# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.82.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.148.82.180 - visionsolut "GET /login/?login_only=1&user=visionsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.16.86.190
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.16.86.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.205.85.137
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.205.85.137 - seyawi "GET /login/?login_only=1&user=seyawi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.174.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.40.174.133 - se "GET /login/?login_only=1&user=se&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user se (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.31.173.14
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.31.173.14 - visionsolutionsh "GET /login/?login_only=1&user=visionsolutionsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.22.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.149.22.67 - visionsolutions "GET /login/?login_only=1&user=visionsolutions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.196.143.211
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 142.196.143.211 - seyawincom "GET /login/?login_only=1&user=seyawincom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawincom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.117.174.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.117.174.73 - vision "GET /login/?login_only=1&user=vision&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vision (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.220.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.152.220.11 - visio "GET /login/?login_only=1&user=visio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.197.123.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.197.123.143 - visi "GET /login/?login_only=1&user=visi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.19.59.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.19.59.17 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.64.140.161
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 139.64.140.161 - vis "GET /login/?login_only=1&user=vis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.51.65.232
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.51.65.232 - visions2 "GET /login/?login_only=1&user=visions2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.41.206.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.41.206.65 - visions1 "GET /login/?login_only=1&user=visions1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 09:47:29 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<HltVTpFFaq6qQMFo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.115.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.115.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.130.79
country_id: 2077456
description:
2025-12-10 09:49:00 dovecot_login authenticator failed for (61-69-130-79.static.tpgi.com.au) [61.69.130.79]:35927: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.180.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.7.180.252 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.86.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.86.250 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.48.128.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.48.128.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.78.225.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.78.225.209 - ksoftlk "GET /login/?login_only=1&user=ksoftlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoftlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.51.46.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.51.46.21 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.207.198.158
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.207.198.158 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.42.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.226.42.230 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.227.92.236
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.227.92.236 - ksoft "GET /login/?login_only=1&user=ksoft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.228.119.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.228.119.91 - kso "GET /login/?login_only=1&user=kso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.166.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.37.166.143 - ksof "GET /login/?login_only=1&user=ksof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.62.122
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.224.62.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.163.39.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.163.39.252 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.123.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.44.123.126 - ks "GET /login/?login_only=1&user=ks&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ks (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.17.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.158.17.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2025-12-10 09:49:14 dovecot_login authenticator failed for ([103.111.6.121]) [103.111.6.121]:46385: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-10 09:54:06 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:44584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-10 09:54:28 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:32778: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-10 09:54:27 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:49526: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-12-10 09:54:51 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:60218: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 09:55:47 host2 sshd[1989969]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.238.192.73
country_id: 6252001
description:
[2025-12-10 09:55:42 +0530] info [cpaneld] 73.238.192.73 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.18.29
country_id: 6252001
description:
[2025-12-10 09:55:43 +0530] info [cpaneld] 74.105.18.29 - ceylondigest "GET /login/?login_only=1&user=ceylondigest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.127.48.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.127.48.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.185.88.99
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.185.88.99 - askinternationalco "GET /login/?login_only=1&user=askinternationalco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.106.47.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.106.47.130 - askinternati "GET /login/?login_only=1&user=askinternati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.130.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.130.92 - askin "GET /login/?login_only=1&user=askin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.106.236.223
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.106.236.223 - ask "GET /login/?login_only=1&user=ask&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ask (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.134.15.211
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 135.134.15.211 - aski "GET /login/?login_only=1&user=aski&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aski (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.140.34.189
country_id: 6252001
description:
[2025-12-10 09:55:50 +0530] info [cpaneld] 74.140.34.189 - ceylondige "GET /login/?login_only=1&user=ceylondige&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondige (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.72.132.143
country_id: 6252001
description:
[2025-12-10 09:55:53 +0530] info [cpaneld] 198.72.132.143 - ceylondig "GET /login/?login_only=1&user=ceylondig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.88.169.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.88.169.24 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.206.247.25
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.206.247.25 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.231.116.249
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.231.116.249 - askinte1 "GET /login/?login_only=1&user=askinte1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.162.30.215
country_id: 6252001
description:
[2025-12-10 09:55:49 +0530] info [cpaneld] 24.162.30.215 - ceylondiges "GET /login/?login_only=1&user=ceylondiges&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondiges (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.145.166
country_id: 6252001
description:
[2025-12-10 09:55:55 +0530] info [cpaneld] 45.50.145.166 - ceylondi "GET /login/?login_only=1&user=ceylondi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.111.150.140
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.111.150.140 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.133.182.2
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.133.182.2 - askinternat "GET /login/?login_only=1&user=askinternat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.172.13.106
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.172.13.106 - askint "GET /login/?login_only=1&user=askint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.220.110.173
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.220.110.173 - askinte "GET /login/?login_only=1&user=askinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.81.224.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.81.224.176 - askinternationalconsortium "GET /login/?login_only=1&user=askinternationalconsortium&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalconsortium (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.191.141.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.191.141.208 - askinternationalconsortiumcom "GET /login/?login_only=1&user=askinternationalconsortiumcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalconsortiumcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.58.87.241
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.58.87.241 - askinternationalcons "GET /login/?login_only=1&user=askinternationalcons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalcons (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.120.152.19
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.120.152.19 - askinternational "GET /login/?login_only=1&user=askinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.150.204.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.150.204.219 - askinternationa "GET /login/?login_only=1&user=askinternationa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.70.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.136.70.24 - askintern "GET /login/?login_only=1&user=askintern&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askintern (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.209.51.91
country_id: 6252001
description:
[2025-12-10 09:55:56 +0530] info [cpaneld] 97.209.51.91 - ceylond "GET /login/?login_only=1&user=ceylond&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.16.214.14
country_id: 6252001
description:
[2025-12-10 09:56:02 +0530] info [cpaneld] 76.16.214.14 - cey "GET /login/?login_only=1&user=cey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.51.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.147.51.237 - askinternationalc "GET /login/?login_only=1&user=askinternationalc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.226.11.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.226.11.134 - askinternation "GET /login/?login_only=1&user=askinternation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.90.230.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.90.230.151 - askinter "GET /login/?login_only=1&user=askinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.102.43.68
country_id: 6252001
description:
[2025-12-10 09:55:42 +0530] info [cpaneld] 97.102.43.68 - askinte2 "GET /login/?login_only=1&user=askinte2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.173.229.17
country_id: 6252001
description:
[2025-12-10 09:55:48 +0530] info [cpaneld] 104.173.229.17 - ceylondigestcom "GET /login/?login_only=1&user=ceylondigestcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondigestcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.238.67
country_id: 6252001
description:
[2025-12-10 09:55:46 +0530] info [whostmgrd] 76.33.238.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.151.189.221
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.151.189.221 - askinterna "GET /login/?login_only=1&user=askinterna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinterna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.199.139.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.199.139.50 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-10 09:55:48 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:60352: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.88.133.84
country_id: 6252001
description:
[2025-12-10 09:56:01 +0530] info [cpaneld] 73.88.133.84 - ceyl "GET /login/?login_only=1&user=ceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.29.189.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.29.189.138 - askinternationalcon "GET /login/?login_only=1&user=askinternationalcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalcon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.146.244.125
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.146.244.125 - askinternatio "GET /login/?login_only=1&user=askinternatio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternatio (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.72
country_id: 3996063
description:
2025-12-10 09:55:58 dovecot_login authenticator failed for ([177.236.144.72]) [177.236.144.72]:47472: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.254.254.239
country_id: 6252001
description:
[2025-12-10 09:55:57 +0530] info [cpaneld] 216.254.254.239 - ceylon "GET /login/?login_only=1&user=ceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.191.49
country_id: 6252001
description:
[2025-12-10 09:56:00 +0530] info [cpaneld] 143.105.191.49 - ceylo "GET /login/?login_only=1&user=ceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.11.9.149
country_id: 6252001
description:
[2025-12-10 09:56:10 +0530] info [cpaneld] 75.11.9.149 - ceylond2 "GET /login/?login_only=1&user=ceylond2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.233.99
country_id: 6252001
description:
[2025-12-10 09:56:03 +0530] info [cpaneld] 73.120.233.99 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.184.157.31
country_id: 6252001
description:
[2025-12-10 09:56:07 +0530] info [cpaneld] 47.184.157.31 - ceylond1 "GET /login/?login_only=1&user=ceylond1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 09:57:15 host2 sshd[1991707]: Disconnected from invalid user user 2.57.121.25 port 7852 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.61.74.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.61.74.51 - ajsstarlog "GET /login/?login_only=1&user=ajsstarlog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.201.132
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.51.201.132 - ajsstarl "GET /login/?login_only=1&user=ajsstarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.162.132.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 165.162.132.31 - ajssta "GET /login/?login_only=1&user=ajssta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.196.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.196.65 - ajsst "GET /login/?login_only=1&user=ajsst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.44.43.168
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.44.43.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.232.204.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.232.204.210 - ajsstarlogcom "GET /login/?login_only=1&user=ajsstarlogcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarlogcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.2.174
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.2.174 - ajsstarlo "GET /login/?login_only=1&user=ajsstarlo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarlo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.19.124
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.149.19.124 - ajs "GET /login/?login_only=1&user=ajs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajs (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.64.165
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.44.64.165 - aj "GET /login/?login_only=1&user=aj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.216.97.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.216.97.116 - ajsstar2 "GET /login/?login_only=1&user=ajsstar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.72.181.117
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.72.181.117 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.86.204.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.86.204.143 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.207.85.125
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.207.85.125 - ajsstar "GET /login/?login_only=1&user=ajsstar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.187.52
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.44.187.52 - ajss "GET /login/?login_only=1&user=ajss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.87.72.220
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.87.72.220 - ajsstar1 "GET /login/?login_only=1&user=ajsstar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-12-10 10:00:32 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:36526: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 10:01:25 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<4BErgJFFXsSqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-10 10:01:58 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:47579: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-10 10:02:14 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:35328: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 10 10:03:06 host2 sshd[1997380]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 52690


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-10 10:05:46 dovecot_plain authenticator failed for (renescar) [24.93.140.162]:51603: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.31.64.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.31.64.163 - maximsholdingscom "GET /login/?login_only=1&user=maximsholdingscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.55.108.9
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.55.108.9 - maximshol "GET /login/?login_only=1&user=maximshol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximshol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.143.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.49.143.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.171.8.189
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.171.8.189 - cloudtourssrila "GET /login/?login_only=1&user=cloudtourssrila&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrila (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.30.236.152
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.30.236.152 - cloudtourssril "GET /login/?login_only=1&user=cloudtourssril&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssril (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.250.139.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 130.250.139.243 - maximsholdin "GET /login/?login_only=1&user=maximsholdin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.3.38.94
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.3.38.94 - maximsh "GET /login/?login_only=1&user=maximsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.12.30.173
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.12.30.173 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.178.237.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.178.237.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.83.26.71
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.83.26.71 - cloudtourssrilank "GET /login/?login_only=1&user=cloudtourssrilank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.234.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.157.234.127 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.217.151.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.217.151.102 - maximsh2 "GET /login/?login_only=1&user=maximsh2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.153.233.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.153.233.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-10 10:06:27 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (bruls) [73.137.7.97]:45324: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.85.200.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.85.200.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.78.179.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.78.179.29 - cloudtourssrilanka "GET /login/?login_only=1&user=cloudtourssrilanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilanka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.180.164
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.41.180.164 - cloudtourssrilankacom "GET /login/?login_only=1&user=cloudtourssrilankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.162.70.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.162.70.225 - cloudtourssrilan "GET /login/?login_only=1&user=cloudtourssrilan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.171.84.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.171.84.208 - maximsholdings "GET /login/?login_only=1&user=maximsholdings&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.209.102.118
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.209.102.118 - maximsho "GET /login/?login_only=1&user=maximsho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.193.155.112
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.193.155.112 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.194.87.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.194.87.45 - maximsholding "GET /login/?login_only=1&user=maximsholding&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholding (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.112.190.69
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.112.190.69 - maximsholdi "GET /login/?login_only=1&user=maximsholdi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.156.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.66.156.17 - maximshold "GET /login/?login_only=1&user=maximshold&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximshold (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.9.17.8
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.9.17.8 - max "GET /login/?login_only=1&user=max&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user max (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.215.6.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 134.215.6.7 - cloudtourssri "GET /login/?login_only=1&user=cloudtourssri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.108.57.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.108.57.163 - maxims "GET /login/?login_only=1&user=maxims&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maxims (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.104.173.14
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.104.173.14 - cloudtourssr "GET /login/?login_only=1&user=cloudtourssr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.238.51.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.238.51.239 - cloudtourss "GET /login/?login_only=1&user=cloudtourss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.244.96.44
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.244.96.44 - maxi "GET /login/?login_only=1&user=maxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maxi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.124.85.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.124.85.202 - maximsh1 "GET /login/?login_only=1&user=maximsh1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.249.233.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.249.233.207 - cloudt "GET /login/?login_only=1&user=cloudt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.228.108.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.228.108.34 - clou "GET /login/?login_only=1&user=clou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.30.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.30.188 - cloudto1 "GET /login/?login_only=1&user=cloudto1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.180.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.41.180.64 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.117.19.149
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.117.19.149 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.140.155.22
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.140.155.22 - jr "GET /login/?login_only=1&user=jr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.230.79.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.230.79.36 - cloudtours "GET /login/?login_only=1&user=cloudtours&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtours (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.77.220.188
country_id: 203312
description:
Dec 10 10:07:41 host2 sshd[2002970]: Disconnected from invalid user dockeradmin 41.77.220.188 port 48928 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.157.164.244
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.157.164.244 - jrdc "GET /login/?login_only=1&user=jrdc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrdc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.147.179.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.147.179.10 - jrdclk "GET /login/?login_only=1&user=jrdclk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.95.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.151.95.80 - cloudtour "GET /login/?login_only=1&user=cloudtour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtour (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.46.243.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.46.243.56 - cloud "GET /login/?login_only=1&user=cloud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloud (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.202.116.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.202.116.160 - clo "GET /login/?login_only=1&user=clo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.50.184.141
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.50.184.141 - cl "GET /login/?login_only=1&user=cl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.22.220.213
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.22.220.213 - cloudto2 "GET /login/?login_only=1&user=cloudto2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.2.187.170
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.2.187.170 - cloudto "GET /login/?login_only=1&user=cloudto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.145.44.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.145.44.176 - cloudtou "GET /login/?login_only=1&user=cloudtou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.231.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.147.231.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.153.232.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.153.232.203 - jrd "GET /login/?login_only=1&user=jrd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a0e:97c0:3ea:402::1
country_id: 3042058
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2a0e:97c0:3ea:402::1 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 10:09:24 host2 sshd[2004763]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-10 10:11:12 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:35837: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-12-10 10:11:25 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:45632: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.23.113
country_id: 6252001
description:
[2025-12-10 10:17:05 +0530] info [cpaneld] 172.251.23.113 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.3.200.174
country_id: 6252001
description:
[2025-12-10 10:16:48 +0530] info [cpaneld] 160.3.200.174 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-10 10:16:52 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:54888: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.91.232.151
country_id: 6252001
description:
[2025-12-10 10:16:52 +0530] info [whostmgrd] 76.91.232.151 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.191.109.214
country_id: 6252001
description:
[2025-12-10 10:16:59 +0530] info [cpaneld] 24.191.109.214 - anandaoba "GET /login/?login_only=1&user=anandaoba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaoba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.178.123.9
country_id: 6252001
description:
[2025-12-10 10:17:02 +0530] info [cpaneld] 76.178.123.9 - ananda "GET /login/?login_only=1&user=ananda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ananda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.140.11.113
country_id: 6252001
description:
[2025-12-10 10:17:03 +0530] info [cpaneld] 76.140.11.113 - anand "GET /login/?login_only=1&user=anand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 205.178.64.74
country_id: 6252001
description:
[2025-12-10 10:16:53 +0530] info [cpaneld] 205.178.64.74 - anandaobauaeorg "GET /login/?login_only=1&user=anandaobauaeorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauaeorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.31.57.22
country_id: 6252001
description:
[2025-12-10 10:16:54 +0530] info [cpaneld] 76.31.57.22 - anandaobaua "GET /login/?login_only=1&user=anandaobaua&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobaua (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2025-12-10 10:17:02 dovecot_login authenticator failed for ([78.197.6.173]) [78.197.6.173]:64610: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.86.96.26
country_id: 6252001
description:
[2025-12-10 10:17:13 +0530] info [cpaneld] 75.86.96.26 - anandao1 "GET /login/?login_only=1&user=anandao1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.93.78.213
country_id: 6252001
description:
[2025-12-10 10:17:14 +0530] info [cpaneld] 76.93.78.213 - anandao2 "GET /login/?login_only=1&user=anandao2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.240.52.38
country_id: 6252001
description:
[2025-12-10 10:16:51 +0530] info [cpaneld] 67.240.52.38 - anandaobauae "GET /login/?login_only=1&user=anandaobauae&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauae (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.179.103
country_id: 6252001
description:
[2025-12-10 10:16:56 +0530] info [cpaneld] 169.150.179.103 - anandaobau "GET /login/?login_only=1&user=anandaobau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.36.23.84
country_id: 6252001
description:
[2025-12-10 10:17:00 +0530] info [cpaneld] 98.36.23.84 - anandaob "GET /login/?login_only=1&user=anandaob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.171.23.87
country_id: 6252001
description:
[2025-12-10 10:17:04 +0530] info [cpaneld] 66.171.23.87 - anan "GET /login/?login_only=1&user=anan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anan (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-12-10 10:17:10 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:56468: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.132.179
country_id: 6252001
description:
[2025-12-10 10:16:50 +0530] info [cpaneld] 76.32.132.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.10.164.153
country_id: 6252001
description:
[2025-12-10 10:17:01 +0530] info [cpaneld] 172.10.164.153 - anandao "GET /login/?login_only=1&user=anandao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.38.22.192
country_id: 6252001
description:
[2025-12-10 10:17:06 +0530] info [cpaneld] 47.38.22.192 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-10 10:17:10 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:55498: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2025-12-10 10:17:25 dovecot_login authenticator failed for dsl-212-135-208-13.dsl.easynet.co.uk [212.135.208.13]:38828: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 10 10:18:58 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=<wWEWv5FFEKks3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-12-10 10:20:02 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:42125: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-10 10:20:15 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:53500: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.36
country_id: 3996063
description:
2025-12-10 10:21:17 dovecot_login authenticator failed for (189.219.138.36-clientes-izzi.mx) [189.219.138.36]:41408: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-12-10 10:21:31 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:59772: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-10 10:20:45 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:33135: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.150
country_id: 1694008
description:
2025-12-10 10:21:00 dovecot_login authenticator failed for ([124.105.219.170]) [124.105.218.150]:51458: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 10 10:21:57 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=</DPCyZFFmqos3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-10 10:22:51 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (proty) [24.98.45.238]:34810: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.90.173.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.90.173.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.46.25.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.46.25.133 - asrgroup "GET /login/?login_only=1&user=asrgroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.242.94.0
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.242.94.0 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.131.115
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 74.244.131.115 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.81.161.152
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.81.161.152 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.232.134.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.232.134.145 - asrgrou "GET /login/?login_only=1&user=asrgrou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.133.78.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.133.78.196 - asrgrouplk "GET /login/?login_only=1&user=asrgrouplk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrouplk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.101.2.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.101.2.252 - asrgr "GET /login/?login_only=1&user=asrgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.213.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.213.160 - asrgro "GET /login/?login_only=1&user=asrgro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.250.229.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.250.229.79 - asr "GET /login/?login_only=1&user=asr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.15.56.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.15.56.130 - asrg "GET /login/?login_only=1&user=asrg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-10 10:26:05 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:42138: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-10 10:25:49 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:38586: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-10 10:27:07 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:60578: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-10 10:26:48 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:35816: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-10 10:26:55 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (hamudien) [69.142.126.37]:33618: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 10 10:28:58 host2 sshd[2026561]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 65182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-10 10:30:43 dovecot_plain authenticator failed for (avachanita) [88.207.210.23]:61801: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-10 10:32:28 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (cravintion) [68.40.189.43]:40892: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-10 10:33:50 dovecot_plain authenticator failed for (refaluscip) [5.11.140.219]:34418: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 10:36:09 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<zPln/JFFgNm8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-10 10:36:23 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:55300: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.111
country_id: 3996063
description:
2025-12-10 10:36:43 dovecot_login authenticator failed for (201.173.97.111-clientes-izzi.mx) [201.173.97.111]:41885: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:37:20 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<7ojBAJJF6OcDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-10 10:37:40 dovecot_plain authenticator failed for (crifies) [154.144.243.93]:39164: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.70.74.154
country_id: 3469034
description:
Dec 10 10:39:21 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=177.70.74.154, lip=66.85.158.91, TLS, session=<qDvgBpJFltSxRkqa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.234
country_id: 6252001
description:
Dec 10 10:39:58 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.234, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<H/QyCpJFkMOTuYXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-10 10:40:13 dovecot_plain authenticator failed for (korulgena) [75.97.190.237]:55032: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.140.192
country_id: 357994
description:
2025-12-10 10:40:23 dovecot_login authenticator failed for ([41.65.118.172]) [41.239.140.192]:58952: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.60
country_id: 798544
description:
Dec 10 10:39:40 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=91.228.33.60, lip=66.85.158.91, TLS, session=<aRgUCJJFhNZb5CE8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:41:32 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<pZ/JD5JFep4Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.234
country_id: 6252001
description:
Dec 10 10:40:47 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=147.185.133.234, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<7X0TDZJFuuiTuYXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-10 10:40:54 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:38291: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 10:41:05 host2 sshd[2040779]: Disconnected from invalid user admin 2.57.121.112 port 16108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:42:20 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<6GCgEpJFWp4Dg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:42:28 host2 dovecot[1766329]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<x1kjE5JFhJ4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-10 10:42:59 dovecot_plain authenticator failed for (vioged) [41.248.243.181]:47916: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-10 10:45:29 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:60334: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.206
country_id: 1269750
description:
2025-12-10 10:45:20 dovecot_login authenticator failed for ([182.95.63.206]) [182.95.63.206]:52110: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-10 10:46:07 dovecot_login authenticator failed for ([182.95.229.38]) [182.95.229.38]:39714: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-10 10:46:31 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:45528: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:45:38 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<PJZzHpJFkJ8Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-10 10:45:46 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:57304: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-10 10:46:48 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:37372: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 10:46:49 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<FGuUIpJFUpiqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.234
country_id: 6252001
description:
Dec 10 10:47:25 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.234, lip=66.85.158.92, TLS, session=<nLHNJJJF+uuTuYXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-10 10:48:12 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (matidneped) [73.213.236.66]:36324: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 10 10:48:31 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<gv7BKJJFFJyLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.157
country_id: 3865483
description:
Dec 10 10:49:28 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.122.133.157, lip=66.85.158.91, TLS, session=<MnP+KpJFmqK+eoWd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.154
country_id: 3865483
description:
Dec 10 10:49:50 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.124.218.154, lip=66.85.158.91, TLS, session=<GmVMLJJFkpa6fNqa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2025-12-10 10:51:47 dovecot_login authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:65338: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-10 10:52:16 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:47848: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-10 10:52:23 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:59220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-12-10 10:52:43 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:51408: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 10:54:37 host2 sshd[2054350]: Disconnected from invalid user admin 2.57.121.112 port 58699 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.112.215
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.2.112.215 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.37.199.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.37.199.135 - systemteclk "GET /login/?login_only=1&user=systemteclk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemteclk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.204.190.241
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.204.190.241 - kamechote "GET /login/?login_only=1&user=kamechote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.36.65.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.36.65.24 - syste "GET /login/?login_only=1&user=syste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user syste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.242.129.136
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.242.129.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.214.228
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.214.228 - kamechotech "GET /login/?login_only=1&user=kamechotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.83.68.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.83.68.116 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.55.150.82
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.55.150.82 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.205.229.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.205.229.10 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.186.54.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.186.54.60 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.33.12.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.33.12.73 - systemte "GET /login/?login_only=1&user=systemte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.157.240.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.157.240.31 - systemt "GET /login/?login_only=1&user=systemt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.142.14.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.142.14.177 - system "GET /login/?login_only=1&user=system&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user system (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.244.27.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.244.27.50 - kamechotechcom "GET /login/?login_only=1&user=kamechotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.21.124.156
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.21.124.156 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.92.152.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.92.152.212 - systemtec "GET /login/?login_only=1&user=systemtec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemtec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.140.79.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.140.79.243 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 10 10:58:12 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<1cJmS5JFIpg2rEyT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.180.189
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.176.180.189 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.166.143.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.166.143.18 - kamechotec "GET /login/?login_only=1&user=kamechotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.58.147.227
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.58.147.227 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.164.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.164.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.50.140.198
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.50.140.198 - syst "GET /login/?login_only=1&user=syst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user syst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.150.221
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.15.150.221 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.230.109.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.230.109.55 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.252.218.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.252.218.145 - kamechot "GET /login/?login_only=1&user=kamechot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.159.235
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.194.159.235 - kamecho1 "GET /login/?login_only=1&user=kamecho1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.180.246.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.180.246.135 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.26.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.171.26.13 - kamecho2 "GET /login/?login_only=1&user=kamecho2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 11:00:52 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Hf/HVJJFjoeqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.16
country_id: 6252001
description:
2025-12-10 11:02:20 dovecot_login authenticator failed for ([98.181.44.16]) [98.181.44.16]:49547: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-10 11:03:18 dovecot_login authenticator failed for ([94.207.251.240]) [94.207.251.240]:42587: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.61.226.85
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.61.226.85 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.107.171.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.107.171.91 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.172.214.9
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.172.214.9 - saaralk "GET /login/?login_only=1&user=saaralk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saaralk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.15.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.15.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.236
country_id: 3469034
description:
Dec 10 11:04:56 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.89.137.236, lip=66.85.158.91, TLS, session=<HWdoYpJFlc6+WYns>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.100
country_id: 3469034
description:
Dec 10 11:05:16 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=177.44.96.100, lip=66.85.158.91, TLS, session=<i8SWY5JFbtmxLGBk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.238.5.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.238.5.138 - saar "GET /login/?login_only=1&user=saar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.94.239.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.94.239.21 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.66.242.74
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.66.242.74 - saara "GET /login/?login_only=1&user=saara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.59.158
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.151.59.158 - saa "GET /login/?login_only=1&user=saa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-10 11:06:33 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:57626: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.77.225.4
country_id: 798549
description:
2025-12-10 11:06:03 dovecot_plain authenticator failed for (6LCBR6) [82.77.225.4]:64782: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2025-12-10 11:06:50 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:35032: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.191.197.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.191.197.250 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.23.190.112
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.23.190.112 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.107.61.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.107.61.11 - essenceceylo "GET /login/?login_only=1&user=essenceceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.50.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.226.50.7 - essence1 "GET /login/?login_only=1&user=essence1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.7.176.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.7.176.188 - essenceceylonteacom "GET /login/?login_only=1&user=essenceceylonteacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylonteacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.81.162.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.81.162.178 - essencecey "GET /login/?login_only=1&user=essencecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.25.1
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.181.25.1 - essenceceyl "GET /login/?login_only=1&user=essenceceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.141.197
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.62.141.197 - essencece "GET /login/?login_only=1&user=essencece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.63.33.44
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.63.33.44 - ess "GET /login/?login_only=1&user=ess&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ess (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.101.67.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.101.67.145 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.129.96.157
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.129.96.157 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.79.175.58
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.79.175.58 - essenceceylontea "GET /login/?login_only=1&user=essenceceylontea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User essenceceylontea has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.112.206.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.112.206.208 - essenceceylont "GET /login/?login_only=1&user=essenceceylont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylont (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.147.185.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.147.185.234 - essenc "GET /login/?login_only=1&user=essenc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.248.99.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.248.99.237 - essence2 "GET /login/?login_only=1&user=essence2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.234.44.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.234.44.91 - essenceceylonte "GET /login/?login_only=1&user=essenceceylonte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylonte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.146.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.175.146.64 - essenceceylon "GET /login/?login_only=1&user=essenceceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.94.66.49
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.94.66.49 - essencec "GET /login/?login_only=1&user=essencec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.180.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.241.180.53 - essence "GET /login/?login_only=1&user=essence&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.181.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.128.181.206 - esse "GET /login/?login_only=1&user=esse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.172.197.168
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.172.197.168 - essen "GET /login/?login_only=1&user=essen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essen (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.132.164.17
country_id: 2635167
description:
Dec 10 11:10:08 host2 sshd[2073622]: Disconnected from invalid user surubu 23.132.164.17 port 55870 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-10 11:09:41 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (frevellars) [73.213.237.28]:55316: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-10 11:12:06 dovecot_login authenticator failed for ([46.212.35.53]) [46.212.35.53]:41373: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-10 11:12:11 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:53316: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-10 11:12:27 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:54577: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-10 11:11:47 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:48693: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-10 11:13:06 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:40614: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-10 11:13:31 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:60697: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-10 11:12:58 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (submon) [2.135.31.74]:40213: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.72.2
country_id: 690791
description:
Dec 10 11:15:20 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=194.44.72.2, lip=66.85.158.91, TLS, session=<9LCRh5JFmcHCLEgC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.139.20
country_id: 690791
description:
Dec 10 11:15:43 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=37.221.139.20, lip=66.85.158.91, TLS, session=<ti/DiJJF9rEl3YsU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.117.92
country_id: 6252001
description:
[2025-12-10 11:16:53 +0530] info [cpaneld] 184.164.117.92 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.138.205.200
country_id: 6252001
description:
[2025-12-10 11:16:54 +0530] info [cpaneld] 64.138.205.200 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.206.219.35
country_id: 6252001
description:
[2025-12-10 11:17:06 +0530] info [cpaneld] 98.206.219.35 - neo "GET /login/?login_only=1&user=neo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.16.204.178
country_id: 6252001
description:
[2025-12-10 11:16:57 +0530] info [whostmgrd] 24.16.204.178 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 11:17:03 host2 sshd[2081983]: Disconnected from invalid user  62.60.131.157 port 65016 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.97.216.156
country_id: 6252001
description:
[2025-12-10 11:17:03 +0530] info [cpaneld] 97.97.216.156 - neote "GET /login/?login_only=1&user=neote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.164.138.173
country_id: 6252001
description:
[2025-12-10 11:17:07 +0530] info [cpaneld] 47.164.138.173 - ne "GET /login/?login_only=1&user=ne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ne (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.145.135
country_id: 798544
description:
Dec 10 11:17:34 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=78.31.145.135, lip=66.85.158.91, TLS, session=<MNl0j5JFgeVOH5GH>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.118.67.85
country_id: 6252001
description:
[2025-12-10 11:16:55 +0530] info [cpaneld] 23.118.67.85 - neotechlk "GET /login/?login_only=1&user=neotechlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.72.199.225
country_id: 6252001
description:
[2025-12-10 11:17:00 +0530] info [cpaneld] 198.72.199.225 - neotech "GET /login/?login_only=1&user=neotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.183.26
country_id: 6252001
description:
[2025-12-10 11:16:59 +0530] info [cpaneld] 76.35.183.26 - neotechl "GET /login/?login_only=1&user=neotechl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.170.12.48
country_id: 6252001
description:
[2025-12-10 11:17:04 +0530] info [cpaneld] 24.170.12.48 - neot "GET /login/?login_only=1&user=neot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.125.1
country_id: 6252001
description:
[2025-12-10 11:16:58 +0530] info [cpaneld] 129.222.125.1 - neotechlkcom "GET /login/?login_only=1&user=neotechlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.224.90.56
country_id: 6252001
description:
[2025-12-10 11:17:02 +0530] info [cpaneld] 98.224.90.56 - neotec "GET /login/?login_only=1&user=neotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotec (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-10 11:17:55 dovecot_plain authenticator failed for (bactotraus) [46.10.210.68]:51263: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.195
country_id: 3469034
description:
Dec 10 11:17:56 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=191.240.96.195, lip=66.85.158.91, TLS, session=<cQPGkJJFJr6/8GDD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-10 11:18:00 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:43970: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-10 11:18:18 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:57025: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.81.150
country_id: 1269750
description:
2025-12-10 11:19:06 dovecot_login authenticator failed for ([103.181.81.150]) [103.181.81.150]:42078: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-10 11:19:24 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:39323: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 11:20:39 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<rWuMm5JFerKPbvgo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 11:22:55 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.37.42.58
country_id: 6252001
description:
[2025-12-10 11:23:14 +0530] info [cpaneld] 50.37.42.58 - gnetunivers "GET /login/?login_only=1&user=gnetunivers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetunivers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.155.21.137
country_id: 6252001
description:
[2025-12-10 11:23:20 +0530] info [cpaneld] 47.155.21.137 - gnetu "GET /login/?login_only=1&user=gnetu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.164.192.145
country_id: 6252001
description:
[2025-12-10 11:23:19 +0530] info [cpaneld] 47.164.192.145 - gnetun "GET /login/?login_only=1&user=gnetun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.95.74.143
country_id: 6252001
description:
[2025-12-10 11:23:21 +0530] info [cpaneld] 73.95.74.143 - gnet "GET /login/?login_only=1&user=gnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.240.13.34
country_id: 6252001
description:
[2025-12-10 11:23:09 +0530] info [cpaneld] 209.240.13.34 - gnetuniversals "GET /login/?login_only=1&user=gnetuniversals&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.213.21
country_id: 6252001
description:
[2025-12-10 11:23:16 +0530] info [cpaneld] 72.80.213.21 - gnetunive "GET /login/?login_only=1&user=gnetunive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetunive (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.113.111.45
country_id: 6252001
description:
[2025-12-10 11:23:18 +0530] info [cpaneld] 172.113.111.45 - gnetuni "GET /login/?login_only=1&user=gnetuni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.24.48.83
country_id: 6252001
description:
[2025-12-10 11:23:22 +0530] info [cpaneld] 66.24.48.83 - gne "GET /login/?login_only=1&user=gne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.105.103.190
country_id: 6252001
description:
[2025-12-10 11:23:06 +0530] info [cpaneld] 76.105.103.190 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.119.75
country_id: 6252001
description:
[2025-12-10 11:23:08 +0530] info [cpaneld] 135.129.119.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.176.79.24
country_id: 6252001
description:
[2025-12-10 11:23:12 +0530] info [cpaneld] 73.176.79.24 - gnetuniversal "GET /login/?login_only=1&user=gnetuniversal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.184.118.86
country_id: 6252001
description:
[2025-12-10 11:23:11 +0530] info [cpaneld] 75.184.118.86 - gnetuniversalscom "GET /login/?login_only=1&user=gnetuniversalscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversalscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.70.235.228
country_id: 6252001
description:
[2025-12-10 11:23:15 +0530] info [cpaneld] 73.70.235.228 - gnetuniver "GET /login/?login_only=1&user=gnetuniver&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniver (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.56.210.247
country_id: 6252001
description:
[2025-12-10 11:23:23 +0530] info [cpaneld] 142.56.210.247 - gnetuni1 "GET /login/?login_only=1&user=gnetuni1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.215.14.153
country_id: 6252001
description:
[2025-12-10 11:23:25 +0530] info [cpaneld] 74.215.14.153 - gnetuni2 "GET /login/?login_only=1&user=gnetuni2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.41.147.54
country_id: 6252001
description:
[2025-12-10 11:23:36 +0530] info [cpaneld] 158.41.147.54 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.16.113.254
country_id: 6252001
description:
[2025-12-10 11:23:10 +0530] info [whostmgrd] 45.16.113.254 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.212.61.67
country_id: 6252001
description:
[2025-12-10 11:23:13 +0530] info [cpaneld] 67.212.61.67 - gnetuniversa "GET /login/?login_only=1&user=gnetuniversa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.36.96
country_id: 6252001
description:
[2025-12-10 11:23:17 +0530] info [cpaneld] 73.74.36.96 - gnetuniv "GET /login/?login_only=1&user=gnetuniv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.177.54
country_id: 6252001
description:
[2025-12-10 11:23:23 +0530] info [cpaneld] 169.150.177.54 - gn "GET /login/?login_only=1&user=gn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.131.83
country_id: 6252001
description:
[2025-12-10 11:23:38 +0530] info [cpaneld] 76.32.131.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.221.105.97
country_id: 6252001
description:
[2025-12-10 11:23:44 +0530] info [cpaneld] 74.221.105.97 - myproteinb "GET /login/?login_only=1&user=myproteinb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myproteinb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.25.100.74
country_id: 6252001
description:
[2025-12-10 11:23:47 +0530] info [cpaneld] 137.25.100.74 - myprotei "GET /login/?login_only=1&user=myprotei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprotei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.101.166
country_id: 6252001
description:
[2025-12-10 11:23:50 +0530] info [cpaneld] 172.56.101.166 - myprot "GET /login/?login_only=1&user=myprot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.51.43.45
country_id: 6252001
description:
[2025-12-10 11:23:42 +0530] info [cpaneld] 73.51.43.45 - myproteinboxlk "GET /login/?login_only=1&user=myproteinboxlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myproteinboxlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.14.148
country_id: 6252001
description:
[2025-12-10 11:23:46 +0530] info [cpaneld] 35.149.14.148 - myprotein "GET /login/?login_only=1&user=myprotein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprotein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.198.39
country_id: 6252001
description:
[2025-12-10 11:23:48 +0530] info [cpaneld] 73.15.198.39 - myprote "GET /login/?login_only=1&user=myprote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.89.88
country_id: 6252001
description:
[2025-12-10 11:23:52 +0530] info [cpaneld] 47.152.89.88 - mypro "GET /login/?login_only=1&user=mypro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mypro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.120.81
country_id: 6252001
description:
[2025-12-10 11:23:54 +0530] info [cpaneld] 73.93.120.81 - myp "GET /login/?login_only=1&user=myp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.58.112
country_id: 6252001
description:
[2025-12-10 11:23:57 +0530] info [cpaneld] 68.224.58.112 - myprote1 "GET /login/?login_only=1&user=myprote1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.227.238
country_id: 6252001
description:
[2025-12-10 11:23:40 +0530] info [cpaneld] 172.59.227.238 - myproteinbox "GET /login/?login_only=1&user=myproteinbox&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.212.224.140
country_id: 6252001
description:
[2025-12-10 11:23:43 +0530] info [cpaneld] 73.212.224.140 - myproteinbo "GET /login/?login_only=1&user=myproteinbo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myproteinbo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.54.29.236
country_id: 6252001
description:
[2025-12-10 11:23:53 +0530] info [cpaneld] 142.54.29.236 - mypr "GET /login/?login_only=1&user=mypr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mypr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.196.64.224
country_id: 6252001
description:
[2025-12-10 11:23:56 +0530] info [cpaneld] 216.196.64.224 - my "GET /login/?login_only=1&user=my&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user my (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.41.241.211
country_id: 6252001
description:
[2025-12-10 11:23:59 +0530] info [cpaneld] 96.41.241.211 - myprote2 "GET /login/?login_only=1&user=myprote2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.25.67
country_id: 1605651
description:
Dec 10 11:24:20 host2 sshd[2091359]: Disconnected from invalid user pp 49.228.25.67 port 47870 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.131.63.232
country_id: 6252001
description:
[2025-12-10 11:23:41 +0530] info [whostmgrd] 65.131.63.232 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.246
country_id: 6252001
description:
2025-12-10 11:24:55 dovecot_login authenticator failed for wsip-184-191-242-246.fv.ks.cox.net [184.191.242.246]:49851: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-10 11:25:08 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:47344: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.50.13.224
country_id: 6252001
description:
[2025-12-10 11:28:29 +0530] info [cpaneld] 76.50.13.224 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.130.123
country_id: 6252001
description:
[2025-12-10 11:28:28 +0530] info [cpaneld] 174.134.130.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.87.48.59
country_id: 6252001
description:
[2025-12-10 11:28:32 +0530] info [cpaneld] 23.87.48.59 - bostonlankacom "GET /login/?login_only=1&user=bostonlankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonlankacom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-10 11:28:19 dovecot_plain authenticator failed for (undiskle) [91.73.195.150]:33835: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.17.12
country_id: 6252001
description:
[2025-12-10 11:28:31 +0530] info [whostmgrd] 76.150.17.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.22.10.43
country_id: 6252001
description:
[2025-12-10 11:28:30 +0530] info [cpaneld] 73.22.10.43 - bostonlanka "GET /login/?login_only=1&user=bostonlanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.51.161
country_id: 6252001
description:
[2025-12-10 11:28:34 +0530] info [cpaneld] 76.32.51.161 - bostonlank "GET /login/?login_only=1&user=bostonlank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonlank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.247.209.173
country_id: 6252001
description:
[2025-12-10 11:28:35 +0530] info [cpaneld] 76.247.209.173 - bostonlan "GET /login/?login_only=1&user=bostonlan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonlan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.203.241
country_id: 6252001
description:
[2025-12-10 11:28:38 +0530] info [cpaneld] 172.59.203.241 - bostonl "GET /login/?login_only=1&user=bostonl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.20.3.0
country_id: 6252001
description:
[2025-12-10 11:28:40 +0530] info [cpaneld] 67.20.3.0 - bosto "GET /login/?login_only=1&user=bosto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bosto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.77.243
country_id: 6252001
description:
[2025-12-10 11:28:41 +0530] info [cpaneld] 68.224.77.243 - bost "GET /login/?login_only=1&user=bost&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bost (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.107.93.219
country_id: 6252001
description:
[2025-12-10 11:28:37 +0530] info [cpaneld] 73.107.93.219 - bostonla "GET /login/?login_only=1&user=bostonla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.187.93.223
country_id: 6252001
description:
[2025-12-10 11:28:39 +0530] info [cpaneld] 70.187.93.223 - boston "GET /login/?login_only=1&user=boston&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boston (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.76.67
country_id: 6252001
description:
[2025-12-10 11:28:43 +0530] info [cpaneld] 35.151.76.67 - bos "GET /login/?login_only=1&user=bos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.168.93.100
country_id: 6252001
description:
[2025-12-10 11:28:45 +0530] info [cpaneld] 199.168.93.100 - bostonl1 "GET /login/?login_only=1&user=bostonl1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2025-12-10 11:28:45 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:39370: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.182.152
country_id: 6252001
description:
[2025-12-10 11:28:44 +0530] info [cpaneld] 174.160.182.152 - bo "GET /login/?login_only=1&user=bo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.126.199.29
country_id: 6252001
description:
[2025-12-10 11:28:46 +0530] info [cpaneld] 208.126.199.29 - bostonl2 "GET /login/?login_only=1&user=bostonl2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec 10 11:29:31 host2 sshd[2098362]: Disconnected from invalid user ubuntu 20.46.50.43 port 37536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 10 11:30:21 host2 sshd[2099399]: Disconnected from invalid user ankit 34.39.58.191 port 38898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec 10 11:30:08 host2 sshd[2099124]: Disconnected from invalid user pp 20.46.50.43 port 33524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.78.13.158
country_id: 1269750
description:
Dec 10 11:30:10 host2 sshd[2099165]: Disconnected from invalid user postgres 103.78.13.158 port 56722 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.143.181.149
country_id: 6252001
description:
[2025-12-10 11:30:48 +0530] info [cpaneld] 47.143.181.149 - vdeploy "GET /login/?login_only=1&user=vdeploy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.71.210.33
country_id: 6252001
description:
[2025-12-10 11:30:55 +0530] info [cpaneld] 99.71.210.33 - vdep "GET /login/?login_only=1&user=vdep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.90.76.161
country_id: 6252001
description:
[2025-12-10 11:30:47 +0530] info [cpaneld] 99.90.76.161 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.159.186.13
country_id: 6252001
description:
[2025-12-10 11:30:49 +0530] info [whostmgrd] 47.159.186.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.61.45.38
country_id: 6252001
description:
[2025-12-10 11:30:56 +0530] info [cpaneld] 71.61.45.38 - vde "GET /login/?login_only=1&user=vde&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vde (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 10 11:31:21 host2 sshd[2100401]: Disconnected from invalid user sysadmin 34.39.58.191 port 60374 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.75.103.65
country_id: 6252001
description:
[2025-12-10 11:30:45 +0530] info [cpaneld] 174.75.103.65 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.46.50.43
country_id: 290557
description:
Dec 10 11:30:46 host2 sshd[2099802]: Disconnected from invalid user ftpuser1 20.46.50.43 port 56174 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.238.189
country_id: 6252001
description:
[2025-12-10 11:30:53 +0530] info [cpaneld] 76.141.238.189 - vdepl "GET /login/?login_only=1&user=vdepl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdepl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.26.62.65
country_id: 6252001
description:
[2025-12-10 11:30:52 +0530] info [cpaneld] 45.26.62.65 - vdeplo "GET /login/?login_only=1&user=vdeplo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeplo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.59.114.53
country_id: 6252001
description:
[2025-12-10 11:30:57 +0530] info [cpaneld] 174.59.114.53 - vd "GET /login/?login_only=1&user=vd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.242.118.191
country_id: 6252001
description:
[2025-12-10 11:30:51 +0530] info [cpaneld] 24.242.118.191 - vdeploycom "GET /login/?login_only=1&user=vdeploycom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeploycom (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 10 11:31:52 host2 sshd[2100816]: Disconnected from invalid user mike 34.39.58.191 port 51234 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 10 11:32:22 host2 sshd[2101235]: Disconnected from invalid user pp 34.39.58.191 port 46636 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-12-10 11:32:22 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:49593: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.25.67
country_id: 1605651
description:
Dec 10 11:33:03 host2 sshd[2101842]: Disconnected from invalid user ubuntu 49.228.25.67 port 55918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-12-10 11:32:48 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:38146: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 10 11:32:53 host2 sshd[2101696]: Disconnected from invalid user radarr 34.39.58.191 port 52274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.78.13.158
country_id: 1269750
description:
Dec 10 11:33:40 host2 sshd[2102421]: Disconnected from invalid user kaveh 103.78.13.158 port 41428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.188.154.6
country_id: 1819730
description:
Dec 10 11:34:11 host2 sshd[2102881]: Disconnected from invalid user pp 218.188.154.6 port 39966 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 218.188.154.6
country_id: 1819730
description:
Dec 10 11:34:52 host2 sshd[2103442]: Disconnected from invalid user kaveh 218.188.154.6 port 38286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec 10 11:35:06 host2 sshd[2103807]: Disconnected from invalid user postgres 20.46.50.43 port 48956 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.59
country_id: 6252001
description:
Dec 10 11:36:42 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.59, lip=66.85.158.91, TLS, session=<2OgX1ZJF0ujN0h87>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 10 11:37:28 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<ggfX15JFnkhChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-12-10 11:37:31 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:57058: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-10 11:38:29 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:43047: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-10 11:37:48 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:49223: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-10 11:37:58 dovecot_login authenticator failed for (nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:49162: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 10 11:37:35 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, session=<XmM/2JJFoMtChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-12-10 11:37:43 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:59546: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 11:41:29 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.112.103.164
country_id: 6252001
description:
[2025-12-10 11:41:29 +0530] info [cpaneld] 70.112.103.164 - kiriasw "GET /login/?login_only=1&user=kiriasw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriasw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.118.42.252
country_id: 6252001
description:
[2025-12-10 11:41:30 +0530] info [cpaneld] 24.118.42.252 - kirias "GET /login/?login_only=1&user=kirias&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kirias (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.175.240.31
country_id: 6252001
description:
[2025-12-10 11:41:35 +0530] info [cpaneld] 104.175.240.31 - ki "GET /login/?login_only=1&user=ki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.211.92.89
country_id: 6252001
description:
[2025-12-10 11:41:20 +0530] info [cpaneld] 67.211.92.89 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.51.190
country_id: 6252001
description:
[2025-12-10 11:41:28 +0530] info [cpaneld] 74.244.51.190 - kiriaswa "GET /login/?login_only=1&user=kiriaswa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.45.39
country_id: 6252001
description:
[2025-12-10 11:41:22 +0530] info [cpaneld] 76.168.45.39 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.203.48.51
country_id: 6252001
description:
[2025-12-10 11:41:24 +0530] info [whostmgrd] 71.203.48.51 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.106.21
country_id: 6252001
description:
[2025-12-10 11:41:32 +0530] info [cpaneld] 73.241.106.21 - kiria "GET /login/?login_only=1&user=kiria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiria (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 10 11:41:10 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<65kL5ZJFjIuLonQW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.69.71.54
country_id: 6252001
description:
[2025-12-10 11:41:23 +0530] info [cpaneld] 66.69.71.54 - kiriaswanu "GET /login/?login_only=1&user=kiriaswanu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriaswanu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.138.5
country_id: 6252001
description:
[2025-12-10 11:41:26 +0530] info [cpaneld] 45.50.138.5 - kiriaswan "GET /login/?login_only=1&user=kiriaswan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriaswan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.209.126.176
country_id: 6252001
description:
[2025-12-10 11:41:34 +0530] info [cpaneld] 24.209.126.176 - kir "GET /login/?login_only=1&user=kir&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kir (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.8.246.60
country_id: 6252001
description:
[2025-12-10 11:41:25 +0530] info [cpaneld] 100.8.246.60 - kiriaswanucom "GET /login/?login_only=1&user=kiriaswanucom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriaswanucom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.146.183.66
country_id: 6252001
description:
[2025-12-10 11:41:33 +0530] info [cpaneld] 24.146.183.66 - kiri "GET /login/?login_only=1&user=kiri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.177.168
country_id: 6252001
description:
[2025-12-10 11:41:38 +0530] info [cpaneld] 47.149.177.168 - kiriasw2 "GET /login/?login_only=1&user=kiriasw2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriasw2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.20.106.252
country_id: 6252001
description:
[2025-12-10 11:41:36 +0530] info [cpaneld] 24.20.106.252 - kiriasw1 "GET /login/?login_only=1&user=kiriasw1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriasw1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 11:42:26 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<sxZv6ZJF+O28putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-10 11:43:07 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:53432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-10 11:43:29 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:38754: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.228
country_id: 6252001
description:
2025-12-10 11:44:10 dovecot_login authenticator failed for wsip-184-191-242-228.fv.ks.cox.net [184.191.242.228]:35138: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-12-10 11:44:14 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:34936: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 11:44:22 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.129.182
country_id: 3144096
description:
2025-12-10 11:43:41 dovecot_login authenticator failed for ([188.124.129.182]) [188.124.129.182]:54621: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-10 11:45:07 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (sabic) [76.145.10.140]:38742: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 11:45:07 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Cs4E85JFoKeqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-10 11:47:37 dovecot_plain authenticator failed for (renjumild) [192.34.128.202]:58416: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.174.142.148
country_id: 6252001
description:
[2025-12-10 11:48:32 +0530] info [cpaneld] 104.174.142.148 - lakwe "GET /login/?login_only=1&user=lakwe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.91.204.152
country_id: 6252001
description:
[2025-12-10 11:48:35 +0530] info [cpaneld] 172.91.204.152 - lak "GET /login/?login_only=1&user=lak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lak (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.83.4.174
country_id: 6252001
description:
[2025-12-10 11:48:22 +0530] info [cpaneld] 172.83.4.174 - lakwelholdingscom "GET /login/?login_only=1&user=lakwelholdingscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.177.11.250
country_id: 6252001
description:
[2025-12-10 11:48:23 +0530] info [cpaneld] 47.177.11.250 - lakwelholding "GET /login/?login_only=1&user=lakwelholding&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelholding (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.169.161
country_id: 6252001
description:
[2025-12-10 11:48:25 +0530] info [cpaneld] 172.59.169.161 - lakwelholdin "GET /login/?login_only=1&user=lakwelholdin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelholdin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.120.74.169
country_id: 6252001
description:
[2025-12-10 11:48:21 +0530] info [whostmgrd] 70.120.74.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.140.102
country_id: 6252001
description:
[2025-12-10 11:48:27 +0530] info [cpaneld] 67.187.140.102 - lakwelhol "GET /login/?login_only=1&user=lakwelhol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelhol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.204.212.91
country_id: 6252001
description:
[2025-12-10 11:48:19 +0530] info [cpaneld] 162.204.212.91 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.78.212.245
country_id: 6252001
description:
[2025-12-10 11:48:18 +0530] info [cpaneld] 108.78.212.245 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.11.255.200
country_id: 6252001
description:
[2025-12-10 11:48:20 +0530] info [cpaneld] 66.11.255.200 - lakwelholdings "GET /login/?login_only=1&user=lakwelholdings&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.175.195.92
country_id: 6252001
description:
[2025-12-10 11:48:34 +0530] info [cpaneld] 72.175.195.92 - lakw "GET /login/?login_only=1&user=lakw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakw (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-10 11:48:22 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:36428: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.193.178
country_id: 6252001
description:
[2025-12-10 11:48:30 +0530] info [cpaneld] 172.59.193.178 - lakwel "GET /login/?login_only=1&user=lakwel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.225.150.179
country_id: 6252001
description:
[2025-12-10 11:48:29 +0530] info [cpaneld] 71.225.150.179 - lakwelh "GET /login/?login_only=1&user=lakwelh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.37.145.201
country_id: 6252001
description:
[2025-12-10 11:48:26 +0530] info [cpaneld] 73.37.145.201 - lakwelhold "GET /login/?login_only=1&user=lakwelhold&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelhold (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.147.197.176
country_id: 6252001
description:
[2025-12-10 11:48:26 +0530] info [cpaneld] 99.147.197.176 - lakwelholdi "GET /login/?login_only=1&user=lakwelholdi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelholdi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.201.184.123
country_id: 6252001
description:
[2025-12-10 11:48:28 +0530] info [cpaneld] 68.201.184.123 - lakwelho "GET /login/?login_only=1&user=lakwelho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelho (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 10 11:48:36 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Zaue/5JFZrEDhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.172.108.58
country_id: 6252001
description:
[2025-12-10 11:48:38 +0530] info [cpaneld] 67.172.108.58 - lakwelh2 "GET /login/?login_only=1&user=lakwelh2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelh2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-10 11:48:46 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:44412: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.94.124.144
country_id: 6252001
description:
[2025-12-10 11:48:36 +0530] info [cpaneld] 73.94.124.144 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.14.176.250
country_id: 6252001
description:
[2025-12-10 11:48:37 +0530] info [cpaneld] 104.14.176.250 - lakwelh1 "GET /login/?login_only=1&user=lakwelh1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelh1 (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 11:49:37 host2 sshd[2117480]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.58
country_id: 6252001
description:
Dec 10 11:50:05 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.58, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<B8b1BJNFR8+TuYQ6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 10 11:51:07 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<8CCbCJNFfrUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 10 11:52:32 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<LLStDZNFQtoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-12-10 11:54:02 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:47409: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-12-10 11:54:16 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:54630: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-10 11:54:28 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:35990: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-10 11:54:48 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:51154: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 10 11:55:47 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oqNPGZNFUOkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.235
country_id: 6252001
description:
Dec 10 11:57:15 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.235, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<geaWHpNFrcPG6xjr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-12-10 11:57:27 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:49278: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-10 11:57:46 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:44124: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 10 11:58:08 host2 sshd[2127520]: Disconnected from invalid user ftpuser 50.232.189.209 port 47442 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 10 11:58:37 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<A2x1I5NFTuUDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-10 11:59:37 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (foran) [174.166.153.20]:46374: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.6.111.84
country_id: 6252001
description:
[2025-12-10 12:00:21 +0530] info [cpaneld] 104.6.111.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.53.12
country_id: 6252001
description:
[2025-12-10 12:00:31 +0530] info [cpaneld] 47.147.53.12 - dandag "GET /login/?login_only=1&user=dandag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.185.91.73
country_id: 6252001
description:
[2025-12-10 12:00:30 +0530] info [cpaneld] 173.185.91.73 - dandaga "GET /login/?login_only=1&user=dandaga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.42.220.90
country_id: 6252001
description:
[2025-12-10 12:00:32 +0530] info [cpaneld] 73.42.220.90 - danda "GET /login/?login_only=1&user=danda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user danda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.190.122.247
country_id: 6252001
description:
[2025-12-10 12:00:34 +0530] info [cpaneld] 67.190.122.247 - dan "GET /login/?login_only=1&user=dan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.30.249.61
country_id: 6252001
description:
[2025-12-10 12:00:36 +0530] info [cpaneld] 199.30.249.61 - dandaga1 "GET /login/?login_only=1&user=dandaga1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.21.201.106
country_id: 6252001
description:
[2025-12-10 12:00:23 +0530] info [whostmgrd] 98.21.201.106 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.203.159.22
country_id: 6252001
description:
[2025-12-10 12:00:25 +0530] info [cpaneld] 162.203.159.22 - dandagamuwalk "GET /login/?login_only=1&user=dandagamuwalk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuwalk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.50.11
country_id: 6252001
description:
[2025-12-10 12:00:27 +0530] info [cpaneld] 35.149.50.11 - dandagamuw "GET /login/?login_only=1&user=dandagamuw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.4.195.22
country_id: 6252001
description:
[2025-12-10 12:00:22 +0530] info [cpaneld] 107.4.195.22 - dandagamuwa "GET /login/?login_only=1&user=dandagamuwa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuwa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.1.184.90
country_id: 6252001
description:
[2025-12-10 12:00:29 +0530] info [cpaneld] 172.1.184.90 - dandagam "GET /login/?login_only=1&user=dandagam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.93.25.238
country_id: 6252001
description:
[2025-12-10 12:00:33 +0530] info [cpaneld] 23.93.25.238 - dand "GET /login/?login_only=1&user=dand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dand (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.205
country_id: 1880251
description:
Dec 10 11:59:55 host2 sshd[2135564]: Disconnected from invalid user admin 101.47.143.205 port 33230 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.182.107.155
country_id: 6252001
description:
[2025-12-10 12:00:19 +0530] info [cpaneld] 184.182.107.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.229.182.207
country_id: 6252001
description:
[2025-12-10 12:00:28 +0530] info [cpaneld] 104.229.182.207 - dandagamu "GET /login/?login_only=1&user=dandagamu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.114.16.243
country_id: 6252001
description:
[2025-12-10 12:00:35 +0530] info [cpaneld] 172.114.16.243 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 10 12:01:16 host2 sshd[2140569]: Disconnected from invalid user jira 50.232.189.209 port 44736 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.113.145.176
country_id: 6252001
description:
[2025-12-10 12:00:38 +0530] info [cpaneld] 74.113.145.176 - dandaga2 "GET /login/?login_only=1&user=dandaga2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 10 12:00:41 host2 sshd[2138652]: Disconnected from invalid user sysadmin 50.232.189.209 port 59880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 10 12:02:33 host2 sshd[2144034]: Disconnected from invalid user mapadmin 50.232.189.209 port 42522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 10 12:02:35 host2 sshd[2144062]: Disconnected from invalid user ftpuser 138.197.123.123 port 38890 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 12:03:13 host2 sshd[2145213]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-10 12:03:14 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:40894: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-10 12:03:29 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:34851: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.139
country_id: 298795
description:
Dec 10 12:03:30 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.32.139, lip=66.85.158.91, TLS, session=<LJboM5NFW4NfACCL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-10 12:03:02 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:51460: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 10 12:03:28 host2 sshd[2145564]: Disconnected from invalid user sysadmin 138.197.123.123 port 34382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2025-12-10 12:02:50 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:34032: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.137.209
country_id: 99237
description:
Dec 10 12:03:12 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=65.20.137.209, lip=66.85.158.91, TLS, session=<n57OMpNFcNxBFInR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.21
country_id: 6252001
description:
2025-12-10 12:04:04 dovecot_login authenticator failed for ([98.185.120.21]) [98.185.120.21]:39932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 10 12:04:04 host2 sshd[2146456]: Disconnected from invalid user jira 138.197.123.123 port 35752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 10 12:04:05 host2 sshd[2146448]: Disconnected from invalid user manage 103.171.85.115 port 59572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-10 12:04:33 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:41068: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 10 12:05:17 host2 sshd[2147829]: Disconnected from invalid user integration 103.171.85.115 port 54896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-10 12:05:25 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:48229: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Dec 10 12:04:39 host2 sshd[2147026]: Disconnected from invalid user pedrito 138.197.123.123 port 41196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 10 12:04:48 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<lA2UOZNFThhChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-10 12:06:17 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:46618: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.255.22.2
country_id: 6252001
description:
[2025-12-10 12:06:24 +0530] info [cpaneld] 207.255.22.2 - colpe "GET /login/?login_only=1&user=colpe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colpe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.248.25.202
country_id: 6252001
description:
[2025-12-10 12:06:26 +0530] info [cpaneld] 172.248.25.202 - col "GET /login/?login_only=1&user=col&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user col (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.245.130.8
country_id: 6252001
description:
[2025-12-10 12:06:25 +0530] info [cpaneld] 173.245.130.8 - colp "GET /login/?login_only=1&user=colp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colp (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.205
country_id: 1880251
description:
Dec 10 12:05:53 host2 sshd[2148426]: Disconnected from invalid user ubuntu 101.47.143.205 port 45594 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.69.84.23
country_id: 6252001
description:
[2025-12-10 12:06:14 +0530] info [cpaneld] 68.69.84.23 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.230.12.29
country_id: 6252001
description:
[2025-12-10 12:06:15 +0530] info [cpaneld] 47.230.12.29 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.215.229.12
country_id: 6252001
description:
[2025-12-10 12:06:19 +0530] info [whostmgrd] 66.215.229.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.218.208.201
country_id: 6252001
description:
[2025-12-10 12:06:22 +0530] info [cpaneld] 108.218.208.201 - colperl "GET /login/?login_only=1&user=colperl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colperl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.160.255
country_id: 6252001
description:
[2025-12-10 12:06:16 +0530] info [cpaneld] 23.243.160.255 - colperlab "GET /login/?login_only=1&user=colperlab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.176.193.1
country_id: 6252001
description:
[2025-12-10 12:06:27 +0530] info [cpaneld] 70.176.193.1 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 10 12:06:35 host2 sshd[2148969]: Disconnected from invalid user ubuntu 103.171.85.115 port 42238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-10 12:05:56 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:60546: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.210.78.108
country_id: 6252001
description:
[2025-12-10 12:06:20 +0530] info [cpaneld] 72.210.78.108 - colperlabcom "GET /login/?login_only=1&user=colperlabcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colperlabcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.230.57.105
country_id: 6252001
description:
[2025-12-10 12:06:21 +0530] info [cpaneld] 98.230.57.105 - colperla "GET /login/?login_only=1&user=colperla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colperla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.37.178.180
country_id: 6252001
description:
[2025-12-10 12:06:23 +0530] info [cpaneld] 50.37.178.180 - colper "GET /login/?login_only=1&user=colper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.67.82.126
country_id: 6252001
description:
[2025-12-10 12:06:54 +0530] info [cpaneld] 73.67.82.126 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.234.148.112
country_id: 6252001
description:
[2025-12-10 12:07:10 +0530] info [cpaneld] 162.234.148.112 - su "GET /login/?login_only=1&user=su&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user su (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.0.163
country_id: 6252001
description:
[2025-12-10 12:07:05 +0530] info [cpaneld] 129.222.0.163 - sunris "GET /login/?login_only=1&user=sunris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunris (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.50.193.157
country_id: 6252001
description:
[2025-12-10 12:07:09 +0530] info [cpaneld] 76.50.193.157 - sun "GET /login/?login_only=1&user=sun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.185.46.95
country_id: 6252001
description:
[2025-12-10 12:07:11 +0530] info [cpaneld] 147.185.46.95 - sunrise1 "GET /login/?login_only=1&user=sunrise1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrise1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.162.53.157
country_id: 6252001
description:
[2025-12-10 12:07:13 +0530] info [cpaneld] 67.162.53.157 - sunrise2 "GET /login/?login_only=1&user=sunrise2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrise2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.177.131.45
country_id: 6252001
description:
[2025-12-10 12:06:56 +0530] info [whostmgrd] 104.177.131.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.162.146.210
country_id: 6252001
description:
[2025-12-10 12:07:01 +0530] info [cpaneld] 73.162.146.210 - sunrisel "GET /login/?login_only=1&user=sunrisel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrisel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.155.141.74
country_id: 6252001
description:
[2025-12-10 12:07:04 +0530] info [cpaneld] 47.155.141.74 - sunrise "GET /login/?login_only=1&user=sunrise&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrise (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.130.174.20
country_id: 6252001
description:
[2025-12-10 12:07:07 +0530] info [cpaneld] 69.130.174.20 - sunr "GET /login/?login_only=1&user=sunr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.226.81
country_id: 6252001
description:
[2025-12-10 12:06:55 +0530] info [cpaneld] 172.59.226.81 - sunriselanka "GET /login/?login_only=1&user=sunriselanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.119.74.124
country_id: 6252001
description:
[2025-12-10 12:07:00 +0530] info [cpaneld] 69.119.74.124 - sunrisela "GET /login/?login_only=1&user=sunrisela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrisela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.99.188.99
country_id: 6252001
description:
[2025-12-10 12:06:59 +0530] info [cpaneld] 68.99.188.99 - sunriselan "GET /login/?login_only=1&user=sunriselan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunriselan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.252.96.133
country_id: 6252001
description:
[2025-12-10 12:07:06 +0530] info [cpaneld] 98.252.96.133 - sunri "GET /login/?login_only=1&user=sunri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.38.97.101
country_id: 6252001
description:
[2025-12-10 12:06:53 +0530] info [cpaneld] 96.38.97.101 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.167.245
country_id: 6252001
description:
[2025-12-10 12:06:59 +0530] info [cpaneld] 104.32.167.245 - sunriselank "GET /login/?login_only=1&user=sunriselank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunriselank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.9.176
country_id: 6252001
description:
[2025-12-10 12:06:58 +0530] info [cpaneld] 67.181.9.176 - sunriselankalk "GET /login/?login_only=1&user=sunriselankalk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunriselankalk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.71
country_id: 6252001
description:
Dec 10 12:07:37 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.71, lip=66.85.158.92, TLS, session=<qO6hQ5NFAunN0h9H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 10 12:07:39 host2 sshd[2150024]: Disconnected from invalid user mongo 103.171.85.115 port 45132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-10 12:08:41 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:46040: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-12-10 12:08:54 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:36219: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 12:09:32 host2 sshd[2151783]: Disconnected from invalid user  62.60.131.157 port 7025 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-10 12:10:13 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:52566: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-10 12:10:27 dovecot_login authenticator failed for ([154.208.47.13]) [154.208.47.13]:55718: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 12:12:55 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (volling) [51.195.117.220]:34523: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-10 12:14:09 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (vitibly) [68.60.77.128]:53492: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.72
country_id: 6252001
description:
Dec 10 12:14:49 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.105.72, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ksBiXZNFyp0UqWlI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-12-10 12:19:09 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:50998: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-12-10 12:19:55 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:55846: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.208.134.106
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.208.134.106 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.84.86.2
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.84.86.2 - dataesitelk "GET /login/?login_only=1&user=dataesitelk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataesitelk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.249.198.185
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.249.198.185 - data "GET /login/?login_only=1&user=data&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user data (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.197.34.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.197.34.135 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.220.132.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.220.132.31 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-12-10 12:23:11 dovecot_login authenticator failed for (c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:44812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.193.21.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.193.21.92 - dataesi "GET /login/?login_only=1&user=dataesi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataesi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.165.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.165.238 - dataesite "GET /login/?login_only=1&user=dataesite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataesite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.120.100.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.120.100.135 - dataesit "GET /login/?login_only=1&user=dataesit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.74.82
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.66.74.82 - emlproperties "GET /login/?login_only=1&user=emlproperties&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlproperties (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.127.94.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.127.94.147 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.255.248.112
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.255.248.112 - datae "GET /login/?login_only=1&user=datae&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user datae (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.122.235.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.122.235.56 - dat "GET /login/?login_only=1&user=dat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.138.142.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.138.142.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.58.116.63
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.58.116.63 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.131.156.119
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 135.131.156.119 - dataes "GET /login/?login_only=1&user=dataes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataes (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.78.82.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.78.82.243 - emlpropertie "GET /login/?login_only=1&user=emlpropertie&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlpropertie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.243.165
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.243.165 - emlprop "GET /login/?login_only=1&user=emlprop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlprop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.247.90.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.247.90.87 - emlprop1 "GET /login/?login_only=1&user=emlprop1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlprop1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.17.49
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 35.149.17.49 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.172.108.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.172.108.202 - emlproper "GET /login/?login_only=1&user=emlproper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlproper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.15.66.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.15.66.73 - emlprope "GET /login/?login_only=1&user=emlprope&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlprope (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.144.226.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.144.226.180 - eml "GET /login/?login_only=1&user=eml&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eml (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.213.116.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.213.116.177 - emlp "GET /login/?login_only=1&user=emlp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.121.221.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.121.221.195 - emlpro "GET /login/?login_only=1&user=emlpro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlpro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.7.26.246
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.7.26.246 - emlpr "GET /login/?login_only=1&user=emlpr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlpr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.129.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.39.129.77 - em "GET /login/?login_only=1&user=em&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user em (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-12-10 12:24:02 dovecot_login authenticator failed for ([27.123.114.130]) [27.123.114.130]:32980: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.113.136.254
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.113.136.254 - emlpropertieslk "GET /login/?login_only=1&user=emlpropertieslk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlpropertieslk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.242.203.118
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.242.203.118 - emlproperti "GET /login/?login_only=1&user=emlproperti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlproperti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.73.9.233
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.73.9.233 - emlpropert "GET /login/?login_only=1&user=emlpropert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlpropert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.110.73.184
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.110.73.184 - emlprop2 "GET /login/?login_only=1&user=emlprop2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlprop2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.71.103.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.71.103.93 - lezzarot "GET /login/?login_only=1&user=lezzarot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.0.59.228
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.0.59.228 - lezzar "GET /login/?login_only=1&user=lezzar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.49.34.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.49.34.181 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.216.168.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.216.168.39 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-10 12:25:29 dovecot_plain authenticator failed for (knundente) [64.72.74.162]:49892: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.251.3.241
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.251.3.241 - lezzaro1 "GET /login/?login_only=1&user=lezzaro1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.113.89.158
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.113.89.158 - lezzarotec "GET /login/?login_only=1&user=lezzarotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.131.120.125
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 135.131.120.125 - lezzaro "GET /login/?login_only=1&user=lezzaro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.161.62
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.161.62 - lezz "GET /login/?login_only=1&user=lezz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.39.49.63
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.39.49.63 - lez "GET /login/?login_only=1&user=lez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lez (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-10 12:24:46 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (tenth) [185.62.224.44]:35558: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.235.95.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.235.95.12 - lezzarotechcom "GET /login/?login_only=1&user=lezzarotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.8.122.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.8.122.100 - lezzarote "GET /login/?login_only=1&user=lezzarote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.185.77.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.185.77.11 - lezza "GET /login/?login_only=1&user=lezza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.112.184.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.112.184.32 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.29.246.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.29.246.54 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.181.213.85
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.181.213.85 - lezzarotech "GET /login/?login_only=1&user=lezzarotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.172.107
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.172.107 - lezzaro2 "GET /login/?login_only=1&user=lezzaro2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 12:25:39 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<ngP8g5NFwM+Pbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.2
country_id: 3469034
description:
Dec 10 12:26:22 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=186.209.248.2, lip=66.85.158.91, TLS, session=<czuihZNFOpC60fgC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.29.194.255
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.29.194.255 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.13.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.13.234 - weeratrad "GET /login/?login_only=1&user=weeratrad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratrad (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.227
country_id: 298795
description:
Dec 10 12:26:52 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=95.0.32.227, lip=66.85.158.91, TLS, session=<75tqh5NFksdfACDj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.60.64.114
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.60.64.114 - weeratradi "GET /login/?login_only=1&user=weeratradi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratradi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.4.216
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 167.248.4.216 - weeratradin "GET /login/?login_only=1&user=weeratradin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratradin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.48.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.51.48.39 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.166.18.19
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.166.18.19 - weeratra "GET /login/?login_only=1&user=weeratra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.55.62.253
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.55.62.253 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.59.189.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.59.189.219 - weerat "GET /login/?login_only=1&user=weerat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weerat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.175.118.140
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.175.118.140 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.241.128
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.241.128 - weeratrading "GET /login/?login_only=1&user=weeratrading&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratrading (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-10 12:26:47 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (nismoningn) [68.52.119.193]:36840: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.6.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.170.6.39 - weeratradingcom "GET /login/?login_only=1&user=weeratradingcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratradingcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.216.54.104
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.216.54.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.80.90.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.80.90.18 - weeratr "GET /login/?login_only=1&user=weeratr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.49.199.172
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.49.199.172 - agentallia "GET /login/?login_only=1&user=agentallia&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentallia (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.169.158.46
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.169.158.46 - age "GET /login/?login_only=1&user=age&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user age (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.144.81.191
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.144.81.191 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.125.192.216
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.125.192.216 - agentall "GET /login/?login_only=1&user=agentall&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentall (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.169.235.247
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.169.235.247 - agenta "GET /login/?login_only=1&user=agenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.7.37.229
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.7.37.229 - agental1 "GET /login/?login_only=1&user=agental1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.241.79.140
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.241.79.140 - weera "GET /login/?login_only=1&user=weera&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weera (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.254.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.254.21 - agentallianzcom "GET /login/?login_only=1&user=agentallianzcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentallianzcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.70.14.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.70.14.130 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.252.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.50.252.51 - weeratr1 "GET /login/?login_only=1&user=weeratr1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratr1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.7.122
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.134.7.122 - weeratr2 "GET /login/?login_only=1&user=weeratr2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratr2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-12-10 12:28:19 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:63757: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-10 12:28:14 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:53293: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.20.207.132
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.20.207.132 - weer "GET /login/?login_only=1&user=weer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.190.174.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.190.174.178 - we "GET /login/?login_only=1&user=we&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user we (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.51.220.41
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.51.220.41 - wee "GET /login/?login_only=1&user=wee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.128.233.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.128.233.146 - agentalli "GET /login/?login_only=1&user=agentalli&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentalli (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.123.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.90.123.35 - agental "GET /login/?login_only=1&user=agental&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.229.47.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.229.47.84 - agentallianz "GET /login/?login_only=1&user=agentallianz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User agentallianz has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.141.96.90
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.141.96.90 - agentallian "GET /login/?login_only=1&user=agentallian&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentallian (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.30.149.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.30.149.126 - agent "GET /login/?login_only=1&user=agent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.23.153.23
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.23.153.23 - agen "GET /login/?login_only=1&user=agen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.125.180.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.125.180.102 - agental2 "GET /login/?login_only=1&user=agental2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-10 12:28:40 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:46979: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.158.59.44
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.158.59.44 - euroentertainmentlk "GET /login/?login_only=1&user=euroentertainmentlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.27.132
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.171.27.132 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.60.58.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 139.60.58.10 - euroentertainmentl "GET /login/?login_only=1&user=euroentertainmentl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.5.237.124
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.5.237.124 - euroenterta "GET /login/?login_only=1&user=euroenterta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenterta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.193.20.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.193.20.45 - eu "GET /login/?login_only=1&user=eu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.85.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.85.225 - euroent "GET /login/?login_only=1&user=euroent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.103.144.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.103.144.100 - eur "GET /login/?login_only=1&user=eur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.170.105.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 148.170.105.147 - euroentertainme "GET /login/?login_only=1&user=euroentertainme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.164.105.200
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.164.105.200 - euroentertainm "GET /login/?login_only=1&user=euroentertainm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.25.139
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.243.25.139 - euroent1 "GET /login/?login_only=1&user=euroent1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-10 12:29:33 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:38898: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 12:28:46 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Ixwpj5NFGKQXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.87.176.46
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.87.176.46 - euroentertai "GET /login/?login_only=1&user=euroentertai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.39.91.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.39.91.56 - euroe "GET /login/?login_only=1&user=euroe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.149.66
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.149.66 - euroent2 "GET /login/?login_only=1&user=euroent2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.118.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.151.118.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.134.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.89.134.60 - euroentertainmen "GET /login/?login_only=1&user=euroentertainmen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.178.128.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.178.128.214 - euro "GET /login/?login_only=1&user=euro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euro (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-10 12:28:47 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:34642: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.255.95.119
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.255.95.119 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.6.212.175
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.6.212.175 - euroen "GET /login/?login_only=1&user=euroen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.73.98.129
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.73.98.129 - euroentertain "GET /login/?login_only=1&user=euroentertain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.96.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.242.96.36 - euroenter "GET /login/?login_only=1&user=euroenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.240.10.69
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.240.10.69 - euroentert "GET /login/?login_only=1&user=euroentert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.28.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.61.28.138 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.101.243.231
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 99.101.243.231 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.7.171.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.7.171.13 - euroentertainment "GET /login/?login_only=1&user=euroentertainment&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainment (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-10 12:29:52 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:37922: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 12:32:16 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (vibaciongy) [51.195.117.220]:34982: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-10 12:34:21 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:40820: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.43
country_id: 1733045
description:
2025-12-10 12:35:04 dovecot_login authenticator failed for ([49.124.146.43]) [49.124.146.43]:48218: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 10 12:35:19 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<m+21ppNF8oY26lCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-10 12:35:23 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:50583: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.225.248
country_id: 290557
description:
2025-12-10 12:34:57 dovecot_login authenticator failed for ([91.73.225.248]) [91.73.225.248]:48648: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 12:35:40 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (colusse) [96.230.65.90]:38288: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 12:36:37 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (entypen) [87.103.126.54]:27951: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.242.91.220
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.242.91.220 - lank "GET /login/?login_only=1&user=lank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.57.249
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.243.57.249 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.193.28.175
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.193.28.175 - lankaherbalsolution "GET /login/?login_only=1&user=lankaherbalsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.49.42.148
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.49.42.148 - lankaherbalsolut "GET /login/?login_only=1&user=lankaherbalsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.137.152.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.137.152.21 - lankaherbalso "GET /login/?login_only=1&user=lankaherbalso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.45.116.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.45.116.103 - lankaher "GET /login/?login_only=1&user=lankaher&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.45.146.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.45.146.100 - lankahe "GET /login/?login_only=1&user=lankahe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.104.239.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.104.239.195 - lankaherbalsolu "GET /login/?login_only=1&user=lankaherbalsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.81.108
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.90.81.108 - lankaherbalsol "GET /login/?login_only=1&user=lankaherbalsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.6.142.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.6.142.51 - lankaherbal "GET /login/?login_only=1&user=lankaherbal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.60.113.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.60.113.133 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.104.175.187
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 97.104.175.187 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.155.215
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.188.155.215 - lankaherbalsolutio "GET /login/?login_only=1&user=lankaherbalsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolutio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.218.188.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.218.188.206 - lanka "GET /login/?login_only=1&user=lanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lanka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.255.30.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.255.30.230 - lankaherbals "GET /login/?login_only=1&user=lankaherbals&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbals (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.74.188.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.74.188.144 - lankaherba "GET /login/?login_only=1&user=lankaherba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.98.104.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.98.104.250 - lankaherb "GET /login/?login_only=1&user=lankaherb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.52.24.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.52.24.21 - lankah "GET /login/?login_only=1&user=lankah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.159.183.247
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.159.183.247 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.115.226.215
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.115.226.215 - lankaherbalsolutions "GET /login/?login_only=1&user=lankaherbalsolutions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolutions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.249.234.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.249.234.105 - lankaherbalsolutionscom "GET /login/?login_only=1&user=lankaherbalsolutionscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolutionscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.125.248.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.125.248.143 - lankaherbalsoluti "GET /login/?login_only=1&user=lankaherbalsoluti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsoluti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.26.181.14
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.26.181.14 - lan "GET /login/?login_only=1&user=lan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.88.4.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.88.4.195 - lankahe2 "GET /login/?login_only=1&user=lankahe2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.208.131.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.208.131.77 - lankahe1 "GET /login/?login_only=1&user=lankahe1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-10 12:42:51 dovecot_login authenticator failed for ([102.38.3.109]) [102.38.3.109]:39525: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-10 12:43:02 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:45104: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.72.59
country_id: 3996063
description:
2025-12-10 12:43:04 dovecot_login authenticator failed for (201.173.72.59-clientes-izzi.mx) [201.173.72.59]:46213: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.139
country_id: 6252001
description:
2025-12-10 12:43:30 dovecot_login authenticator failed for wsip-184-191-250-139.fv.ks.cox.net [184.191.250.139]:47425: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 87.241.102.128
country_id: 2661886
description:
Dec 10 12:44:08 host2 sshd[2184628]: Disconnecting authenticating user root 87.241.102.128 port 36204: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-12-10 12:44:21 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:38714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-10 12:44:24 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:48534: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 12:43:47 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-12-10 12:44:07 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:40364: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 87.241.102.128
country_id: 2661886
description:
Dec 10 12:44:08 host2 sshd[2184628]: error: maximum authentication attempts exceeded for root from 87.241.102.128 port 36204 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.56
country_id: 1733045
description:
2025-12-10 12:44:38 dovecot_login authenticator failed for ([49.124.145.56]) [49.124.145.56]:48050: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 87.241.102.128
country_id: 2661886
description:
Dec 10 12:44:46 host2 sshd[2185330]: Disconnecting authenticating user root 87.241.102.128 port 38562: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 87.241.102.128
country_id: 2661886
description:
Dec 10 12:44:46 host2 sshd[2185330]: error: maximum authentication attempts exceeded for root from 87.241.102.128 port 38562 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.96.102.157
country_id: 6252001
description:
[2025-12-10 12:46:18 +0530] info [cpaneld] 99.96.102.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 12:46:18 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.132.219
country_id: 6252001
description:
[2025-12-10 12:46:22 +0530] info [cpaneld] 46.110.132.219 - tfab "GET /login/?login_only=1&user=tfab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tfab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.236.2
country_id: 6252001
description:
[2025-12-10 12:46:23 +0530] info [whostmgrd] 76.32.236.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.116.0.196
country_id: 6252001
description:
[2025-12-10 12:46:30 +0530] info [cpaneld] 73.116.0.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.8.147.222
country_id: 6252001
description:
[2025-12-10 12:46:32 +0530] info [cpaneld] 76.8.147.222 - sivagnanamfoundation "GET /login/?login_only=1&user=sivagnanamfoundation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.229.172.142
country_id: 6252001
description:
[2025-12-10 12:46:21 +0530] info [cpaneld] 47.229.172.142 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.224.235
country_id: 6252001
description:
[2025-12-10 12:46:36 +0530] info [cpaneld] 73.41.224.235 - sivagnanamfoundatio "GET /login/?login_only=1&user=sivagnanamfoundatio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundatio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.143.141.132
country_id: 6252001
description:
[2025-12-10 12:46:24 +0530] info [cpaneld] 69.143.141.132 - tfablk "GET /login/?login_only=1&user=tfablk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.163.120.67
country_id: 6252001
description:
[2025-12-10 12:46:26 +0530] info [cpaneld] 73.163.120.67 - tf "GET /login/?login_only=1&user=tf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.65.243.244
country_id: 6252001
description:
[2025-12-10 12:46:25 +0530] info [cpaneld] 99.65.243.244 - tfa "GET /login/?login_only=1&user=tfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tfa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.46.225.221
country_id: 6252001
description:
[2025-12-10 12:46:35 +0530] info [cpaneld] 98.46.225.221 - sivagnanamfoundationcom "GET /login/?login_only=1&user=sivagnanamfoundationcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundationcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.125.232.105
country_id: 6252001
description:
[2025-12-10 12:46:33 +0530] info [whostmgrd] 76.125.232.105 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.126.227
country_id: 6252001
description:
[2025-12-10 12:46:32 +0530] info [cpaneld] 73.92.126.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.133.131.250
country_id: 6252001
description:
[2025-12-10 12:46:57 +0530] info [cpaneld] 216.133.131.250 - sivagna2 "GET /login/?login_only=1&user=sivagna2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagna2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.47.58.12
country_id: 6252001
description:
[2025-12-10 12:46:40 +0530] info [cpaneld] 216.47.58.12 - sivagnanamfound "GET /login/?login_only=1&user=sivagnanamfound&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfound (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.14.38
country_id: 6252001
description:
[2025-12-10 12:46:41 +0530] info [cpaneld] 71.193.14.38 - sivagnanamfoun "GET /login/?login_only=1&user=sivagnanamfoun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.63.40.23
country_id: 6252001
description:
[2025-12-10 12:46:46 +0530] info [cpaneld] 136.63.40.23 - sivagnan "GET /login/?login_only=1&user=sivagnan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.229.172.142
country_id: 6252001
description:
[2025-12-10 12:46:46 +0530] info [cpaneld] 47.229.172.142 - sivagnana "GET /login/?login_only=1&user=sivagnana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.239.96.174
country_id: 6252001
description:
[2025-12-10 12:46:53 +0530] info [cpaneld] 96.239.96.174 - siv "GET /login/?login_only=1&user=siv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user siv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.16.187.251
country_id: 6252001
description:
[2025-12-10 12:46:54 +0530] info [cpaneld] 76.16.187.251 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.13.236
country_id: 6252001
description:
[2025-12-10 12:46:56 +0530] info [cpaneld] 71.9.13.236 - sivagna1 "GET /login/?login_only=1&user=sivagna1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagna1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.82.89
country_id: 6252001
description:
[2025-12-10 12:46:39 +0530] info [cpaneld] 96.2.82.89 - sivagnanamfounda "GET /login/?login_only=1&user=sivagnanamfounda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.72.52.241
country_id: 6252001
description:
[2025-12-10 12:46:45 +0530] info [cpaneld] 73.72.52.241 - sivagnanam "GET /login/?login_only=1&user=sivagnanam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.168.222.247
country_id: 6252001
description:
[2025-12-10 12:46:48 +0530] info [cpaneld] 146.168.222.247 - sivagna "GET /login/?login_only=1&user=sivagna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.1.116
country_id: 6252001
description:
[2025-12-10 12:46:49 +0530] info [cpaneld] 98.97.1.116 - sivag "GET /login/?login_only=1&user=sivag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.180.191
country_id: 6252001
description:
[2025-12-10 12:46:38 +0530] info [cpaneld] 184.179.180.191 - sivagnanamfoundat "GET /login/?login_only=1&user=sivagnanamfoundat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.66.76.23
country_id: 6252001
description:
[2025-12-10 12:46:37 +0530] info [cpaneld] 207.66.76.23 - sivagnanamfoundati "GET /login/?login_only=1&user=sivagnanamfoundati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.39.223.89
country_id: 6252001
description:
[2025-12-10 12:46:42 +0530] info [cpaneld] 73.39.223.89 - sivagnanamfou "GET /login/?login_only=1&user=sivagnanamfou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.110.132.213
country_id: 6252001
description:
[2025-12-10 12:46:48 +0530] info [cpaneld] 64.110.132.213 - sivagn "GET /login/?login_only=1&user=sivagn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.218.231.24
country_id: 6252001
description:
[2025-12-10 12:46:51 +0530] info [cpaneld] 32.218.231.24 - siva "GET /login/?login_only=1&user=siva&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user siva (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.143
country_id: 6252001
description:
[2025-12-10 12:46:44 +0530] info [cpaneld] 172.58.167.143 - sivagnanamf "GET /login/?login_only=1&user=sivagnanamf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.75.52.210
country_id: 6252001
description:
[2025-12-10 12:46:43 +0530] info [cpaneld] 66.75.52.210 - sivagnanamfo "GET /login/?login_only=1&user=sivagnanamfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-10 12:48:08 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:41772: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-12-10 12:48:24 dovecot_login authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:56282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 12:47:48 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<I4Q005NFeMO8putr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.103.248.15
country_id: 6252001
description:
[2025-12-10 12:48:50 +0530] info [cpaneld] 73.103.248.15 - agronaturehol "GET /login/?login_only=1&user=agronaturehol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronaturehol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.108.98.23
country_id: 6252001
description:
[2025-12-10 12:49:07 +0530] info [cpaneld] 64.108.98.23 - agronat2 "GET /login/?login_only=1&user=agronat2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronat2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.82.148.208
country_id: 6252001
description:
[2025-12-10 12:48:40 +0530] info [cpaneld] 75.82.148.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.142.118
country_id: 6252001
description:
[2025-12-10 12:48:42 +0530] info [whostmgrd] 71.9.142.118 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.55.204.69
country_id: 6252001
description:
[2025-12-10 12:48:43 +0530] info [cpaneld] 174.55.204.69 - agronatureholdingscom "GET /login/?login_only=1&user=agronatureholdingscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.50.252.106
country_id: 6252001
description:
[2025-12-10 12:49:01 +0530] info [cpaneld] 76.50.252.106 - agron "GET /login/?login_only=1&user=agron&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agron (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.123.110
country_id: 6252001
description:
[2025-12-10 12:49:05 +0530] info [cpaneld] 76.175.123.110 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.155.105.95
country_id: 6252001
description:
[2025-12-10 12:49:06 +0530] info [cpaneld] 184.155.105.95 - agronat1 "GET /login/?login_only=1&user=agronat1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronat1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.10.13.142
country_id: 6252001
description:
[2025-12-10 12:48:38 +0530] info [cpaneld] 72.10.13.142 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.183.100.138
country_id: 6252001
description:
[2025-12-10 12:48:54 +0530] info [cpaneld] 24.183.100.138 - agronature "GET /login/?login_only=1&user=agronature&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronature (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.146.52.131
country_id: 6252001
description:
[2025-12-10 12:49:03 +0530] info [cpaneld] 35.146.52.131 - agro "GET /login/?login_only=1&user=agro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.34.223.204
country_id: 6252001
description:
[2025-12-10 12:48:49 +0530] info [cpaneld] 47.34.223.204 - agronaturehold "GET /login/?login_only=1&user=agronaturehold&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronaturehold (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.205.108
country_id: 6252001
description:
[2025-12-10 12:49:00 +0530] info [cpaneld] 24.4.205.108 - agrona "GET /login/?login_only=1&user=agrona&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.37.195
country_id: 6252001
description:
[2025-12-10 12:48:41 +0530] info [cpaneld] 73.170.37.195 - agronatureholdings "GET /login/?login_only=1&user=agronatureholdings&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholdings (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.163.24.141
country_id: 6252001
description:
[2025-12-10 12:48:45 +0530] info [cpaneld] 174.163.24.141 - agronatureholding "GET /login/?login_only=1&user=agronatureholding&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholding (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.76.174
country_id: 6252001
description:
[2025-12-10 12:48:46 +0530] info [cpaneld] 76.32.76.174 - agronatureholdi "GET /login/?login_only=1&user=agronatureholdi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholdi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.126.43.75
country_id: 6252001
description:
[2025-12-10 12:48:57 +0530] info [cpaneld] 141.126.43.75 - agronatu "GET /login/?login_only=1&user=agronatu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.198.13
country_id: 6252001
description:
[2025-12-10 12:48:55 +0530] info [cpaneld] 76.35.198.13 - agronatur "GET /login/?login_only=1&user=agronatur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.81.90.202
country_id: 6252001
description:
[2025-12-10 12:48:58 +0530] info [cpaneld] 206.81.90.202 - agronat "GET /login/?login_only=1&user=agronat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.233.144
country_id: 6252001
description:
[2025-12-10 12:49:04 +0530] info [cpaneld] 23.243.233.144 - agr "GET /login/?login_only=1&user=agr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.17.12
country_id: 6252001
description:
[2025-12-10 12:48:46 +0530] info [cpaneld] 76.150.17.12 - agronatureholdin "GET /login/?login_only=1&user=agronatureholdin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.186.86.120
country_id: 6252001
description:
[2025-12-10 12:48:51 +0530] info [cpaneld] 75.186.86.120 - agronatureho "GET /login/?login_only=1&user=agronatureho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.166.145.173
country_id: 6252001
description:
[2025-12-10 12:48:52 +0530] info [cpaneld] 76.166.145.173 - agronatureh "GET /login/?login_only=1&user=agronatureh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureh (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 12:50:17 host2 sshd[2190785]: Disconnected from invalid user user 2.57.121.25 port 52872 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.226.61.95
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.226.61.95: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.114.25
country_id: 6252001
description:
Dec 10 12:52:20 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.114.25, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3ceM45NFOMKsynIZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-10 12:53:17 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:46161: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-10 12:53:19 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:38347: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-10 12:53:40 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:53938: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2025-12-10 12:53:40 dovecot_login authenticator failed for ([182.95.125.122]) [182.95.125.122]:49132: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-10 12:54:28 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:60222: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-10 12:55:04 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:46048: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.240
country_id: 6252001
description:
2025-12-10 12:57:01 dovecot_login authenticator failed for wsip-184-191-242-240.fv.ks.cox.net [184.191.242.240]:36175: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-10 12:57:17 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:46510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.55
country_id: 1733045
description:
2025-12-10 12:57:20 dovecot_login authenticator failed for ([49.124.151.55]) [49.124.151.55]:41322: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-12-10 12:57:23 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:47570: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2025-12-10 12:57:23 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:59368: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.222.192.238
country_id: 6252001
description:
[2025-12-10 12:58:22 +0530] info [cpaneld] 73.222.192.238 - greentara "GET /login/?login_only=1&user=greentara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.9.161.118
country_id: 6252001
description:
[2025-12-10 12:58:24 +0530] info [cpaneld] 104.9.161.118 - greenta "GET /login/?login_only=1&user=greenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.218.18.139
country_id: 6252001
description:
[2025-12-10 12:58:24 +0530] info [cpaneld] 174.218.18.139 - greentar "GET /login/?login_only=1&user=greentar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.78.40.164
country_id: 6252001
description:
[2025-12-10 12:58:28 +0530] info [cpaneld] 73.78.40.164 - gree "GET /login/?login_only=1&user=gree&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.90.54.164
country_id: 6252001
description:
[2025-12-10 12:58:32 +0530] info [cpaneld] 73.90.54.164 - greenta2 "GET /login/?login_only=1&user=greenta2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.10.252.198
country_id: 6252001
description:
[2025-12-10 12:58:31 +0530] info [cpaneld] 24.10.252.198 - greenta1 "GET /login/?login_only=1&user=greenta1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-10 12:58:15 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:40280: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.53.240.138
country_id: 6252001
description:
[2025-12-10 12:58:29 +0530] info [cpaneld] 174.53.240.138 - gre "GET /login/?login_only=1&user=gre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.49.56.249
country_id: 6252001
description:
[2025-12-10 12:58:30 +0530] info [cpaneld] 24.49.56.249 - gr "GET /login/?login_only=1&user=gr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.222.145.10
country_id: 6252001
description:
[2025-12-10 12:58:12 +0530] info [cpaneld] 69.222.145.10 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.42.82.212
country_id: 6252001
description:
[2025-12-10 12:58:14 +0530] info [cpaneld] 68.42.82.212 - greentaraceylon "GET /login/?login_only=1&user=greentaraceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.71.25.185
country_id: 6252001
description:
[2025-12-10 12:58:16 +0530] info [cpaneld] 209.71.25.185 - greentaraceyloncom "GET /login/?login_only=1&user=greentaraceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.16.211.69
country_id: 6252001
description:
[2025-12-10 12:58:19 +0530] info [cpaneld] 100.16.211.69 - greentaracey "GET /login/?login_only=1&user=greentaracey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaracey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.228.104.74
country_id: 6252001
description:
[2025-12-10 12:58:21 +0530] info [cpaneld] 104.228.104.74 - greentarac "GET /login/?login_only=1&user=greentarac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentarac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.182.201.168
country_id: 6252001
description:
[2025-12-10 12:58:26 +0530] info [cpaneld] 174.182.201.168 - green "GET /login/?login_only=1&user=green&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user green (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-10 12:57:39 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:41099: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.184.241.84
country_id: 6252001
description:
[2025-12-10 12:58:13 +0530] info [cpaneld] 64.184.241.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.161.115.156
country_id: 6252001
description:
[2025-12-10 12:58:15 +0530] info [whostmgrd] 69.161.115.156 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.218.139.237
country_id: 6252001
description:
[2025-12-10 12:58:18 +0530] info [cpaneld] 15.218.139.237 - greentaraceyl "GET /login/?login_only=1&user=greentaraceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.250.53.76
country_id: 6252001
description:
[2025-12-10 12:58:17 +0530] info [cpaneld] 96.250.53.76 - greentaraceylo "GET /login/?login_only=1&user=greentaraceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.89.98.63
country_id: 6252001
description:
[2025-12-10 12:58:20 +0530] info [cpaneld] 108.89.98.63 - greentarace "GET /login/?login_only=1&user=greentarace&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentarace (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.8.114.211
country_id: 6252001
description:
[2025-12-10 12:58:25 +0530] info [cpaneld] 73.8.114.211 - greent "GET /login/?login_only=1&user=greent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greent (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-10 12:58:36 dovecot_login authenticator failed for ([149.54.62.26]) [149.54.62.26]:54102: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-10 12:59:16 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:44416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.158.252.235
country_id: 6252001
description:
[2025-12-10 12:59:49 +0530] info [cpaneld] 99.158.252.235 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-10 12:59:58 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:49305: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.89.206.181
country_id: 6252001
description:
[2025-12-10 12:59:44 +0530] info [cpaneld] 72.89.206.181 - trails "GET /login/?login_only=1&user=trails&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.131.109.191
country_id: 6252001
description:
[2025-12-10 12:59:44 +0530] info [cpaneld] 107.131.109.191 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.23.176.24
country_id: 6252001
description:
[2025-12-10 12:59:47 +0530] info [cpaneld] 98.23.176.24 - trail "GET /login/?login_only=1&user=trail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.33.162.34
country_id: 6252001
description:
[2025-12-10 12:59:46 +0530] info [cpaneld] 100.33.162.34 - trailslk "GET /login/?login_only=1&user=trailslk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trailslk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.189.132.119
country_id: 6252001
description:
[2025-12-10 12:59:42 +0530] info [cpaneld] 70.189.132.119 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.73.14.9
country_id: 6252001
description:
[2025-12-10 12:59:45 +0530] info [whostmgrd] 69.73.14.9 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.248.220.165
country_id: 6252001
description:
[2025-12-10 12:59:48 +0530] info [cpaneld] 108.248.220.165 - trai "GET /login/?login_only=1&user=trai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.171.72.3
country_id: 6252001
description:
[2025-12-10 12:59:50 +0530] info [cpaneld] 97.171.72.3 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-10 13:02:28 dovecot_plain authenticator failed for (warole) [91.73.188.251]:33445: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 13:02:23 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (piter) [51.195.117.220]:10050: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.223.93.160
country_id: 6252001
description:
[2025-12-10 13:06:16 +0530] info [whostmgrd] 98.223.93.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.203.9.24
country_id: 6252001
description:
[2025-12-10 13:06:19 +0530] info [cpaneld] 12.203.9.24 - simpleengineeri "GET /login/?login_only=1&user=simpleengineeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.216.108.34
country_id: 6252001
description:
[2025-12-10 13:06:22 +0530] info [cpaneld] 72.216.108.34 - simpleenginee "GET /login/?login_only=1&user=simpleenginee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleenginee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.184.182
country_id: 6252001
description:
[2025-12-10 13:06:31 +0530] info [cpaneld] 172.59.184.182 - simple "GET /login/?login_only=1&user=simple&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simple (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.173.193.243
country_id: 6252001
description:
[2025-12-10 13:06:32 +0530] info [cpaneld] 71.173.193.243 - simpl "GET /login/?login_only=1&user=simpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.9.22.144
country_id: 6252001
description:
[2025-12-10 13:06:13 +0530] info [cpaneld] 99.9.22.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.154.103.153
country_id: 6252001
description:
[2025-12-10 13:06:14 +0530] info [cpaneld] 24.154.103.153 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.193.213.191
country_id: 6252001
description:
[2025-12-10 13:06:23 +0530] info [cpaneld] 98.193.213.191 - simpleengine "GET /login/?login_only=1&user=simpleengine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.220.223.10
country_id: 6252001
description:
[2025-12-10 13:06:27 +0530] info [cpaneld] 98.220.223.10 - simpleengi "GET /login/?login_only=1&user=simpleengi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.7.57.1
country_id: 6252001
description:
[2025-12-10 13:06:25 +0530] info [cpaneld] 47.7.57.1 - simpleengin "GET /login/?login_only=1&user=simpleengin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.114.182.106
country_id: 6252001
description:
[2025-12-10 13:06:15 +0530] info [cpaneld] 73.114.182.106 - simpleengineering "GET /login/?login_only=1&user=simpleengineering&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineering (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.45.87.181
country_id: 6252001
description:
[2025-12-10 13:06:21 +0530] info [cpaneld] 98.45.87.181 - simpleengineer "GET /login/?login_only=1&user=simpleengineer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.54.126.108
country_id: 6252001
description:
[2025-12-10 13:06:29 +0530] info [cpaneld] 104.54.126.108 - simpleen "GET /login/?login_only=1&user=simpleen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.168.26.217
country_id: 6252001
description:
[2025-12-10 13:06:28 +0530] info [cpaneld] 206.168.26.217 - simpleeng "GET /login/?login_only=1&user=simpleeng&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleeng (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.218.215.57
country_id: 6252001
description:
[2025-12-10 13:06:17 +0530] info [cpaneld] 97.218.215.57 - simpleengineeringlk "GET /login/?login_only=1&user=simpleengineeringlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineeringlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.186.71.142
country_id: 6252001
description:
[2025-12-10 13:06:18 +0530] info [cpaneld] 67.186.71.142 - simpleengineerin "GET /login/?login_only=1&user=simpleengineerin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.83.118.234
country_id: 6252001
description:
[2025-12-10 13:06:30 +0530] info [cpaneld] 184.83.118.234 - simplee "GET /login/?login_only=1&user=simplee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.191.212
country_id: 6252001
description:
[2025-12-10 13:06:34 +0530] info [cpaneld] 172.59.191.212 - sim "GET /login/?login_only=1&user=sim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.202
country_id: 6252001
description:
[2025-12-10 13:06:33 +0530] info [cpaneld] 172.58.167.202 - simp "GET /login/?login_only=1&user=simp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.129.32.162
country_id: 6252001
description:
[2025-12-10 13:06:36 +0530] info [cpaneld] 66.129.32.162 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.63.51.8
country_id: 6252001
description:
[2025-12-10 13:06:39 +0530] info [cpaneld] 104.63.51.8 - simplee2 "GET /login/?login_only=1&user=simplee2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.81.136.149
country_id: 6252001
description:
[2025-12-10 13:06:38 +0530] info [cpaneld] 75.81.136.149 - simplee1 "GET /login/?login_only=1&user=simplee1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-10 13:10:10 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:64841: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-10 13:10:45 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:50734: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.255
country_id: 6252001
description:
Dec 10 13:11:40 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.255, lip=66.85.158.92, TLS, session=<7sS1KJRFjvnG6xj/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Dec 10 13:16:55 host2 sshd[2215098]: Disconnected from invalid user cortega 103.161.207.2 port 54814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Dec 10 13:17:20 host2 sshd[2215423]: Disconnected from invalid user testuser 122.176.122.24 port 40214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 13:17:30 host2 sshd[2215524]: Disconnected from invalid user admin 2.57.121.112 port 56646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-10 13:19:09 dovecot_login authenticator failed for ([182.78.241.30]) [182.78.241.30]:45854: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.43.207
country_id: 3144096
description:
2025-12-10 13:19:12 dovecot_login authenticator failed for (cm-46.212.43.207.get.no) [46.212.43.207]:36840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Dec 10 13:18:22 host2 sshd[2216269]: Disconnected from invalid user stefano 103.161.207.2 port 52116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 10 13:18:40 host2 sshd[2216737]: Disconnected from invalid user ricardo 197.5.145.8 port 56240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-10 13:19:31 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:44458: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 10 13:19:37 host2 sshd[2217387]: Disconnected from invalid user yzx 197.5.145.8 port 50738 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-10 13:19:26 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:54142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-10 13:20:18 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:48436: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-10 13:20:39 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:55373: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Dec 10 13:20:51 host2 sshd[2218591]: Disconnected from invalid user ssh 192.227.128.3 port 51890 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 10 13:22:03 host2 sshd[2219393]: Received disconnect from 197.5.145.8 port 51632:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 10 13:22:03 host2 sshd[2219393]: Disconnected from invalid user user01 197.5.145.8 port 51632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Dec 10 13:23:38 host2 sshd[2220594]: Disconnected from invalid user jinyu 94.102.4.12 port 44678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Dec 10 13:25:47 host2 sshd[2222293]: Disconnected from invalid user user5 94.102.4.12 port 46690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 6252001
description:
2025-12-10 13:26:02 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:36196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-10 13:25:41 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:38552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Dec 10 13:25:43 host2 sshd[2222157]: Disconnected from invalid user sftpuser 192.227.128.3 port 42772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-10 13:26:16 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:39162: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-10 13:26:19 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:37509: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-10 13:26:27 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:59884: 535 Incorrect authentication data (set_id=contact)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.226.61.95
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.226.61.95: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.81.250
country_id: 1269750
description:
Dec 10 13:27:11 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.30.81.250, lip=66.85.158.91, TLS, session=<Gr0iX5RF4NZnHlH6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.47.99.66
country_id: 3077311
description:
Dec 10 13:27:29 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=31.47.99.66, lip=66.85.158.91, TLS, session=<py5GYJRFp5cfL2NC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-10 13:27:34 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:39334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-10 13:27:49 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:55602: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 13:28:04 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<billing@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<eV42Y5RFxoWPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-10 13:27:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57226: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.102.4.12
country_id: 298795
description:
Dec 10 13:29:25 host2 sshd[2225498]: Disconnected from invalid user applmgr 94.102.4.12 port 59006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 13:30:36 host2 sshd[2226504]: Disconnected from invalid user admin 2.57.121.112 port 38576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-10 13:31:26 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:40969: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-10 13:31:40 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:33858: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.151.200.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.151.200.250 - nsteel "GET /login/?login_only=1&user=nsteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-10 13:33:07 dovecot_plain authenticator failed for (roment) [75.97.190.237]:44899: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.131.198.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.131.198.50 - nsteelengcom "GET /login/?login_only=1&user=nsteelengcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteelengcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.75.113.76
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.75.113.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 13:33:10 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (viterchers) [51.195.117.220]:60138: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-10 13:33:12 dovecot_login authenticator failed for ([152.52.234.4]) [152.52.231.202]:53844: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-10 13:32:21 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:57258: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.62.189.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 144.62.189.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.204.105.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.204.105.40 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.158.111.222
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.158.111.222 - nsteele "GET /login/?login_only=1&user=nsteele&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteele (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.86
country_id: 6252001
description:
Dec 10 13:32:36 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.86, lip=66.85.158.92, session=<X4WMc5RFZv/N0h9W>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.1.117.187
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.1.117.187 - nsteelen "GET /login/?login_only=1&user=nsteelen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteelen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.117.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 143.105.117.144 - nsteeleng "GET /login/?login_only=1&user=nsteeleng&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.191.164.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.191.164.126 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.51.106.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.51.106.203 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Dec 10 13:33:38 host2 sshd[2228964]: Disconnected from invalid user rsyncuser 94.102.4.12 port 57686 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.215.41.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.215.41.230 - nstee "GET /login/?login_only=1&user=nstee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.237.17.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.237.17.160 - nste "GET /login/?login_only=1&user=nste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nste (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Dec 10 13:35:54 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<GUFff5RFmKBBMQHo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2025-12-10 13:36:04 dovecot_login authenticator failed for ([149.54.62.2]) [149.54.62.2]:59173: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Dec 10 13:36:19 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<XP3VgJRFLG1BMQHo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-12-10 13:36:21 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:50562: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-10 13:36:25 dovecot_plain authenticator failed for (hialae) [92.62.243.174]:60760: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-10 13:39:24 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:38202: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-10 13:39:46 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:39760: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 13:40:55 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 10 13:41:43 host2 sshd[2235592]: Disconnected from invalid user frontend 154.124.97.102 port 50050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:41:48 host2 sshd[2235664]: Disconnected from invalid user ftproot 156.236.75.64 port 43600 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 13:43:42 host2 sshd[2237409]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.212.105.138
country_id: 6252001
description:
[2025-12-10 13:43:59 +0530] info [cpaneld] 108.212.105.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.143.181.253
country_id: 6252001
description:
[2025-12-10 13:44:03 +0530] info [cpaneld] 76.143.181.253 - manaharasupercenter "GET /login/?login_only=1&user=manaharasupercenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.164.210.196
country_id: 6252001
description:
[2025-12-10 13:44:01 +0530] info [cpaneld] 97.164.210.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.118.198.199
country_id: 6252001
description:
[2025-12-10 13:44:04 +0530] info [whostmgrd] 24.118.198.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.29.254.24
country_id: 6252001
description:
[2025-12-10 13:44:14 +0530] info [cpaneld] 207.29.254.24 - manaharasuperce "GET /login/?login_only=1&user=manaharasuperce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuperce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.147.32.30
country_id: 6252001
description:
[2025-12-10 13:44:06 +0530] info [cpaneld] 35.147.32.30 - manaharasupercenterlk "GET /login/?login_only=1&user=manaharasupercenterlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercenterlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-10 13:44:09 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:50838: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.215.227.218
country_id: 6252001
description:
[2025-12-10 13:44:08 +0530] info [cpaneld] 74.215.227.218 - manaharasupercente "GET /login/?login_only=1&user=manaharasupercente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.55.137.33
country_id: 6252001
description:
[2025-12-10 13:44:10 +0530] info [cpaneld] 69.55.137.33 - manaharasupercent "GET /login/?login_only=1&user=manaharasupercent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.137.68
country_id: 6252001
description:
[2025-12-10 13:44:12 +0530] info [cpaneld] 172.251.137.68 - manaharasupercen "GET /login/?login_only=1&user=manaharasupercen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercen (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-10 13:44:22 dovecot_login authenticator failed for (broadband.actcorp.in) [49.204.232.244]:39732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.209.109.12
country_id: 6252001
description:
[2025-12-10 13:44:31 +0530] info [cpaneld] 69.209.109.12 - manaharasu "GET /login/?login_only=1&user=manaharasu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-12-10 13:44:44 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:52617: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.74.196.148
country_id: 6252001
description:
[2025-12-10 13:44:46 +0530] info [cpaneld] 24.74.196.148 - manaha "GET /login/?login_only=1&user=manaha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.155.45.112
country_id: 6252001
description:
[2025-12-10 13:44:52 +0530] info [cpaneld] 99.155.45.112 - mana "GET /login/?login_only=1&user=mana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.9.250.67
country_id: 6252001
description:
[2025-12-10 13:44:59 +0530] info [cpaneld] 204.9.250.67 - manahar1 "GET /login/?login_only=1&user=manahar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.87.239.16
country_id: 6252001
description:
[2025-12-10 13:44:27 +0530] info [cpaneld] 23.87.239.16 - manaharasup "GET /login/?login_only=1&user=manaharasup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasup (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.144.205.2
country_id: 6252001
description:
[2025-12-10 13:44:35 +0530] info [cpaneld] 98.144.205.2 - manaharas "GET /login/?login_only=1&user=manaharas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.233.2
country_id: 6252001
description:
[2025-12-10 13:44:58 +0530] info [cpaneld] 35.151.233.2 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.15.158.243
country_id: 6252001
description:
[2025-12-10 13:45:03 +0530] info [cpaneld] 75.15.158.243 - manahar2 "GET /login/?login_only=1&user=manahar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.230.11.224
country_id: 6252001
description:
[2025-12-10 13:44:17 +0530] info [cpaneld] 104.230.11.224 - manaharasuperc "GET /login/?login_only=1&user=manaharasuperc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuperc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.76.148
country_id: 6252001
description:
[2025-12-10 13:44:21 +0530] info [cpaneld] 76.37.76.148 - manaharasupe "GET /login/?login_only=1&user=manaharasupe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.237.113.90
country_id: 6252001
description:
[2025-12-10 13:44:41 +0530] info [cpaneld] 68.237.113.90 - manahar "GET /login/?login_only=1&user=manahar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.111.28.85
country_id: 6252001
description:
[2025-12-10 13:44:56 +0530] info [cpaneld] 76.111.28.85 - man "GET /login/?login_only=1&user=man&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user man (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.69.44.68
country_id: 6252001
description:
[2025-12-10 13:44:19 +0530] info [cpaneld] 99.69.44.68 - manaharasuper "GET /login/?login_only=1&user=manaharasuper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuper (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-10 13:44:30 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:45879: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.26.169.174
country_id: 6252001
description:
[2025-12-10 13:44:37 +0530] info [cpaneld] 108.26.169.174 - manahara "GET /login/?login_only=1&user=manahara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.42.224.245
country_id: 6252001
description:
[2025-12-10 13:44:49 +0530] info [cpaneld] 73.42.224.245 - manah "GET /login/?login_only=1&user=manah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manah (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-12-10 13:45:27 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:51080: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:45:41 host2 sshd[2239753]: Disconnected from invalid user info 156.236.75.64 port 45184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-12-10 13:45:48 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:65146: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.122.207
country_id: 6252001
description:
Dec 10 13:46:07 host2 pure-ftpd[2240318]: (?@172.202.122.207) [INFO] New connection from 172.202.122.207


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 2.59.22.234
country_id: 2782113
description:
Dec 10 13:46:35 host2 dovecot[1766329]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 4 secs): user=<>, rip=2.59.22.234, lip=66.85.158.91, session=<rsiMpZRFAOcCOxbq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 2.59.22.234
country_id: 2782113
description:
Dec 10 13:46:37 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=2.59.22.234, lip=66.85.158.91, session=<yBCzpZRFfIQCOxbq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:46:58 host2 sshd[2241078]: Disconnected from invalid user ubuntu 156.236.75.64 port 46128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 10 13:47:19 host2 sshd[2241418]: Disconnected from invalid user vhserver 154.124.97.102 port 51372 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.248.168.120
country_id: 6252001
description:
[2025-12-10 13:48:54 +0530] info [cpaneld] 172.248.168.120 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.33.133.188
country_id: 6252001
description:
[2025-12-10 13:48:58 +0530] info [whostmgrd] 64.33.133.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.206.210.27
country_id: 6252001
description:
[2025-12-10 13:49:06 +0530] info [cpaneld] 97.206.210.27 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.144.18.61
country_id: 6252001
description:
[2025-12-10 13:49:09 +0530] info [cpaneld] 47.144.18.61 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.100.26.113
country_id: 6252001
description:
[2025-12-10 13:49:02 +0530] info [cpaneld] 174.100.26.113 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.173.115.166
country_id: 6252001
description:
[2025-12-10 13:49:04 +0530] info [cpaneld] 104.173.115.166 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-10 13:49:07 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:54076: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.123.255.91
country_id: 6252001
description:
[2025-12-10 13:48:55 +0530] info [cpaneld] 99.123.255.91 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.25.184.21
country_id: 6252001
description:
[2025-12-10 13:48:59 +0530] info [cpaneld] 98.25.184.21 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-10 13:49:14 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:49954: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.76.147.108
country_id: 6252001
description:
[2025-12-10 13:49:13 +0530] info [cpaneld] 99.76.147.108 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.190.87.229
country_id: 6252001
description:
[2025-12-10 13:48:50 +0530] info [cpaneld] 71.190.87.229 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.160.79
country_id: 6252001
description:
[2025-12-10 13:49:11 +0530] info [cpaneld] 76.33.160.79 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.141.148.221
country_id: 6252001
description:
[2025-12-10 13:49:20 +0530] info [cpaneld] 140.141.148.221 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Dec 10 13:51:14 host2 dovecot[1766329]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<NvsxtpRFdoRHBobn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-10 13:50:20 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:36818: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-10 13:50:51 dovecot_login authenticator failed for (cm-178.232.153.184.get.no) [178.232.153.184]:48341: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-10 13:50:59 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:40232: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-10 13:51:05 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:42936: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 10 13:50:16 host2 sshd[2244275]: Disconnected from invalid user shree 154.124.97.102 port 37919 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:50:45 host2 sshd[2244822]: Disconnected from invalid user simon 156.236.75.64 port 53454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-10 13:51:20 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:33584: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 10 13:51:59 host2 sshd[2245718]: Disconnected from invalid user teste1 156.236.75.64 port 46904 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.136.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.120.136.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.83.59.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.83.59.116 - sobaherbalcom "GET /login/?login_only=1&user=sobaherbalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.6.6.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.6.6.130 - sobaherb "GET /login/?login_only=1&user=sobaherb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.202.144.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.202.144.75 - sobaherba "GET /login/?login_only=1&user=sobaherba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.213.236.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.213.236.57 - sobahe "GET /login/?login_only=1&user=sobahe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobahe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.137.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.207.137.100 - sobaher "GET /login/?login_only=1&user=sobaher&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.84.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 129.222.84.171 - sobah "GET /login/?login_only=1&user=sobah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.241.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.128.241.40 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.12.72.199
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.12.72.199 - sobaherbal "GET /login/?login_only=1&user=sobaherbal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.177.178.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.177.178.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.105.142.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.105.142.56 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.200.183
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.157.200.183 - sobaher1 "GET /login/?login_only=1&user=sobaher1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.128.61.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.128.61.209 - sobaher2 "GET /login/?login_only=1&user=sobaher2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 13:53:22 host2 sshd[2246571]: Disconnected from invalid user  62.60.131.157 port 33268 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.103.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.170.103.53 - soba "GET /login/?login_only=1&user=soba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.220.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.220.178 - sob "GET /login/?login_only=1&user=sob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sob (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 10 13:54:53 host2 sshd[2247982]: Disconnected from invalid user zhl 154.124.97.102 port 60100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-12-10 13:54:57 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:46809: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 13:54:24 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sones) [87.103.126.54]:17729: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-10 13:54:32 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:49905: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 13:57:25 host2 sshd[2250100]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 13:57:55 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<fnf5zZRFDMwXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.26.21.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.26.21.230 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.180.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.187.180.60 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.21.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.117.21.186 - ay "GET /login/?login_only=1&user=ay&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ay (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.139.241
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 45.50.139.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.34.133.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.34.133.181 - ayuzonelank "GET /login/?login_only=1&user=ayuzonelank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.146.249.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.146.249.127 - ayuzonela "GET /login/?login_only=1&user=ayuzonela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.180.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.187.180.60 - ayuzo "GET /login/?login_only=1&user=ayuzo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.31.52
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.241.31.52 - ayuz "GET /login/?login_only=1&user=ayuz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.119.87.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.119.87.105 - ayuzonelankacom "GET /login/?login_only=1&user=ayuzonelankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.142.227.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.142.227.230 - ayuzonelan "GET /login/?login_only=1&user=ayuzonelan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.201.31.115
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.201.31.115 - ayu "GET /login/?login_only=1&user=ayu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.80.160.137
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.80.160.137 - ayuzone1 "GET /login/?login_only=1&user=ayuzone1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.85.193.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.85.193.218 - ayuzone "GET /login/?login_only=1&user=ayuzone&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.159.59
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.4.159.59 - ayuzonelanka "GET /login/?login_only=1&user=ayuzonelanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.44.137.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.44.137.217 - ayuzonel "GET /login/?login_only=1&user=ayuzonel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.52.169.78
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.52.169.78 - ayuzon "GET /login/?login_only=1&user=ayuzon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.94.239.27
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.94.239.27 - ayuzone2 "GET /login/?login_only=1&user=ayuzone2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-10 13:59:49 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:33535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-10 13:59:52 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (bernslity) [81.225.30.107]:53797: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-10 14:00:03 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:49309: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.55
country_id: 6252001
description:
2025-12-10 14:01:14 dovecot_login authenticator failed for ([72.214.133.55]) [72.214.133.55]:46751: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.168.92
country_id: 6252001
description:
2025-12-10 14:01:26 dovecot_login authenticator failed for 64-251-168-92.ip4.gwtc.net [64.251.168.92]:44970: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-10 14:02:50 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:47956: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-10 14:02:59 dovecot_login authenticator failed for ([84.211.24.143]) [84.211.24.143]:56257: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-10 14:03:02 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:44558: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-10 14:03:05 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:59769: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-12-10 14:03:15 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:53880: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.28
country_id: 6252001
description:
2025-12-10 14:02:45 dovecot_login authenticator failed for ([98.181.46.28]) [98.181.46.28]:58311: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.58.147.227
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.58.147.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.175.61.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.175.61.50 - melanifinefood "GET /login/?login_only=1&user=melanifinefood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.14.48.125
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.14.48.125 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.192.140.247
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.192.140.247 - melanifinefoo "GET /login/?login_only=1&user=melanifinefoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinefoo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.190.44.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.190.44.4 - melanifinef "GET /login/?login_only=1&user=melanifinef&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinef (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.47.202.63
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 199.47.202.63 - melanifine "GET /login/?login_only=1&user=melanifine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.126.146.227
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.126.146.227 - melanifin "GET /login/?login_only=1&user=melanifin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.73.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.141.73.18 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.20.73.148
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.20.73.148 - melanif "GET /login/?login_only=1&user=melanif&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.205.213.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.205.213.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.98.234.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.98.234.40 - melanifi "GET /login/?login_only=1&user=melanifi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.101.212.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.101.212.212 - melan "GET /login/?login_only=1&user=melan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.137.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.160.137.225 - mel "GET /login/?login_only=1&user=mel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.69.169.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.69.169.181 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.97.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.157.97.80 - melanifinefoodcom "GET /login/?login_only=1&user=melanifinefoodcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinefoodcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.14.144.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.14.144.48 - melanif2 "GET /login/?login_only=1&user=melanif2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.160.110
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.141.160.110 - melani "GET /login/?login_only=1&user=melani&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melani (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.44.139.187
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.44.139.187 - mela "GET /login/?login_only=1&user=mela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.209.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.209.155 - melanif1 "GET /login/?login_only=1&user=melanif1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif1 (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 212.104.231.194
country_id: 1227603
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.104.231.194 - fhbhealt "GET /cpsess9557747597/frontend/jupiter/raw/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [112.135.215.146] != Current IP Address [212.104.231.194]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.235.129.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.235.129.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.70.96.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.70.96.177 - melanifinefo "GET /login/?login_only=1&user=melanifinefo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinefo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.160.120.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.160.120.154 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.104.53.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.104.53.100 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.62.154.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.62.154.123 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.117.139.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.117.139.195 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-10 14:05:10 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:36728: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.110.170.88
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 70.110.170.88 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.213.18.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.213.18.36 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.60.57.211
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 139.60.57.211 - kamecholk "GET /login/?login_only=1&user=kamecholk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecholk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.255.201.69
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.255.201.69 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-10 14:04:54 dovecot_login authenticator failed for ([125.19.174.244]) [128.185.201.138]:44190: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.253.95.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.253.95.100 - drag "GET /login/?login_only=1&user=drag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.156.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.117.156.202 - drago "GET /login/?login_only=1&user=drago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.16.223
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.16.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.165.254
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.165.254 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.41.241.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.41.241.210 - dragon "GET /login/?login_only=1&user=dragon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.129.21.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 65.129.21.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.8.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.8.37 - dragonlk "GET /login/?login_only=1&user=dragonlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dragonlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.56.210.242
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.56.210.242 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-12-10 14:06:14 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:58976: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.49.155.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.49.155.177 - dra "GET /login/?login_only=1&user=dra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dra (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.222.252.199
country_id: 2750405
description:
Dec 10 14:07:05 host2 sshd[2258545]: Disconnected from invalid user sina 168.222.252.199 port 34922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.90
country_id: 1269750
description:
2025-12-10 14:06:38 dovecot_login authenticator failed for ([182.95.228.90]) [182.95.228.90]:60132: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 14:08:15 host2 sshd[2259250]: Disconnected from invalid user user 2.57.121.25 port 36628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 10 14:08:54 host2 sshd[2259760]: Disconnected from invalid user luis 189.112.0.11 port 34006 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-10 14:09:59 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:55199: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 10 14:10:05 host2 sshd[2260713]: Disconnected from invalid user sammy 189.112.0.11 port 51172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.66.12
country_id: 6252001
description:
2025-12-10 14:10:09 dovecot_login authenticator failed for ([98.181.66.12]) [98.181.66.12]:37459: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 6252001
description:
Dec 10 14:09:54 host2 sshd[2260455]: Disconnected from invalid user splunk 144.31.126.21 port 39852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.222.252.199
country_id: 2750405
description:
Dec 10 14:10:55 host2 sshd[2261237]: Disconnected from invalid user user123 168.222.252.199 port 40822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 6252001
description:
Dec 10 14:11:03 host2 sshd[2261363]: Disconnected from invalid user user123 144.31.126.21 port 39126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-12-10 14:10:39 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:47844: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Dec 10 14:10:44 host2 sshd[2261145]: Disconnected from invalid user ubuntu 34.22.66.183 port 40918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 14:11:14 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Qc6b/ZRFmN4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-10 14:10:20 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:53974: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-10 14:11:19 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:56873: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.126.21
country_id: 6252001
description:
Dec 10 14:11:41 host2 sshd[2261706]: Disconnected from invalid user node 144.31.126.21 port 59310 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-12-10 14:12:14 dovecot_login authenticator failed for ([49.124.151.56]) [49.124.151.56]:43850: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 10 14:11:21 host2 sshd[2261537]: Disconnected from invalid user guest 209.141.33.240 port 56836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Dec 10 14:11:30 host2 sshd[2261605]: Disconnected from invalid user ubuntu 106.51.1.63 port 52468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 10 14:11:31 host2 sshd[2261616]: Disconnected from invalid user yy 189.112.0.11 port 47278 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.14.137.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.14.137.145 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.11.146
country_id: 3996063
description:
Dec 10 14:16:29 host2 sshd[2266095]: Disconnected from invalid user yunpeng 47.87.11.146 port 54152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Dec 10 14:16:14 host2 sshd[2265799]: Disconnected from invalid user yy 62.3.56.187 port 35848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.56
country_id: 1643084
description:
Dec 10 14:16:24 host2 sshd[2265930]: Disconnected from invalid user mcserver 103.67.78.56 port 41678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 10 14:17:08 host2 sshd[2266575]: Disconnected from invalid user luis 185.121.0.2 port 50318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.222.252.199
country_id: 2750405
description:
Dec 10 14:17:19 host2 sshd[2266764]: Disconnected from invalid user test 168.222.252.199 port 49038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.11.146
country_id: 3996063
description:
Dec 10 14:17:43 host2 sshd[2267032]: Disconnected from invalid user tecnopos 47.87.11.146 port 48776 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.222.252.199
country_id: 2750405
description:
Dec 10 14:17:53 host2 sshd[2267111]: Disconnected from invalid user node 168.222.252.199 port 58230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-10 14:17:07 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:51290: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 10 14:17:56 host2 sshd[2267123]: Disconnected from invalid user luis 152.32.190.168 port 37654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.56
country_id: 1643084
description:
Dec 10 14:18:08 host2 sshd[2267265]: Disconnected from invalid user canvas 103.67.78.56 port 51242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.111.234.222
country_id: 130758
description:
Dec 10 14:18:20 host2 sshd[2267348]: Disconnected from invalid user test 193.111.234.222 port 41582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 10 14:19:13 host2 sshd[2268046]: Disconnected from invalid user teamspeak 185.121.0.2 port 56196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 10 14:20:48 host2 sshd[2269556]: Disconnected from invalid user blog 152.32.190.168 port 43822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 10 14:20:05 host2 sshd[2268927]: Disconnected from invalid user sammy 152.32.190.168 port 47828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 14:21:20 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (inadaeous) [51.195.117.220]:34050: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.132.164.17
country_id: 2635167
description:
Dec 10 14:25:39 host2 sshd[2273439]: Disconnected from invalid user surubu 23.132.164.17 port 49116 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 10 14:25:28 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<9v2mMJVFXJosyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.51.221.132
country_id: 3175395
description:
2025-12-10 14:26:52 dovecot_login authenticator failed for 93-51-221-132.ip268.fastwebnet.it [93.51.221.132]:54269: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.14.178.19
country_id: 6252001
description:
Dec 10 14:26:22 host2 sshd[2274320]: Disconnected from invalid user administrator 72.14.178.19 port 53218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-10 14:26:40 dovecot_login authenticator failed for (nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:42794: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Dec 10 14:27:04 host2 sshd[2275147]: Disconnected from invalid user rustserver 69.49.246.176 port 49172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 10 14:27:24 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<XSqMN5VFdIo26lCA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Dec 10 14:28:54 host2 sshd[2276826]: Disconnected from invalid user sdbadmin 69.49.246.176 port 53710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Dec 10 14:29:31 host2 sshd[2277458]: Disconnected from invalid user david 69.49.246.176 port 36404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-10 14:31:02 dovecot_login authenticator failed for ([182.73.193.249]) [122.187.41.18]:54464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 14:32:04 host2 sshd[2280135]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Dec 10 14:32:14 host2 sshd[2280275]: Disconnected from invalid user luis 103.248.43.99 port 53422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.14.178.19
country_id: 6252001
description:
Dec 10 14:32:26 host2 sshd[2280494]: Disconnected from invalid user david 72.14.178.19 port 42392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.14.178.19
country_id: 6252001
description:
Dec 10 14:33:32 host2 sshd[2281650]: Disconnected from invalid user william 72.14.178.19 port 34988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 10 14:33:06 host2 sshd[2281316]: Disconnected from invalid user odoo 103.174.114.50 port 47046 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.96
country_id: 6252001
description:
Dec 10 14:33:22 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=44.220.185.96, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+vTfTJVFhpUs3Llg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Dec 10 14:34:12 host2 sshd[2282208]: Disconnected from invalid user tt 103.248.43.99 port 39446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-10 14:35:53 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:44174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.67.39
country_id: 3996063
description:
2025-12-10 14:35:53 dovecot_login authenticator failed for ([201.160.67.39]) [201.160.67.39]:51344: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 10 14:35:07 host2 sshd[2283101]: Disconnected from invalid user toor 198.46.207.98 port 45480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-12-10 14:35:39 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:35782: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Dec 10 14:35:45 host2 sshd[2283555]: Disconnected from invalid user administrador 103.174.115.5 port 36922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-12-10 14:36:26 dovecot_login authenticator failed for ([49.124.152.172]) [49.124.152.172]:57126: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.222.23.164
country_id: 3017382
description:
Dec 10 14:36:32 host2 sshd[2284089]: Disconnected from invalid user app 92.222.23.164 port 46350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 10 14:36:32 host2 sshd[2284087]: Disconnected from invalid user test 58.98.199.45 port 46557 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 10 14:36:45 host2 sshd[2284223]: Disconnected from invalid user thiago 103.174.114.50 port 52170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-10 14:36:48 dovecot_login authenticator failed for (177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:60066: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Dec 10 14:36:50 host2 sshd[2284290]: Disconnected from invalid user oficina 103.174.115.5 port 40588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 10 14:37:37 host2 sshd[2284777]: Disconnected from invalid user colin 103.174.114.50 port 59384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.222.23.164
country_id: 3017382
description:
Dec 10 14:37:42 host2 sshd[2284869]: Disconnected from invalid user omm 92.222.23.164 port 47782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 14:37:06 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:61591: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 10 14:37:29 host2 sshd[2284700]: Disconnected from invalid user wow 198.46.207.98 port 56776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 10 14:38:26 host2 sshd[2285634]: Disconnected from invalid user zyx 202.157.177.33 port 37066 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.207.98
country_id: 6252001
description:
Dec 10 14:39:40 host2 sshd[2286532]: Disconnected from invalid user intern 198.46.207.98 port 59072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.62
country_id: 1643084
description:
Dec 10 14:39:04 host2 sshd[2286195]: Disconnected from invalid user ftpuser 103.59.94.62 port 39366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Dec 10 14:39:24 host2 sshd[2286378]: Disconnected from invalid user vpn 103.174.115.5 port 52222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 10 14:39:30 host2 sshd[2286422]: Disconnected from invalid user developer 58.98.199.45 port 41110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.62
country_id: 1643084
description:
Dec 10 14:41:05 host2 sshd[2287851]: Disconnected from invalid user testadmin 103.59.94.62 port 59036 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 92.222.23.164
country_id: 3017382
description:
Dec 10 14:41:28 host2 sshd[2288219]: Received disconnect from 92.222.23.164 port 52628:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.222.23.164
country_id: 3017382
description:
Dec 10 14:41:28 host2 sshd[2288219]: Disconnected from invalid user testuser 92.222.23.164 port 52628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-10 14:41:39 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:34054: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.90
country_id: 1733045
description:
2025-12-10 14:41:56 dovecot_login authenticator failed for ([49.125.201.90]) [49.125.201.90]:56284: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 10 14:42:17 host2 sshd[2289057]: Disconnected from invalid user vps 58.98.199.45 port 37314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Dec 10 14:42:32 host2 sshd[2289227]: Disconnected from invalid user ubuntu 103.174.115.5 port 57642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-12-10 14:42:56 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:42134: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-10 14:42:16 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:59997: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Dec 10 14:44:08 host2 sshd[2291059]: Disconnected from invalid user yy 103.248.43.99 port 41678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 14:45:00 host2 sshd[2291942]: Disconnected from invalid user admin1 62.60.131.157 port 22985 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Dec 10 14:46:11 host2 sshd[2293314]: Disconnected from invalid user ubuntu 103.248.43.99 port 47748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-10 14:48:00 dovecot_plain authenticator failed for (calar) [24.187.213.29]:47348: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.207
country_id: 953987
description:
Dec 10 14:50:49 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.64.42.207, lip=66.85.158.91, TLS, session=<EloHipVFKrBmQCrP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.10
country_id: 690791
description:
Dec 10 14:51:07 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=176.103.5.10, lip=66.85.158.91, TLS, session=<emNXi5VF/YawZwUK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2025-12-10 14:51:52 dovecot_login authenticator failed for ([197.219.208.38]) [197.219.208.38]:41128: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-12-10 14:52:05 dovecot_login authenticator failed for (171.140.212.218.starhub.net.sg) [218.212.140.171]:30141: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 14:53:43 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (babsublie) [87.103.126.54]:63227: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 14:54:20 host2 sshd[2300715]: Disconnected from invalid user zjw 189.194.140.170 port 60502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-10 14:55:51 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:54462: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-12-10 14:56:10 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:60423: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.131.163.217
country_id: 6252001
description:
Dec 10 14:57:03 host2 pure-ftpd[2303738]: (?@130.131.163.217) [INFO] New connection from 130.131.163.217


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 14:57:31 host2 sshd[2304132]: Disconnected from invalid user wilson 189.194.140.170 port 54276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 14:58:09 host2 sshd[2304825]: Disconnected from invalid user deploy 189.194.140.170 port 38598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 15:00:01 host2 sshd[2306573]: Disconnected from invalid user ftpupload 189.194.140.170 port 48032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-10 15:00:48 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:56086: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-10 15:01:04 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:38171: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-10 15:01:14 dovecot_login authenticator failed for 61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:40230: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-10 15:01:25 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:59782: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 10 15:01:27 host2 sshd[2308497]: Disconnected from invalid user admin 189.194.140.170 port 44918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-10 15:02:59 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:38341: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.74.255.237
country_id: 3625428
description:
2025-12-10 15:05:32 dovecot_plain authenticator failed for ([89.116.164.85]) [38.74.255.237]:9824: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.192.250.124
country_id: 1527747
description:
2025-12-10 15:05:46 dovecot_plain authenticator failed for ([89.116.164.85]) [31.192.250.124]:46442: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.111
country_id: 3865483
description:
Dec 10 15:06:38 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.250.111, lip=66.85.158.91, TLS, session=<op+0wpVFGZWzAPpv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.223.203.78
country_id: 3469034
description:
2025-12-10 15:06:00 dovecot_plain authenticator failed for ([89.116.164.85]) [179.223.203.78]:26986: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.44
country_id: 1269750
description:
Dec 10 15:07:01 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=103.207.4.44, lip=66.85.158.91, TLS, session=<uzILxJVFzddnzwQs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-10 15:07:06 dovecot_login authenticator failed for (187.161.136.37-clientes-izzi.mx) [187.161.136.37]:38270: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-10 15:07:29 dovecot_login authenticator failed for ([182.95.123.46]) [182.95.123.46]:35352: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-10 15:07:52 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:33965: 535 Incorrect authentication data (set_id=test@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-10 15:08:13 dovecot_login authenticator failed for (201.173.56.28-clientes-izzi.mx) [201.173.56.28]:47317: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 10 15:10:55 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<jzsu05VFmM0DWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 15:11:07 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (podat) [51.195.117.220]:41883: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-10 15:17:40 dovecot_plain authenticator failed for (tervy) [24.104.225.201]:43743: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-10 15:17:42 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:38512: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-10 15:17:57 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:47761: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-10 15:21:36 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:49848: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 15:22:53 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (koine) [51.195.117.220]:46429: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-12-10 15:22:07 dovecot_login authenticator failed for ([125.23.202.194]) [125.23.202.194]:33110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-10 15:26:56 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:54270: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-10 15:26:55 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:37449: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-10 15:27:12 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:39466: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-10 15:27:33 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:53234: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-10 15:28:30 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:39296: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-10 15:28:48 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:41012: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-12-10 15:32:11 dovecot_login authenticator failed for ([122.187.234.56]) [122.187.234.56]:54205: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
country_id: 6252001
description:
2025-12-10 15:32:25 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:58533: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-10 15:32:55 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:37958: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-10 15:33:13 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:38545: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-12-10 15:33:48 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:35470: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.70
country_id: 2750405
description:
Dec 10 15:34:24 host2 sshd[2341668]: Disconnected from invalid user sol 41.216.181.70 port 42638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-10 15:34:01 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:42400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.70
country_id: 2750405
description:
Dec 10 15:35:51 host2 sshd[2343232]: Disconnected from invalid user alireza 41.216.181.70 port 36626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.42.3
country_id: 3895114
description:
2025-12-10 15:35:17 dovecot_plain authenticator failed for ([89.116.164.85]) [190.114.42.3]:55382: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.234.167.188
country_id: 3573591
description:
2025-12-10 15:35:29 dovecot_plain authenticator failed for ([89.116.164.85]) [45.234.167.188]:54862: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.227
country_id: 6252001
description:
Dec 10 15:36:51 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.227, lip=66.85.158.92, session=<VFvvL5ZFgc7DuEzj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 10 15:36:24 host2 sshd[2343799]: Disconnected from invalid user guest 154.91.81.224 port 47550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:36:29 host2 sshd[2343872]: Disconnected from invalid user user 41.128.181.199 port 43446 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.5
country_id: 6252001
description:
Dec 10 15:36:33 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.5, lip=66.85.158.92, session=<PBTeLpZFncPDuEwF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.7
country_id: 6252001
description:
Dec 10 15:36:45 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.7, lip=66.85.158.92, session=<wqOML5ZFC77DuEwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.0
country_id: 6252001
description:
Dec 10 15:36:55 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.0, lip=66.85.158.92, session=<l0YfMJZFDY3DuEwA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.181.70
country_id: 2750405
description:
Dec 10 15:36:55 host2 sshd[2344426]: Disconnected from invalid user ubuntu 41.216.181.70 port 33592 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 15:37:43 host2 sshd[2345366]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 10 15:37:26 host2 sshd[2345006]: Disconnected from invalid user milad 70.54.182.130 port 43213 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.70
country_id: 2750405
description:
Dec 10 15:37:25 host2 sshd[2344995]: Disconnected from invalid user telegram 41.216.181.70 port 46186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-10 15:38:36 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:55416: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:38:40 host2 sshd[2346521]: Disconnected from invalid user milad 41.128.181.199 port 55692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-10 15:38:46 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:53460: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Dec 10 15:38:51 host2 sshd[2346750]: Disconnected from invalid user mqm 154.221.22.203 port 44584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.175.56
country_id: 3017382
description:
Dec 10 15:38:10 host2 sshd[2345997]: Disconnected from invalid user user 51.68.175.56 port 39182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 10 15:38:17 host2 sshd[2346151]: Disconnected from invalid user haproxy 154.91.81.224 port 58120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-10 15:39:03 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:50294: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 10 15:39:08 host2 sshd[2347104]: Disconnected from invalid user imran 196.92.7.249 port 34880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 10 15:39:31 host2 sshd[2347524]: Disconnected from invalid user db2inst1 154.91.81.224 port 55690 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.175.56
country_id: 3017382
description:
Dec 10 15:39:46 host2 sshd[2347948]: Disconnected from invalid user alireza 51.68.175.56 port 47422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:39:56 host2 sshd[2348173]: Disconnected from invalid user installer 41.128.181.199 port 41056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 10 15:40:09 host2 sshd[2348573]: Disconnected from invalid user uat 154.91.81.224 port 40680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 10 15:41:53 host2 sshd[2350261]: Disconnected from invalid user acs 196.92.7.246 port 58038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:42:30 host2 sshd[2351007]: Disconnected from invalid user test4 41.128.181.199 port 43880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 15:42:34 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kgY+RJZFcM4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-10 15:42:50 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:36334: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-10 15:43:01 dovecot_login authenticator failed for (cm-84.211.6.119.get.no) [84.211.6.119]:60427: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.128.181.199
country_id: 357994
description:
Dec 10 15:43:07 host2 sshd[2351896]: Disconnected from invalid user alireza 41.128.181.199 port 38630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 10 15:43:17 host2 sshd[2352145]: Disconnected from invalid user andy 196.92.7.249 port 42166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-12-10 15:46:50 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:46878: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-10 15:47:11 dovecot_login authenticator failed for (broadband.actcorp.in) [49.204.232.244]:37968: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Dec 10 15:47:46 host2 sshd[2357100]: Disconnected from invalid user ansadmin 154.144.225.226 port 33462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Dec 10 15:48:57 host2 sshd[2358198]: Disconnected from invalid user trade 154.221.22.203 port 54130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 10 15:49:45 host2 sshd[2359130]: Disconnected from invalid user ubuntu 196.92.7.246 port 36020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 15:49:22 host2 sshd[2358747]: Disconnected from invalid user admin 2.57.121.112 port 58756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.22.203
country_id: 1819730
description:
Dec 10 15:49:39 host2 sshd[2359008]: Disconnected from invalid user dev 154.221.22.203 port 38454 [preauth]


