.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.135.102
country_id: 6252001
description:
[2025-12-30 22:14:23 +0530] info [cpaneld] 216.49.135.102 - lezzaro "GET /login/?login_only=1&user=lezzaro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.26.205.236
country_id: 6252001
description:
[2025-12-30 22:14:26 +0530] info [cpaneld] 75.26.205.236 - lezz "GET /login/?login_only=1&user=lezz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.186.163.151
country_id: 6252001
description:
[2025-12-30 22:14:20 +0530] info [cpaneld] 71.186.163.151 - lezzarotech "GET /login/?login_only=1&user=lezzarotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.236.126.115
country_id: 6252001
description:
[2025-12-30 22:14:22 +0530] info [cpaneld] 69.236.126.115 - lezzarotechcom "GET /login/?login_only=1&user=lezzarotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.254.74
country_id: 6252001
description:
[2025-12-30 22:14:28 +0530] info [cpaneld] 73.205.254.74 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.174.29.15
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 192.174.29.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.239.76.43
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 141.239.76.43 - sobaher1 "GET /login/?login_only=1&user=sobaher1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.249.21
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.249.21 - sobah "GET /login/?login_only=1&user=sobah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.132.239.86
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.132.239.86 - sob "GET /login/?login_only=1&user=sob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sob (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.123.15.82
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 163.123.15.82 - sobaherb "GET /login/?login_only=1&user=sobaherb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.220.2.129
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.220.2.129 - sobaher "GET /login/?login_only=1&user=sobaher&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.2.64.24
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.2.64.24 - sobahe "GET /login/?login_only=1&user=sobahe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobahe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.159.209.79
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.159.209.79 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.112.138
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.112.138 - sobaherbal "GET /login/?login_only=1&user=sobaherbal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.62.160
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.170.62.160 - sobaherbalcom "GET /login/?login_only=1&user=sobaherbalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.62.68.17
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.62.68.17 - sobaher2 "GET /login/?login_only=1&user=sobaher2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.175.147.148
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.175.147.148 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.55.205
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.5.55.205 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.18.144.221
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.18.144.221 - asrgrouplk "GET /login/?login_only=1&user=asrgrouplk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrouplk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.200.244.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 151.200.244.16 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.210.130
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.2.210.130 - asrgrou "GET /login/?login_only=1&user=asrgrou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.61.78.33
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.61.78.33 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.90.156.247
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.90.156.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.185.233.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.185.233.122 - asrgroup "GET /login/?login_only=1&user=asrgroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.102.101.181
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.102.101.181 - asrgro "GET /login/?login_only=1&user=asrgro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.16.244.27
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.16.244.27 - asrgr "GET /login/?login_only=1&user=asrgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.0.5
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.0.5 - asrg "GET /login/?login_only=1&user=asrg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.109.67.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.109.67.89 - asr "GET /login/?login_only=1&user=asr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.226.106.167
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.226.106.167 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 22:23:08 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<aJeJMS5HoJZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 22:23:46 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<1bTdMy5H3uIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 22:24:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<SPfWNC5H+NeYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:24:30 host2 sshd[11325]: Disconnected from invalid user test 154.36.158.64 port 48500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 22:24:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Q0E1OC5HQIai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 22:29:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+qhISC5HRJcjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.49.220.61
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.49.220.61 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.63.205.14
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.63.205.14 - age "GET /login/?login_only=1&user=age&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user age (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.164.4
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.170.164.4 - agental1 "GET /login/?login_only=1&user=agental1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.215.161
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.46.215.161 - agentallianzcom "GET /login/?login_only=1&user=agentallianzcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentallianzcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.102.73.112
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.102.73.112 - agen "GET /login/?login_only=1&user=agen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.8.83
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.8.83 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.45.97.129
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.45.97.129 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.172.192.235
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.172.192.235 - agentallianz "GET /login/?login_only=1&user=agentallianz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User agentallianz has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.125.184.74
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.125.184.74 - agenta "GET /login/?login_only=1&user=agenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.252.221.6
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.252.221.6 - agent "GET /login/?login_only=1&user=agent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.47.35.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 156.47.35.141 - agental2 "GET /login/?login_only=1&user=agental2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:30:11 host2 sshd[13981]: Disconnected from invalid user admin 154.36.158.64 port 57342 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.226.112.102
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 66.226.112.102 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.184.33.124
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.184.33.124 - agentall "GET /login/?login_only=1&user=agentall&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentall (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.63.175.86
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.63.175.86 - agental "GET /login/?login_only=1&user=agental&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:31:34 host2 sshd[15129]: Disconnected from invalid user ali 154.36.158.64 port 56410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-30 22:32:08 dovecot_plain authenticator failed for H=(gurersess) [12.150.243.22]:54890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 22:34:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<b5uRWC5HOotn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 22:34:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<pNK8WC5HaIpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 22:34:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<L5I+Wi5H1LUv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:35:27 host2 sshd[18577]: Disconnected from invalid user ubuntu 154.36.158.64 port 49426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:36:08 host2 sshd[19107]: Disconnected from invalid user postgres 154.36.158.64 port 41972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 22:38:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<pjMlZy5HSpqeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 30 22:40:21 host2 sshd[22388]: Disconnected from invalid user cssserver 103.171.85.115 port 41852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-30 22:41:46 dovecot_plain authenticator failed for H=c-76-106-163-189.hsd1.fl.comcast.net (urerize) [76.106.163.189]:46184: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2025-12-30 22:42:00 dovecot_login authenticator failed for H=(cm-178.232.148.129.get.no) [178.232.148.129]:60992: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 30 22:41:11 host2 sshd[22997]: Disconnected from invalid user story 103.171.85.115 port 39698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-30 22:42:15 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:42673: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-30 22:42:42 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:33601: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 30 22:42:06 host2 sshd[23560]: Disconnected from invalid user ftp-user 103.171.85.115 port 45758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 22:44:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<d5f3fC5HLssjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 22:45:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<8NlggC5HbNSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 22:46:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<8KNhhC5HcN2eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-30 22:49:19 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:13767: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.84.186
country_id: 294640
description:
2025-12-30 22:50:04 dovecot_login authenticator failed for H=(2-54-84-186.orange.net.il) [2.54.84.186]:36726: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.219.234.249
country_id: 6252001
description:
[2025-12-30 22:51:16 +0530] info [cpaneld] 104.219.234.249 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 22:52:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<8Y7gmy5HBsOeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 22:52:58 host2 sshd[33474]: Disconnected from invalid user breonna 62.60.131.157 port 38335 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 22:52:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<UNKImS5HSnCi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 22:52:41 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<HKtAmy5HIKUFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-12-30 22:52:43 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (incyl) [71.229.43.123]:36644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 22:53:34 host2 sshd[34133]: Disconnected from invalid user admin 2.57.121.112 port 10433 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.17.227
country_id: 1643084
description:
Dec 30 22:55:14 host2 sshd[35989]: Disconnected from invalid user julien 222.124.17.227 port 44188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 30 22:56:09 host2 sshd[36933]: Disconnected from invalid user sdbadmin 142.93.126.22 port 35686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 22:56:18 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<C2U3qC5HruRo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Dec 30 22:56:41 host2 sshd[37340]: Disconnected from invalid user test2 8.243.64.226 port 43408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 22:57:32 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<RDOfrC5HKhFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 22:57:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Qn/0rS5HFMYvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 222.124.17.227
country_id: 1643084
description:
Dec 30 22:59:11 host2 sshd[39117]: Disconnected from invalid user elsearch 222.124.17.227 port 50586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.98.75
country_id: 3057568
description:
Dec 30 23:00:17 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=31.134.98.75, lip=66.85.158.91, TLS, session=<4fSUtS5HOBAfhmJL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.213
country_id: 3469034
description:
Dec 30 23:00:55 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<charanaw>, method=PLAIN, rip=190.89.136.213, lip=66.85.158.91, TLS, session=<h0Y6ty5HEYa+WYjV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Dec 30 23:01:12 host2 sshd[41006]: Disconnected from invalid user alpha 8.243.64.226 port 51696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:02:58 host2 sshd[42109]: Disconnected from invalid user alpha 130.250.191.234 port 43646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.64.226
country_id: 3686110
description:
Dec 30 23:02:29 host2 sshd[41819]: Disconnected from invalid user admin 8.243.64.226 port 46402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Dec 30 23:03:11 host2 sshd[42428]: Disconnected from invalid user mhd 8.243.64.226 port 52864 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.137.173
country_id: 6252001
description:
[2025-12-30 23:03:29 +0530] info [whostmgrd] 104.5.137.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.213.86.123
country_id: 6252001
description:
[2025-12-30 23:03:31 +0530] info [cpaneld] 47.213.86.123 - saar "GET /login/?login_only=1&user=saar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.37.178
country_id: 6252001
description:
[2025-12-30 23:03:32 +0530] info [cpaneld] 98.97.37.178 - saa "GET /login/?login_only=1&user=saa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.25.99.136
country_id: 6252001
description:
[2025-12-30 23:03:35 +0530] info [cpaneld] 75.25.99.136 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:03:42 host2 sshd[42809]: Disconnected from invalid user admin 130.250.191.234 port 56500 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.96.183.248
country_id: 6252001
description:
[2025-12-30 23:03:25 +0530] info [cpaneld] 199.96.183.248 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.132.131.24
country_id: 6252001
description:
[2025-12-30 23:03:28 +0530] info [cpaneld] 76.132.131.24 - saara "GET /login/?login_only=1&user=saara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.215.228.119
country_id: 6252001
description:
[2025-12-30 23:03:26 +0530] info [cpaneld] 74.215.228.119 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.128.233.172
country_id: 6252001
description:
[2025-12-30 23:03:30 +0530] info [cpaneld] 107.128.233.172 - saaralk "GET /login/?login_only=1&user=saaralk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saaralk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 23:04:26 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<qRFMxS5HrpieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 23:06:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<igFpyy5Hft8v+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.240
country_id: 6252001
description:
Dec 30 23:07:35 host2 pure-ftpd[45552]: (?@198.235.24.240) [INFO] New connection from 198.235.24.240


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:07:43 host2 sshd[45609]: Disconnected from invalid user admin 130.250.191.234 port 43814 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:07:03 host2 sshd[45219]: Disconnected from invalid user admin 130.250.191.234 port 57274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:08:23 host2 sshd[46032]: Disconnected from invalid user mhd 130.250.191.234 port 50302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Dec 30 23:10:35 host2 sshd[47863]: Disconnected from invalid user paulo 64.227.139.157 port 36476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 23:12:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<mjcT4i5Hkvl100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.7.106
country_id: 1269750
description:
Dec 30 23:14:33 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.207.7.106, lip=66.85.158.91, TLS, session=<gSN76C5Hj65nzwdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.157
country_id: 3865483
description:
Dec 30 23:14:12 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.0.249.157, lip=66.85.158.91, TLS, session=<PTwa5y5HXMWzAPmd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 23:15:32 host2 pure-ftpd[51934]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[43408] [Authentication Database]=[mail] [Username]=[webmaster@lankaherbalsolutions.com] (11/10 failures) (blocked until [Wed Dec 31 17:45:43 2025 UTC/Wed Dec 31 23:15:43 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 23:15:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<NXzD7S5HkKkv/AU1>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[42102] [Authentication Database]=[mail] [Username]=[no-reply@lankaherbalsolutions.com] (10/10 failures) (blocked until [Wed Dec 31 17:46:53 2025 UTC/Wed Dec 31 23:16:53 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 23:16:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<kWz28S5HdqQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 23:17:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<0D1a8i5HHs6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 23:18:41 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<K/xC+C5Hir+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.151.168
country_id: 6252001
description:
2025-12-30 23:19:09 dovecot_login authenticator failed for H=47-145-151-168.fdr01.blpk.ca.ip.frontiernet.net [47.145.151.168]:45906: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-12-30 23:19:52 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:57418: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 23:21:23 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Ki7tAS9H3MozTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.117.114
country_id: 3865483
description:
2025-12-30 23:22:03 dovecot_login authenticator failed for H=(red.170.233.117.114.ssservicios.com.ar) [170.233.117.114]:54269: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-30 23:22:22 dovecot_login authenticator failed for H=([188.124.142.221]) [188.124.142.221]:43605: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 23:25:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<HIuhES9HjMBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 23:26:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7WOKEi9HZJkjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[39268] [Authentication Database]=[mail] [Username]=[support@anandaobauae.org] (12/10 failures) (blocked until [Wed Dec 31 17:56:00 2025 UTC/Wed Dec 31 23:26:00 2025 LOCAL])


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 23:27:37 host2 sshd[61624]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 23:27:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5K1FGS9Hyuln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 23:28:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ji8WHS9H9N9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 23:30:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<DFQMIS9HWNoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 30 23:34:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<eCREMi9HwpIFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 23:36:49 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dvQZOS9HysAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 30 23:38:37 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<0ueLPy9H6KvE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-30 23:40:33 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:47740: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 23:40:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<GUG7Ry9H9uMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-30 23:41:03 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:63548: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 23:41:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<BQGTSy9HnNGYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.74.192.200
country_id: 2186224
description:
2025-12-30 23:41:21 dovecot_login authenticator failed for H=([202.74.192.200]) [202.74.192.200]:36391: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 23:44:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<aAvhUi9HWIieRdY+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 23:45:41 host2 sshd[77099]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 23:48:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<oabzYS9HgBKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 23:49:08 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<skolZS9Hqjxniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.19.19.75
country_id: 3175395
description:
Dec 30 23:49:31 host2 sshd[81118]: Disconnected from invalid user erp 87.19.19.75 port 44268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.239.10.198
country_id: 357994
description:
2025-12-30 23:50:32 dovecot_login authenticator failed for H=([154.239.10.205]) [154.239.10.198]:59564: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-30 23:51:03 dovecot_login authenticator failed for H=([115.247.159.106]) [115.247.159.106]:32972: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-30 23:53:02 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (graph) [24.1.200.187]:48430: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-30 23:53:21 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:50525: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 30 23:53:25 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<GOJzdC9H0p7E+2YX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.19.19.75
country_id: 3175395
description:
Dec 30 23:53:40 host2 sshd[85237]: Disconnected from invalid user elasticsearch 87.19.19.75 port 35820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2025-12-30 23:53:55 dovecot_login authenticator failed for H=(cm-178.232.148.129.get.no) [178.232.148.129]:45966: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.19.19.75
country_id: 3175395
description:
Dec 30 23:54:47 host2 sshd[86609]: Disconnected from invalid user lighthouse 87.19.19.75 port 33762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.19.19.75
country_id: 3175395
description:
Dec 30 23:55:21 host2 sshd[87277]: Disconnected from invalid user esmat 87.19.19.75 port 44866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2025-12-30 23:58:04 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:46444: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-30 23:58:17 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:51617: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 00:00:38 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<QM9Dji9HvoNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 00:00:53 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<5qYnjy9HeLYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 00:01:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<aP6Tki9H0JaeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 00:05:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<jLbnnS9HbsAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 00:05:05 host2 sshd[97035]: Disconnected from invalid user admin 2.57.121.112 port 50887 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.157.139.221
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 175.157.139.221 - fhbhealt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 00:07:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<adyhpS9HXrkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 00:07:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<wjjkpS9H2qCeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 00:08:38 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<n3Lkqi9HgWB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 00:12:33 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<wAzluC9H0pSi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 00:18:18 host2 pure-ftpd[111510]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-31 00:18:25 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:55928: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-31 00:18:15 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:45274: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 00:19:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3pdE0C9HTrkv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 00:20:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Ozec1i9HBLEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 00:22:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<iP+E2y9HuLpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 00:22:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<31bI3C9H3OGeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 00:23:19 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EtNe3y9HxuCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 00:23:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<58wE4C9HQq8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 00:24:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<33ms4i9H3LZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 00:25:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<upaz5i9HBt0zTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 00:26:07 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59680: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Dec 31 00:29:12 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<clmW9C9HIvOnXpI6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 00:29:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<O1sj9y9HPMNCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 31 00:33:28 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<zSDQAzBHtjtChJmN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 00:37:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<mDCIEzBHUMgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 00:38:38 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<neUtFjBHGDUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 00:40:40 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<r4lvHTBHNoIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 00:41:22 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<A8bzHzBHNLaeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 00:41:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<UT5sITBHnBZniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.81
country_id: 6252001
description:
Dec 31 00:42:13 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.81, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<P5UiIzBHEcHG6xhR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 00:44:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<I1YoLDBHSpyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2025-12-31 00:48:47 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [102.132.29.166]:64827: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.24.210.58
country_id: 6252001
description:
2025-12-31 00:48:58 dovecot_login authenticator failed for H=72-24-210-58.cpe.sparklight.net [72.24.210.58]:49057: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.244.170
country_id: 2921044
description:
Dec 31 00:54:49 host2 pure-ftpd[149766]: (?@209.38.244.170) [INFO] New connection from 209.38.244.170


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.199.186
country_id: 2921044
description:
Dec 31 00:54:48 host2 pure-ftpd[149759]: (?@46.101.199.186) [INFO] New connection from 46.101.199.186


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 00:56:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<bS6CVTBHTsanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-31 00:58:22 dovecot_login authenticator failed for H=([125.20.183.201]) [27.123.90.94]:38658: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.244.246
country_id: 2921044
description:
Dec 31 00:58:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.244.246, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<7C5TXTBHr4rRJvT2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-31 00:58:48 dovecot_login authenticator failed for H=([182.95.178.154]) [182.95.178.154]:44890: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 00:59:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<v6WgYDBH8KieRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-31 00:59:53 dovecot_plain authenticator failed for H=(farsequal) [64.72.74.162]:44475: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.193.56
country_id: 2921044
description:
Dec 31 00:59:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.193.56, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tk58XzBHmhkuZcE4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 01:01:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Ez/7ZzBHJqqYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-31 01:01:48 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (anrismomb) [73.197.236.163]:51050: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:04:15 host2 sshd[160236]: Disconnected from invalid user taufik 103.210.21.178 port 52656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 01:05:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<CgOBdDBHALV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 01:05:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<kqGndDBHlKEv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.114.56.148
country_id: 6251999
description:
Dec 31 01:05:12 host2 sshd[161983]: Disconnected from invalid user botuser 167.114.56.148 port 57384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 01:05:36 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<VOCidjBHYvJo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 31 01:05:53 host2 sshd[162887]: Disconnected from invalid user bot 12.189.234.28 port 35892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 31 01:06:38 host2 sshd[163670]: Disconnected from invalid user steam 152.32.239.90 port 48154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 01:06:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Q+gHezBHALmi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 31 01:07:14 host2 sshd[164296]: Disconnected from invalid user taufik 152.32.239.90 port 59766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 31 01:09:34 host2 sshd[166505]: Disconnected from invalid user sri 152.32.239.90 port 51582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 31 01:09:08 host2 sshd[166122]: Disconnected from invalid user taufik 12.189.234.28 port 42825 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.102.4.12
country_id: 298795
description:
Dec 31 01:09:31 host2 sshd[166443]: Disconnected from invalid user sambauser 94.102.4.12 port 57954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 31 01:09:34 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<5cz1hDBHe/7CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:09:43 host2 sshd[166647]: Disconnected from invalid user app 103.210.21.178 port 51384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:10:20 host2 sshd[167529]: Disconnected from invalid user bitwarden 103.210.21.178 port 51806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 01:10:46 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<VOAYiTBHIK8FhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:10:56 host2 sshd[168255]: Disconnected from invalid user botuser 103.210.21.178 port 44072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 31 01:10:10 host2 sshd[167303]: Disconnected from invalid user 3 12.189.234.28 port 54463 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:11:30 host2 sshd[168855]: Disconnected from invalid user ubuntu 103.210.21.178 port 59844 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 01:15:17 host2 sshd[173691]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.88
country_id: 6252001
description:
Dec 31 01:15:49 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.88, lip=66.85.158.92, session=<H9NMmzBH14xAPpxY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 31 01:16:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.92, TLS: Connection closed, session=<ssr9mzBH9n9APpxQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-12-31 01:16:37 dovecot_login authenticator failed for H=([118.26.153.102]) [118.26.153.102]:52514: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 31 01:16:24 host2 sshd[175086]: Disconnected from invalid user user7 198.98.56.227 port 49712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Dec 31 01:16:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.137, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PkoEnjBHMHhAPsWJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Dec 31 01:16:54 host2 dovecot[1566]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, session=<ZWYpnzBHZk6s7ORz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 31 01:16:13 host2 dovecot[1566]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.92, session=<ms66nDBHYkhAPpxQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-12-31 01:16:15 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:47632: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.140
country_id: 6252001
description:
Dec 31 01:16:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.140, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SBHxnDBHff9APsWM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 01:17:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<MUatnzBHEutn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.254.237
country_id: 2658434
description:
Dec 31 01:17:18 host2 pure-ftpd[176046]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.254.237
country_id: 2658434
description:
Dec 31 01:17:22 host2 pure-ftpd[176117]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 31 01:17:56 host2 sshd[176714]: Disconnected from invalid user amir 198.98.56.227 port 45166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 01:18:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<OU+ppTBHJLEvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:19:03 host2 sshd[178037]: Disconnected from invalid user dad 66.42.241.199 port 47434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:19:33 host2 sshd[178508]: Disconnected from invalid user testuser 66.42.241.199 port 34038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 01:19:48 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<KJpiqTBHzoNnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:20:03 host2 sshd[179232]: Disconnected from invalid user lol 66.42.241.199 port 59294 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 01:20:26 host2 pure-ftpd[179758]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:20:33 host2 sshd[179865]: Disconnected from invalid user samba 66.42.241.199 port 54534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Dec 31 01:21:12 host2 sshd[180601]: Disconnected from invalid user zwj 43.240.13.18 port 37322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:21:38 host2 sshd[181013]: Disconnected from invalid user payroll 66.42.241.199 port 42922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 01:21:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5ntMsDBHcOAjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Dec 31 01:22:47 host2 sshd[182324]: Disconnected from invalid user ubuntu 187.170.3.81 port 48100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.170.3.81
country_id: 3996063
description:
Dec 31 01:23:52 host2 sshd[183612]: Disconnected from invalid user zs 187.170.3.81 port 60306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 01:24:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<O2iTuDBHEJQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 01:26:26 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<j8gjwTBHGKQzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.123
country_id: 6252001
description:
Dec 31 01:26:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.123, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cT1jwjBHtdbG6xh7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Dec 31 01:29:04 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wh6lyjBH0mVAPpyO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Dec 31 01:29:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pb6lyzBHqIxAPpyO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 01:30:58 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<VTdd0TBHOp4zTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.154.114
country_id: 6251999
description:
Dec 31 01:32:41 host2 dovecot[1566]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=147.182.154.114, lip=66.85.158.91, TLS, session=<rzqa1zBHkN6Ttppy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 01:33:15 host2 sshd[195786]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.240.13.18
country_id: 1819730
description:
Dec 31 01:34:12 host2 sshd[196762]: Disconnected from invalid user runner 43.240.13.18 port 53774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 01:34:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<DDfR3TBHD0Fniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 01:34:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<lpbT3jBHMrJCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.81
country_id: 953987
description:
Dec 31 01:34:59 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=102.64.34.81, lip=66.85.158.91, TLS, session=<De2x3jBHRLpmQCJR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.132.11
country_id: 99237
description:
Dec 31 01:35:18 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=65.20.132.11, lip=66.85.158.91, TLS, session=<vNvu3zBHfeVBFIQL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 01:36:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hidh5jBHqocjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Dec 31 01:37:51 host2 sshd[201159]: Disconnected from invalid user pt 43.240.13.18 port 47890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 01:38:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<sI7C6zBH8uKeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 31 01:38:57 host2 sshd[202208]: Disconnected from invalid user user 2.57.121.25 port 25962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 01:39:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<LLtx7jBHzMieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 01:41:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<eZ0G9zBHlP2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 31 01:43:22 host2 sshd[206771]: Disconnected from invalid user next 172.200.228.35 port 49468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 01:45:40 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<KfLtBTFHRrsv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.44.98.97
country_id: 1861060
description:
2025-12-31 01:46:37 dovecot_login authenticator failed for H=v163-44-98-97.4zjh.static.cnode.jp [163.44.98.97]:46218: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 01:46:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<PYPKCTFHHosyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 31 01:46:52 host2 sshd[210893]: Disconnected from invalid user rui 172.200.228.35 port 53824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-31 01:46:56 dovecot_login authenticator failed for H=(cm-84.211.11.216.get.no) [84.211.11.216]:56862: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 31 01:47:25 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<7xQzDDFHmtUFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:49:43 host2 sshd[214097]: Disconnected from invalid user minh 172.96.182.111 port 59900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 01:53:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<slFYITFH2qeeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:53:31 host2 sshd[218648]: Disconnected from invalid user User 172.96.182.111 port 46760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:54:34 host2 sshd[220161]: Disconnected from invalid user sshuser 172.96.182.111 port 42586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:55:36 host2 sshd[221446]: Disconnected from invalid user rose 172.96.182.111 port 38586 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:56:06 host2 sshd[222272]: Received disconnect from 172.96.182.111 port 50616:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 01:57:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<VXbPLjFHosOeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 31 01:57:09 host2 sshd[224086]: Disconnected from invalid user user7 103.172.204.220 port 39438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-31 01:57:55 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:59988: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-31 01:58:21 dovecot_login authenticator failed for H=179-125-169-77.static.desktop.com.br [179.125.169.77]:41193: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 31 01:59:19 host2 sshd[226958]: Disconnected from invalid user borg 103.172.204.220 port 53408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.150
country_id: 3865483
description:
Dec 31 02:00:48 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.124.218.150, lip=66.85.158.91, TLS, session=<j7YROzFHu7+6fNqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 02:00:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<wfVjOjFHINui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.184
country_id: 953987
description:
Dec 31 02:00:28 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.129.53.184, lip=66.85.158.91, TLS, session=<PZ+nOTFH4JlmgTW4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 02:00:39 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<v75wOzFH1+R100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 02:03:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<0s0fRzFHUMunrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 02:06:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<cjoMUDFHdIMv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2025-12-31 02:09:10 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:60928: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.72.168.219
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 72.72.168.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-31 02:09:31 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br [187.126.105.42]:55237: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 02:10:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<v27qXzFH9JNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 02:12:04 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<wnBQZDFHVMdn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.12.135
country_id: 2077456
description:
2025-12-31 02:14:04 dovecot_login authenticator failed for H=([101.168.12.135]) [101.168.12.135]:51754: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 31 02:14:12 host2 sshd[244337]: Disconnected from invalid user esp 103.91.246.101 port 50802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-31 02:14:38 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net [51.68.226.171]:58964: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 02:15:58 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<XjFBcjFH4spnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 31 02:16:06 host2 sshd[246705]: Disconnected from invalid user steam 103.91.246.101 port 40320 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Dec 31 02:19:49 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.91, session=<CuAqgDFHBNVAPpyi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 02:19:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0TddgDFHmMIjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Dec 31 02:20:14 host2 dovecot[1566]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.91, session=<zJKngTFHcApAPpyi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 02:20:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<fyPggTFHUpUFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 31 02:22:47 host2 sshd[254542]: Disconnected from invalid user test2 103.91.246.101 port 55578 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 02:22:56 host2 pure-ftpd[254723]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 02:23:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<ndErjDFHBKaYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 31 02:23:22 host2 sshd[255304]: Disconnected from invalid user ubuntu 103.91.246.101 port 51754 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 02:27:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<0RySmjFHJyBniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 02:27:30 host2 sshd[260332]: Disconnected from invalid user admin 2.57.121.112 port 65414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.182.89
country_id: 2921044
description:
Dec 31 02:29:58 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.182.89, lip=66.85.158.91, session=<Pfx5pDFHVRCkXLZZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.65.144
country_id: 2921044
description:
Dec 31 02:29:59 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.65.144, lip=66.85.158.91, session=<NI1/pDFHVreGekGQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 02:29:40 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SwFHozFHhuQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 31 02:29:46 host2 sshd[263193]: Disconnected from invalid user dev 210.79.142.221 port 37276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 02:30:13 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<aWc/pTFHgqgvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.101
country_id: 1819730
description:
Dec 31 02:31:49 host2 sshd[265791]: Disconnected from invalid user deploy 154.83.15.101 port 50974 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 31 02:32:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<1mGrqzFHTqDE+2YT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 02:33:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<EBuPrzFHfOEzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 31 02:33:21 host2 sshd[267736]: Disconnected from invalid user daniel 107.155.55.174 port 60972 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 31 02:33:32 host2 sshd[267924]: Disconnected from invalid user git 210.79.142.221 port 56594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 31 02:34:17 host2 sshd[268996]: Disconnected from invalid user git 210.79.142.221 port 35550 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.227.142
country_id: 2921044
description:
Dec 31 02:34:25 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=209.38.227.142, lip=66.85.158.91, session=<zZtbtDFHExzRJuOO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.65.144
country_id: 2921044
description:
Dec 31 02:34:26 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.65.144, lip=66.85.158.91, session=<SaJrtDFHHmiGekGQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 31 02:35:41 host2 sshd[270855]: Disconnected from invalid user ubuntu 107.155.55.174 port 47492 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 02:35:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sXFUtzFH5qUjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.214.62
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.214.62] [Remote Port]=[57668] [Authentication Database]=[mail] [Username]=[webmaster@melanifinefood.com] (12/10 failures) (blocked until [Wed Dec 31 21:06:56 2025 UTC/Thu Jan  1 02:36:56 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 02:36:58 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<yvFhvTFHROGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 02:36:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<XEV4vDFHAMunrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.101
country_id: 1819730
description:
Dec 31 02:36:45 host2 sshd[272058]: Disconnected from invalid user bitrix 154.83.15.101 port 33830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 31 02:37:07 host2 sshd[272651]: Disconnected from invalid user sysadmin 210.79.142.221 port 41810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 02:37:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<0B4SwDFHkr8zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.101
country_id: 1819730
description:
Dec 31 02:37:58 host2 sshd[273630]: Disconnected from invalid user centos 154.83.15.101 port 33806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2025-12-31 02:38:00 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:36546: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-31 02:38:15 dovecot_login authenticator failed for H=([102.38.3.179]) [102.38.3.179]:47478: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.50
country_id: 1643084
description:
Dec 31 02:38:31 host2 sshd[274274]: Disconnected from invalid user sftp 103.171.85.50 port 60682 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 31 02:38:34 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS: Connection closed, session=<Nv4+wzFHJp9ChJl5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 02:38:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<PwOYxDFHCpOi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.50
country_id: 1643084
description:
Dec 31 02:39:19 host2 sshd[275347]: Disconnected from invalid user bitrix 103.171.85.50 port 42272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 02:39:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<gz4UxjFHQM1CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 31 02:41:26 host2 sshd[278057]: Disconnected from invalid user ali 107.155.55.174 port 57468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.212
country_id: 1643084
description:
Dec 31 02:42:20 host2 sshd[279140]: Disconnected from invalid user ubuntu 157.20.32.212 port 45730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.50
country_id: 1643084
description:
Dec 31 02:45:47 host2 sshd[283763]: Disconnected from invalid user centos 103.171.85.50 port 52550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-12-31 02:45:53 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:49434: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 31 02:45:12 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oAb02jFHZE+4affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-12-31 02:45:25 dovecot_login authenticator failed for H=([152.52.234.180]) [182.95.177.118]:54334: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.32.212
country_id: 1643084
description:
Dec 31 02:48:45 host2 sshd[287291]: Disconnected from invalid user daniel 157.20.32.212 port 36000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.17.157.40
country_id: 630336
description:
2025-12-31 02:49:30 dovecot_login authenticator failed for H=([134.17.157.40]) [134.17.157.40]:51140: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.50
country_id: 1643084
description:
Dec 31 02:49:31 host2 sshd[288284]: Disconnected from invalid user jenkins 103.171.85.50 port 33996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-31 02:49:47 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca [148.170.156.248]:43194: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.155.1.17
country_id: 357994
description:
2025-12-31 02:49:54 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [196.155.1.17]:27460: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-31 02:49:18 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:48618: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 02:51:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<q8yN8jFHSr8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 02:54:41 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tfC4/DFHwp6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 02:55:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Ilps/jFHfsSeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-31 02:55:59 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (flexsitale) [87.103.126.54]:51012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 02:56:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<EvSQATJH1q0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 02:56:36 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<HrqSAzJHlFd100Db>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 03:02:14 host2 sshd[303282]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-31 03:04:29 dovecot_plain authenticator failed for H=(lonred) [5.11.141.74]:55038: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.248.36
country_id: 2921044
description:
Dec 31 03:04:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=46.101.248.36, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mn87ITJHKGouZfgk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 03:07:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<2LscKTJHaMSeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 03:07:36 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DbLpKjJHKr9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 172.58.144.203
country_id: 6252001
description:
Dec 31 03:08:12 host2 dovecot[1566]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=172.58.144.203, lip=66.85.158.91, TLS, session=<PvgVLTJHpbCsOpDL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 03:09:39 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<CUtAMjJHXtMv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.133.25
country_id: 357994
description:
2025-12-31 03:14:31 dovecot_login authenticator failed for H=([41.65.118.172]) [41.239.133.25]:52496: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-31 03:14:50 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:60146: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 03:15:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<iA3CRTJHLv1o7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.64
country_id: 6252001
description:
Dec 31 03:18:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.64, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<64F6UTJHesSTuYRA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 03:19:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DOlFVDJHAngjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 03:20:07 host2 sshd[324437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 03:20:23 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<sI+gWDJH/y9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 03:21:37 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Tx8NXTJHRM6eRdGr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 03:25:28 host2 pure-ftpd[330725]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.73.108
country_id: 294640
description:
2025-12-31 03:27:32 dovecot_login authenticator failed for H=(2-55-73-108.orange.net.il) [2.55.73.108]:52440: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-31 03:28:07 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:38106: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-12-31 03:29:14 dovecot_plain authenticator failed for H=(nocon) [84.238.92.245]:58273: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 03:29:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<6Dg+ejJHOOgFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-31 03:29:53 dovecot_plain authenticator failed for H=(nerolitoku) [50.231.243.28]:49778: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 03:34:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<KIVzizJHLkAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 03:35:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<iX7sjTJHvo2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 03:35:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<4ppPkDJHOKQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 03:36:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<cPoPkzJH3Bei8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:37:22 host2 sshd[344962]: Disconnected from invalid user github 63.142.241.161 port 46086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 03:39:31 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<98UOnTJHIrAzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:39:37 host2 sshd[347452]: Disconnected from invalid user admin 63.142.241.161 port 44100 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.117
country_id: 6252001
description:
Dec 31 03:40:41 host2 pure-ftpd[348810]: (?@198.235.24.117) [INFO] New connection from 198.235.24.117


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:41:20 host2 sshd[349395]: Disconnected from invalid user roman 63.142.241.161 port 40486 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 03:43:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<0ISfqTJHxKIvWBNS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.238.230
country_id: 6252001
description:
Dec 31 03:42:07 host2 pure-ftpd[350304]: (?@161.35.238.230) [INFO] New connection from 161.35.238.230


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 03:42:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<1kuApjJHrOGnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:42:29 host2 sshd[350655]: Disconnected from invalid user rafael 63.142.241.161 port 47646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:43:34 host2 sshd[351808]: Disconnected from invalid user claude 63.142.241.161 port 54384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 03:44:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JFlsrTJH0JAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 03:44:34 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<vS8mrzJHTr1CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.173
country_id: 6251999
description:
2025-12-31 03:45:30 dovecot_login authenticator failed for H=([207.134.139.173]) [207.134.139.173]:47369: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.70
country_id: 1269750
description:
2025-12-31 03:45:44 dovecot_login authenticator failed for H=(nsg-corporate-70.116.187.122.airtel.in) [122.187.116.70]:48836: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 03:47:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<42ASuTJHAIKYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 03:48:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<azjRvTJHZp+i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 31 03:50:52 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<EESwxTJHtrnE+2YU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 03:52:33 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<TxC2yzJHlJZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 03:53:32 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<KhA0zzJHHsOeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.164.120
country_id: 6252001
description:
Dec 31 03:54:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=206.189.164.120, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2Rgy0jJHLtXOvaR4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.92.128
country_id: 6252001
description:
Dec 31 03:54:21 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.89.92.128, lip=66.85.158.91, TLS: Connection closed, session=<YfM/0jJHjNqfWVyA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Dec 31 03:56:05 host2 pure-ftpd[369553]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 03:58:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jKYq3zJHeKYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 03:58:26 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59081: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.72.97
country_id: 6252001
description:
Dec 31 04:02:23 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=178.128.72.97, lip=66.85.158.91, TLS, session=<J4X67jJHXOSygEhh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 04:03:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Nhte8TJH9oRn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.0.5
country_id: 6252001
description:
Dec 31 04:03:55 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=134.209.0.5, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<LtV59DJHiuuG0QAF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 169.255.57.132
country_id: 2328926
description:
Dec 31 04:04:38 host2 sshd[379836]: Disconnected from invalid user testuser 169.255.57.132 port 47346 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.197.40
country_id: 3469034
description:
Dec 31 04:04:59 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.93.197.40, lip=66.85.158.91, TLS, session=<jHws9zJHasCxXcUo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.200
country_id: 953987
description:
Dec 31 04:05:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.37.200, lip=66.85.158.91, TLS, session=<wIVo+DJHmORmQCXI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 04:05:25 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<jH2x+TJHnpsyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 31 04:06:12 host2 sshd[382219]: Disconnected from invalid user spider 36.91.81.195 port 37152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-31 04:07:48 dovecot_login authenticator failed for H=([182.95.54.10]) [182.95.54.10]:43084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 169.255.57.132
country_id: 2328926
description:
Dec 31 04:07:14 host2 sshd[383272]: Disconnected from invalid user sig 169.255.57.132 port 39730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-31 04:08:08 dovecot_login authenticator failed for H=([62.97.161.159]) [62.97.161.159]:54885: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-31 04:08:20 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (lime36.static.otenet.gr) [62.103.27.217]:62097: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 31 04:09:03 host2 sshd[385124]: Disconnected from invalid user elena 36.91.81.195 port 56878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 31 04:09:43 host2 sshd[385823]: Disconnected from invalid user ubuntu 146.59.95.254 port 47374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 04:09:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<o1XGCTNH9oZnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 169.255.57.132
country_id: 2328926
description:
Dec 31 04:09:07 host2 sshd[385180]: Disconnected from invalid user spider 169.255.57.132 port 54116 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 169.255.57.132
country_id: 2328926
description:
Dec 31 04:10:16 host2 sshd[386600]: Disconnected from invalid user administrador 169.255.57.132 port 51636 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.61.238
country_id: 6252001
description:
Dec 31 04:10:47 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.61.238, lip=66.85.158.92, TLS: Connection closed, session=<uNUHDTNHMOud5j3u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.155.151
country_id: 6252001
description:
Dec 31 04:10:47 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=157.230.155.151, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<b5gKDTNH5NOd5puX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 31 04:10:56 host2 sshd[387664]: Disconnected from invalid user luis 36.91.81.195 port 40510 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 31 04:11:45 host2 sshd[388921]: Received disconnect from 146.59.95.254 port 45012:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 04:13:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<NZ3eFzNHmw9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 04:13:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<0icFGDNH7tWnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 04:13:13 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<9iuZFTNHSrUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-31 04:13:22 dovecot_login authenticator failed for H=(nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:52834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-31 04:13:48 dovecot_login authenticator failed for H=([95.164.177.6]) [95.164.177.6]:34248: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.152.20
country_id: 6252001
description:
Dec 31 04:14:43 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.105.152.20, lip=66.85.158.92, TLS, session=<BPwSGzNHZMqsaZgU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 23.92.30.226
country_id: 6252001
description:
Dec 31 04:16:08 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=23.92.30.226, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<TfQiIDNHbuUXXB7i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.5.238.101
country_id: 3175395
description:
2025-12-31 04:18:52 dovecot_login authenticator failed for H=host-87-5-238-101.retail.telecomitalia.it [87.5.238.101]:43706: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 04:19:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<TZRFKjNHTP1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 04:18:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<e1RlJzNHosUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.78.232
country_id: 690791
description:
Dec 31 04:18:22 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=194.44.78.232, lip=66.85.158.91, TLS, session=<lOgrJzNHWqnCLE7o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-31 04:18:41 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:45280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.115
country_id: 3865483
description:
Dec 31 04:18:45 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=179.0.250.115, lip=66.85.158.91, TLS, session=<Yf5NKDNHdLyzAPpz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 04:28:01 host2 pure-ftpd[412670]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-31 04:31:04 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:55445: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.109.23
country_id: 1512440
description:
2025-12-31 04:31:21 dovecot_login authenticator failed for H=([213.230.109.23]) [213.230.109.23]:47935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 04:33:16 host2 sshd[420207]: Disconnected from invalid user admin 2.57.121.112 port 20307 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 04:33:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<QWjHXTNHDpueRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 04:33:34 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<K6VdXjNHEmQjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2025-12-31 04:34:15 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:43916: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 04:34:25 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<32lpYTNHuMueRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 04:34:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9Eh6YjNHaCmi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-31 04:34:55 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:41354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.168.100.250
country_id: 6252001
description:
[2025-12-31 04:39:25 +0530] info [cpaneld] 206.168.100.250 - ayuzo "GET /login/?login_only=1&user=ayuzo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.59.142.120
country_id: 6252001
description:
[2025-12-31 04:39:26 +0530] info [cpaneld] 198.59.142.120 - ayuz "GET /login/?login_only=1&user=ayuz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.100.167
country_id: 6252001
description:
[2025-12-31 04:39:12 +0530] info [cpaneld] 74.105.100.167 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.48.36.189
country_id: 6252001
description:
[2025-12-31 04:39:15 +0530] info [whostmgrd] 99.48.36.189 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.70.40.149
country_id: 6252001
description:
[2025-12-31 04:39:16 +0530] info [cpaneld] 75.70.40.149 - ayuzonel "GET /login/?login_only=1&user=ayuzonel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.186.229.108
country_id: 6252001
description:
[2025-12-31 04:39:22 +0530] info [cpaneld] 99.186.229.108 - ayuzon "GET /login/?login_only=1&user=ayuzon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.41.46.147
country_id: 6252001
description:
[2025-12-31 04:39:28 +0530] info [cpaneld] 38.41.46.147 - ay "GET /login/?login_only=1&user=ay&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ay (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.23.178.240
country_id: 6252001
description:
[2025-12-31 04:39:29 +0530] info [cpaneld] 24.23.178.240 - ayuzone1 "GET /login/?login_only=1&user=ayuzone1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 04:39:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<gDh0dDNHMu0FhXlo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.51.44
country_id: 6252001
description:
[2025-12-31 04:39:13 +0530] info [cpaneld] 184.164.51.44 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.110.224.138
country_id: 6252001
description:
[2025-12-31 04:39:16 +0530] info [cpaneld] 99.110.224.138 - ayuzonelankacom "GET /login/?login_only=1&user=ayuzonelankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.120.194.79
country_id: 6252001
description:
[2025-12-31 04:39:30 +0530] info [cpaneld] 23.120.194.79 - ayuzone2 "GET /login/?login_only=1&user=ayuzone2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.180.234.134
country_id: 6252001
description:
[2025-12-31 04:39:14 +0530] info [cpaneld] 135.180.234.134 - ayuzonelanka "GET /login/?login_only=1&user=ayuzonelanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.6.2.251
country_id: 6252001
description:
[2025-12-31 04:39:21 +0530] info [cpaneld] 64.6.2.251 - ayuzone "GET /login/?login_only=1&user=ayuzone&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.0.48
country_id: 6252001
description:
[2025-12-31 04:39:27 +0530] info [cpaneld] 98.97.0.48 - ayu "GET /login/?login_only=1&user=ayu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 04:41:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<hXntezNHVpgv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-31 04:42:28 dovecot_login authenticator failed for H=([187.161.173.2]) [187.161.173.2]:46768: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 04:42:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<9pJRfjNHWuyi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-31 04:43:08 dovecot_login authenticator failed for H=([179.185.18.67]) [179.185.18.67]:47982: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 04:45:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<fJpZiTNHEOMzTcpt>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 04:49:01 host2 sshd[441052]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 04:48:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BGI/kzNHP8h100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 04:49:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<QHUtljNHVIyeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 04:49:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<koH5ljNHHuNCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 04:50:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<DsG2mTNHrKszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 04:51:28 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<lv5onjNHktmeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 04:56:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4CborjNHRp8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 04:58:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<KeUjuTNHioZn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.123
country_id: 6252001
description:
Dec 31 04:59:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.123, lip=66.85.158.91, session=<PPh9uTNHj+DDuEx7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.127
country_id: 6252001
description:
Dec 31 04:59:11 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.127, lip=66.85.158.91, session=<6PcYujNHJarDuEx/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.97
country_id: 6252001
description:
Dec 31 04:59:24 host2 dovecot[1566]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.97, lip=66.85.158.91, session=<36HdujNHr9rDuExh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.127
country_id: 6252001
description:
Dec 31 04:59:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.127, lip=66.85.158.91, session=<W6gNuzNH2eLDuEx/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 05:03:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<J07qyjNHNrAv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 3.115.231.158
country_id: 1861060
description:
Dec 31 05:05:56 host2 sshd[459597]: Disconnected from invalid user ali 3.115.231.158 port 52550 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 05:06:51 host2 sshd[460656]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 05:07:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4tz21jNHEzpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 05:06:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nU7n1DNHhMdnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 3.115.231.158
country_id: 1861060
description:
Dec 31 05:07:47 host2 sshd[461599]: Disconnected from invalid user steam 3.115.231.158 port 46818 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:08:09 host2 sshd[462069]: Received disconnect from 102.211.209.191 port 35386:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:09:06 host2 sshd[463014]: Disconnected from invalid user Test 102.211.209.191 port 36298 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - gemtrail "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtrail (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-12-31 05:10:11 dovecot_login authenticator failed for H=([213.227.245.154]) [213.227.245.154]:50268: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 3.115.231.158
country_id: 1861060
description:
Dec 31 05:10:51 host2 sshd[464896]: Disconnected from invalid user david 3.115.231.158 port 41714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-31 05:10:23 dovecot_login authenticator failed for H=([62.97.170.80]) [62.97.170.80]:53627: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:10:32 host2 sshd[464604]: Disconnected from invalid user teste 102.211.209.191 port 48026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.65.144
country_id: 2921044
description:
Dec 31 05:11:42 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=134.122.65.144, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3Yvb5jNHKB6GekGQ>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:12:56 host2 sshd[467350]: Received disconnect from 102.211.209.191 port 37950:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:12:28 host2 sshd[466830]: Disconnected from invalid user es 102.211.209.191 port 52186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 05:12:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<yLuO6TNHJt+YNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.77
country_id: 6252001
description:
Dec 31 05:13:45 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.77, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V/A27jNH+9nN0h9N>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:13:25 host2 sshd[467861]: Disconnected from invalid user ubuntu 102.211.209.191 port 42752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:15:16 host2 sshd[469851]: Disconnected from invalid user ubuntu 102.211.209.191 port 50078 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 05:15:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<WX8n8zNHDt4yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 05:16:53 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ZAJH+TNHYJYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 05:17:22 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<j8MI+zNHCOYjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2025-12-31 05:18:48 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:46078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-31 05:19:03 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:42368: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 05:20:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<BhLxBDRHaN2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 05:22:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Mvs1DjRHNito7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Dec 31 05:26:09 host2 sshd[481346]: Disconnected from invalid user ubuntu 177.130.248.114 port 48632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-31 05:25:27 dovecot_plain authenticator failed for H=(ingsormang) [154.144.255.208]:56752: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 31 05:26:05 host2 sshd[481291]: Disconnected from invalid user mailuser 196.204.240.61 port 34334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 31 05:27:21 host2 sshd[482518]: Disconnected from invalid user opennms 162.240.39.179 port 41456 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.183
country_id: 2635167
description:
Dec 31 05:27:44 host2 dovecot[1566]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.183, lip=66.85.158.91, TLS, session=<D441IDRHzeu594m3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 31 05:28:07 host2 sshd[483396]: Disconnected from invalid user szy 125.21.59.218 port 56170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:28:11 host2 sshd[483462]: Disconnected from invalid user pt 186.87.166.141 port 36328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 31 05:28:44 host2 sshd[484114]: Disconnected from invalid user ivan 125.21.59.218 port 41656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:28:51 host2 sshd[484228]: Disconnected from invalid user jamshid 186.87.166.141 port 47904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 31 05:29:20 host2 sshd[484728]: Disconnected from invalid user user 125.21.59.218 port 55370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 31 05:29:27 host2 sshd[484884]: Disconnected from invalid user devuser 162.240.39.179 port 33102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Dec 31 05:29:39 host2 sshd[485044]: Disconnected from invalid user rocky 85.133.253.204 port 40402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:30:11 host2 sshd[485760]: Disconnected from invalid user hassan 186.87.166.141 port 42822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 31 05:30:34 host2 sshd[486138]: Disconnected from invalid user opennms 125.21.59.218 port 54568 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 05:30:34 host2 pure-ftpd[486166]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 31 05:31:03 host2 sshd[486646]: Disconnected from invalid user mailuser 162.240.39.179 port 40954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 31 05:30:31 host2 sshd[486105]: Disconnected from invalid user ubuntu 162.240.39.179 port 57156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:30:51 host2 sshd[486385]: Disconnected from invalid user victor 186.87.166.141 port 54400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 05:31:42 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<XDhNLjRHDqmeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 05:32:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<2u6KLzRHXlWi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:32:12 host2 sshd[487667]: Disconnected from invalid user opennms 186.87.166.141 port 49316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Dec 31 05:31:26 host2 sshd[486958]: Disconnected from invalid user james 85.133.253.204 port 57222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 05:32:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+gyYMjRHXEAjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.204.240.61
country_id: 357994
description:
Dec 31 05:33:01 host2 sshd[488647]: Disconnected from invalid user ivan 196.204.240.61 port 36890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Dec 31 05:32:27 host2 sshd[487902]: Disconnected from invalid user mdm 85.133.253.204 port 52880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 31 05:33:36 host2 sshd[489219]: Disconnected from invalid user pt 196.204.240.61 port 38922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Dec 31 05:33:50 host2 sshd[489435]: Disconnected from invalid user opennms 177.130.248.114 port 47652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Dec 31 05:35:09 host2 sshd[490852]: Disconnected from invalid user mailuser 177.130.248.114 port 48642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Dec 31 05:34:24 host2 sshd[489994]: Disconnected from invalid user monit 85.133.253.204 port 55778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 05:36:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<MrFgPjRHmLui8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.130.248.114
country_id: 3469034
description:
Dec 31 05:36:31 host2 sshd[492371]: Disconnected from invalid user pt 177.130.248.114 port 49662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 31 05:38:17 host2 sshd[494121]: Disconnected from invalid user furukawa 128.1.132.137 port 47172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.84.160.91
country_id: 1605651
description:
2025-12-31 05:39:39 dovecot_login authenticator failed for H=([185.84.160.91]) [185.84.160.91]:36226: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2025-12-31 05:40:08 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:55268: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-31 05:40:36 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:45007: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.43.27
country_id: 3144096
description:
2025-12-31 05:40:50 dovecot_login authenticator failed for H=(cm-178.232.43.27.get.no) [178.232.43.27]:47716: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-31 05:40:25 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:38346: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 05:43:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<B6e0WTRH6TJ100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 31 05:43:53 host2 sshd[500040]: Disconnected from invalid user composer 128.1.132.137 port 44288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 31 05:46:44 host2 sshd[503669]: Disconnected from invalid user neeraj 128.1.132.137 port 40186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.111.216
country_id: 226074
description:
2025-12-31 05:48:57 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [102.209.111.216]:1429: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 05:48:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lmrCaTRH8tYv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 31 05:48:24 host2 sshd[505467]: Disconnected from invalid user bitrix 128.1.132.137 port 39328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.136.169
country_id: 6252001
description:
Dec 31 05:48:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.22.136.169, lip=66.85.158.92, TLS: Connection closed, session=<BwtUazRHgrOlFoip>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 05:49:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<+GBbbzRHCK2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 05:50:18 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<XpDOcDRHDoMFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 05:52:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<+Q3qdzRH1NMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 05:52:31 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<pH+9eDRHzLGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 05:55:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<1J04gzRH3LBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 05:56:53 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<motPiDRHkuszTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-31 05:59:10 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-31 05:59:46 dovecot_login authenticator failed for H=([177.44.71.244]) [177.44.71.244]:40328: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.24.183.76
country_id: 6252001
description:
2025-12-31 06:00:18 dovecot_login authenticator failed for H=(173-24-183-76.client.mchsi.com) [173.24.183.76]:38060: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 06:01:26 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<iTubmDRHexdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 06:02:34 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ozKonDRHKIaeRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.234.200.125
country_id: 6252001
description:
[2025-12-31 06:03:47 +0530] info [cpaneld] 216.234.200.125 - nsteele "GET /login/?login_only=1&user=nsteele&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteele (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.66.69.169
country_id: 6252001
description:
[2025-12-31 06:03:40 +0530] info [cpaneld] 207.66.69.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.231.43.92
country_id: 6252001
description:
[2025-12-31 06:03:43 +0530] info [whostmgrd] 67.231.43.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.98.247.213
country_id: 6252001
description:
[2025-12-31 06:03:42 +0530] info [cpaneld] 68.98.247.213 - nsteeleng "GET /login/?login_only=1&user=nsteeleng&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.106.199.55
country_id: 6252001
description:
[2025-12-31 06:03:44 +0530] info [cpaneld] 70.106.199.55 - nsteelengcom "GET /login/?login_only=1&user=nsteelengcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteelengcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.130.24.56
country_id: 6252001
description:
[2025-12-31 06:03:50 +0530] info [cpaneld] 107.130.24.56 - nste "GET /login/?login_only=1&user=nste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.3.181.117
country_id: 6252001
description:
[2025-12-31 06:03:45 +0530] info [cpaneld] 172.3.181.117 - nsteelen "GET /login/?login_only=1&user=nsteelen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteelen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.29.170.217
country_id: 6252001
description:
[2025-12-31 06:03:48 +0530] info [cpaneld] 76.29.170.217 - nsteel "GET /login/?login_only=1&user=nsteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.41.147.54
country_id: 6252001
description:
[2025-12-31 06:03:51 +0530] info [cpaneld] 158.41.147.54 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.223.175.242
country_id: 6252001
description:
[2025-12-31 06:03:52 +0530] info [cpaneld] 74.223.175.242 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.172.181.89
country_id: 6252001
description:
[2025-12-31 06:03:41 +0530] info [cpaneld] 67.172.181.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.157.216
country_id: 6252001
description:
[2025-12-31 06:03:49 +0530] info [cpaneld] 174.160.157.216 - nstee "GET /login/?login_only=1&user=nstee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstee (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 06:05:19 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<s6R8pjRHQN5nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-12-31 06:07:57 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:35038: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.199.69.186
country_id: 6252001
description:
Dec 31 06:08:04 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.199.69.186, lip=66.85.158.91, TLS: Connection closed, session=</Oh6sDRH6ObGx0W6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-31 06:07:39 dovecot_login authenticator failed for H=([178.232.188.10]) [178.232.188.10]:33791: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 06:09:26 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<jQgztTRH9JsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.51
country_id: 3175395
description:
Dec 31 06:10:30 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.124.182.51, lip=66.85.158.91, TLS, session=<sbEruDRHhOW5fLYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 06:10:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eJS8uTRHsKEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.82.82
country_id: 2328926
description:
Dec 31 06:10:49 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=41.76.82.82, lip=66.85.158.91, TLS, session=<RzhEuTRHpZ8pTFJS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.19
country_id: 3865483
description:
Dec 31 06:11:13 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=179.0.252.19, lip=66.85.158.91, TLS, session=<yM15ujRHyMuzAPwT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.150.104
country_id: 6252001
description:
Dec 31 06:11:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.79.150.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<bJWSvTRHmKwtT5Zo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.75
country_id: 3469034
description:
Dec 31 06:11:53 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng>, method=PLAIN, rip=191.53.131.75, lip=66.85.158.91, TLS, session=<LCaavDRH3aO/NYNL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 06:14:00 host2 sshd[534645]: Disconnected from invalid user admin 2.57.121.112 port 60779 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Dec 31 06:15:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JDj2yjRHidqTuYRG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.244.206
country_id: 6252001
description:
Dec 31 06:15:39 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.127.244.206, lip=66.85.158.92, session=<i8KMyzRHwMgUf/TO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 06:16:39 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<lVX/zjRH2NcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 06:17:41 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<F5iy0jRHdoSeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.133.25
country_id: 357994
description:
2025-12-31 06:18:06 dovecot_plain authenticator failed for H=(cultrums) [41.239.133.25]:40542: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.207
country_id: 6252001
description:
Dec 31 06:18:23 host2 pure-ftpd[539639]: (?@147.185.132.207) [INFO] New connection from 147.185.132.207


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.116
country_id: 6252001
description:
Dec 31 06:23:15 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.116, lip=66.85.158.91, session=<L47B5jRHUsAUQcJ0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.17
country_id: 3175395
description:
Dec 31 06:24:02 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=195.177.113.17, lip=66.85.158.91, TLS, session=<AESJ6DRHb5LDsXER>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.127
country_id: 2300660
description:
Dec 31 06:24:22 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.44.127, lip=66.85.158.91, TLS, session=<Q7Wm6TRHe9Mpiyx/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 06:26:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<zV3m8TRHnLUyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 06:27:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<jPFC9zRHsH5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 06:29:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<uP2A+zRHtuWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 06:30:18 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<gmTf/zRH0IqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 06:30:42 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<I/lKATVHsrai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 06:32:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ZuZxBjVHdF0jupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 06:33:10 host2 pure-ftpd[555000]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 31 06:33:36 host2 sshd[555365]: Disconnected from invalid user user 2.57.121.25 port 38950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2025-12-31 06:37:05 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:59172: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-31 06:37:23 dovecot_login authenticator failed for H=([182.76.69.209]) [128.185.228.134]:54320: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 06:38:28 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<mlYFHTVHOOaYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 06:39:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Re/1ITVHPLx100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.214.128.30
country_id: 6252001
description:
[2025-12-31 06:44:57 +0530] info [cpaneld] 207.214.128.30 - clou "GET /login/?login_only=1&user=clou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.126.88.222
country_id: 6252001
description:
[2025-12-31 06:45:03 +0530] info [cpaneld] 76.126.88.222 - cloudto2 "GET /login/?login_only=1&user=cloudto2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.71.183.238
country_id: 6252001
description:
[2025-12-31 06:44:47 +0530] info [cpaneld] 209.71.183.238 - cloudtourssrilanka "GET /login/?login_only=1&user=cloudtourssrilanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilanka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.4.52.9
country_id: 6252001
description:
[2025-12-31 06:44:46 +0530] info [cpaneld] 50.4.52.9 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.213.57.56
country_id: 6252001
description:
[2025-12-31 06:44:55 +0530] info [cpaneld] 162.213.57.56 - cloudt "GET /login/?login_only=1&user=cloudt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.194.159.216
country_id: 6252001
description:
[2025-12-31 06:44:54 +0530] info [cpaneld] 107.194.159.216 - cloudto "GET /login/?login_only=1&user=cloudto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 06:44:24 host2 sshd[566784]: Disconnected from invalid user admin 2.57.121.112 port 30784 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.20.85.156
country_id: 6252001
description:
[2025-12-31 06:44:45 +0530] info [cpaneld] 47.20.85.156 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.75.133.154
country_id: 6252001
description:
[2025-12-31 06:44:51 +0530] info [cpaneld] 108.75.133.154 - cloudtourssrilankacom "GET /login/?login_only=1&user=cloudtourssrilankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.2.61
country_id: 6252001
description:
[2025-12-31 06:44:59 +0530] info [cpaneld] 172.56.2.61 - cl "GET /login/?login_only=1&user=cl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.209.8.96
country_id: 6252001
description:
[2025-12-31 06:44:58 +0530] info [cpaneld] 107.209.8.96 - clo "GET /login/?login_only=1&user=clo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.169.142
country_id: 6252001
description:
[2025-12-31 06:45:01 +0530] info [cpaneld] 38.194.169.142 - cloudto1 "GET /login/?login_only=1&user=cloudto1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.210.87
country_id: 6252001
description:
[2025-12-31 06:44:50 +0530] info [whostmgrd] 172.58.210.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.131.199
country_id: 6252001
description:
[2025-12-31 06:44:53 +0530] info [cpaneld] 172.59.131.199 - cloudtou "GET /login/?login_only=1&user=cloudtou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.108.2.163
country_id: 6252001
description:
[2025-12-31 06:44:56 +0530] info [cpaneld] 68.108.2.163 - cloud "GET /login/?login_only=1&user=cloud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloud (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 06:49:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Edi6QjVH1sKeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-31 06:50:58 dovecot_login authenticator failed for H=([182.95.20.115]) [182.95.229.142]:58288: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 06:51:56 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Vsg5TTVHVppn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-31 06:51:32 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:46110: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 06:55:13 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<xfXsWDVHQUVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 06:55:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<K93pWTVHfr4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 06:58:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1y8nZDVHWqxCdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.36.4
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.151.36.4 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.237.80.61
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 24.237.80.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.184.14.123
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.184.14.123 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.138.194.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 207.138.194.146 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.118.57.1
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.118.57.1 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.51.30
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.51.30 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.176.17.131
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.176.17.131 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.117.86.157
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 152.117.86.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.22.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 167.248.22.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.180.73
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.160.180.73 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.178.24.251
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.178.24.251 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.118.157
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.118.157 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 07:00:28 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<EJ6zazVHToIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 07:01:23 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<j6P8bjVH7sgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 07:04:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<++VseDVHjM5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 07:05:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<mIRvfDVHjOszTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-31 07:06:09 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (essnum) [24.15.216.41]:42308: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 31 07:06:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<pC5JgTVHvprE+2YY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.215.230.159
country_id: 6252001
description:
[2025-12-31 07:08:04 +0530] info [whostmgrd] 107.215.230.159 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.179.254.219
country_id: 6252001
description:
[2025-12-31 07:08:03 +0530] info [cpaneld] 104.179.254.219 - ksoft "GET /login/?login_only=1&user=ksoft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.81.0
country_id: 6252001
description:
[2025-12-31 07:08:06 +0530] info [cpaneld] 172.56.81.0 - ksof "GET /login/?login_only=1&user=ksof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.200.246
country_id: 6252001
description:
[2025-12-31 07:08:07 +0530] info [cpaneld] 107.216.200.246 - kso "GET /login/?login_only=1&user=kso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.146.111
country_id: 6252001
description:
[2025-12-31 07:08:01 +0530] info [cpaneld] 140.186.146.111 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.19.176.57
country_id: 6252001
description:
[2025-12-31 07:08:02 +0530] info [cpaneld] 76.19.176.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.9.132.101
country_id: 6252001
description:
[2025-12-31 07:08:05 +0530] info [cpaneld] 75.9.132.101 - ksoftweblk "GET /login/?login_only=1&user=ksoftweblk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoftweblk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.10.18.111
country_id: 6252001
description:
[2025-12-31 07:08:09 +0530] info [cpaneld] 24.10.18.111 - ks "GET /login/?login_only=1&user=ks&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ks (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2025-12-31 07:08:29 dovecot_login authenticator failed for H=a4.ucndns.in [103.252.168.4]:60386: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-31 07:08:50 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:59155: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.237.143.40
country_id: 798544
description:
Dec 31 07:15:03 host2 sshd[602105]: Disconnected from invalid user sshuser 185.237.143.40 port 56686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 31 07:15:13 host2 sshd[602275]: Disconnected from invalid user ubuntu 35.210.61.208 port 48112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 07:14:37 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58454: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.151.221
country_id: 3175395
description:
Dec 31 07:14:46 host2 sshd[601669]: Disconnected from invalid user remote 151.43.151.221 port 54442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 07:15:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OjU2ozVH+nwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.10.36.217
country_id: 1643084
description:
Dec 31 07:16:58 host2 sshd[604181]: Disconnected from invalid user liyang 202.10.36.217 port 35884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.222
country_id: 1819730
description:
Dec 31 07:17:50 host2 sshd[604985]: Disconnected from invalid user github 152.32.135.222 port 54332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 31 07:17:54 host2 sshd[605122]: Disconnected from invalid user mikey 35.210.61.208 port 44868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 07:18:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<aOOXqjVHAJcv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 31 07:18:03 host2 sshd[605340]: Disconnected from invalid user sftpuser 52.224.240.74 port 51174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.135.222
country_id: 1819730
description:
Dec 31 07:18:30 host2 sshd[605760]: Disconnected from invalid user grid 152.32.135.222 port 13242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 31 07:19:00 host2 sshd[606256]: Disconnected from invalid user clouduser 35.210.61.208 port 44440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.222
country_id: 1819730
description:
Dec 31 07:20:20 host2 sshd[607908]: Disconnected from invalid user manager 152.32.135.222 port 54974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Dec 31 07:20:57 host2 sshd[608572]: Disconnected from invalid user clouduser 51.75.253.68 port 54382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 31 07:20:58 host2 sshd[608581]: Disconnected from invalid user otrs 59.97.205.137 port 37736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.246.198.97
country_id: 1861060
description:
Dec 31 07:21:19 host2 sshd[609017]: Disconnected from invalid user ubuntu 43.246.198.97 port 60152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.72
country_id: 1880251
description:
Dec 31 07:20:31 host2 sshd[608103]: Disconnected from invalid user VPN 101.47.143.72 port 43772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.237.143.40
country_id: 798544
description:
Dec 31 07:20:41 host2 sshd[608279]: Disconnected from invalid user samuel 185.237.143.40 port 38298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.194.5
country_id: 3508796
description:
Dec 31 07:20:44 host2 sshd[608345]: Disconnected from invalid user manager 45.169.194.5 port 44186 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 31 07:21:03 host2 sshd[608724]: Disconnected from invalid user ehsan 35.210.61.208 port 43482 [preauth]


