# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2025-12-10 01:49:38 dovecot_login authenticator failed for ([182.95.178.174]) [182.95.178.174]:44704: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.251
country_id: 1643084
description:
Dec 10 01:50:14 host2 sshd[1524754]: Disconnected from invalid user hjh 103.67.78.251 port 47770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-10 01:50:50 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:36270: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-12-10 01:51:22 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:45140: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 01:51:30 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<uYEbqIpFgOCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-10 01:51:50 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:37142: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.48
country_id: 6252001
description:
2025-12-10 01:52:04 dovecot_login authenticator failed for ([98.181.46.48]) [98.181.46.48]:45096: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 01:52:30 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<4Zerq4pFcswXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 145.239.85.111
country_id: 798544
description:
Dec 10 01:52:57 host2 sshd[1526656]: Disconnected from invalid user test 145.239.85.111 port 58138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 145.239.85.111
country_id: 798544
description:
Dec 10 01:54:03 host2 sshd[1527676]: Disconnected from invalid user ppp 145.239.85.111 port 41992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 01:54:25 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<+M6IsopFHuCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-10 01:54:53 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:46624: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-12-10 01:55:12 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:60688: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-10 01:56:15 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (mensen) [174.161.27.82]:44001: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-10 01:57:53 dovecot_plain authenticator failed for (nologyn) [91.73.188.251]:41789: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.251
country_id: 1643084
description:
Dec 10 01:58:26 host2 sshd[1531042]: Disconnected from invalid user max 103.67.78.251 port 60182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 10 01:59:02 host2 sshd[1531354]: Disconnected from invalid user jessica 45.120.216.232 port 35092 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 01:59:10 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<iq6Gw4pFkqGPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-10 02:00:06 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:38268: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-12-10 02:00:05 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:49464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-10 02:00:07 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:58818: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-10 02:00:47 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:35566: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 10 02:00:50 host2 sshd[1533349]: Disconnected from invalid user mahmoud 45.120.216.232 port 59662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-10 02:01:41 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12123: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 10 02:00:55 host2 sshd[1533398]: Disconnected from invalid user super 179.40.112.10 port 44314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-10 02:01:29 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:60968: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 10 02:02:16 host2 sshd[1534415]: Disconnected from invalid user qwe 45.120.216.232 port 56998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 10 02:02:25 host2 sshd[1534508]: Disconnected from invalid user bence 115.133.68.171 port 33295 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-10 02:03:40 dovecot_plain authenticator failed for (palic) [5.31.15.108]:39302: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.140.18
country_id: 690791
description:
Dec 10 02:03:51 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=37.221.140.18, lip=66.85.158.91, TLS, session=<ggVi04pFweQl3YwS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 10 02:03:03 host2 sshd[1535050]: Disconnected from invalid user web 115.133.68.171 port 39801 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.234.178.105
country_id: 3469034
description:
Dec 10 02:03:32 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.234.178.105, lip=66.85.158.91, TLS, session=<ePA50opFmJWx6rJp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 10 02:03:37 host2 sshd[1536316]: Disconnected from invalid user aovalle 45.120.216.232 port 54328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.30.169
country_id: 2233387
description:
Dec 10 02:04:19 host2 sshd[1536868]: Disconnected from invalid user ricardo 41.223.30.169 port 51342 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 10 02:04:22 host2 sshd[1536906]: Disconnected from invalid user jessica 115.133.68.171 port 52814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 02:04:37 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<q/wK14pF6NO8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-10 02:04:49 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (overnate) [68.60.77.128]:49688: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.123
country_id: 1605651
description:
Dec 10 02:04:52 host2 sshd[1537342]: Disconnected from invalid user vscode 209.15.119.123 port 51778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.205.46.101
country_id: 2328926
description:
Dec 10 02:04:07 host2 sshd[1536718]: Disconnected from invalid user es 102.205.46.101 port 58354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.123
country_id: 1605651
description:
Dec 10 02:05:35 host2 sshd[1538343]: Disconnected from invalid user aovalle 209.15.119.123 port 58164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-10 02:05:47 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:51239: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 10 02:05:04 host2 sshd[1537643]: Disconnected from invalid user mahmoud 115.133.68.171 port 59322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.205.46.101
country_id: 2328926
description:
Dec 10 02:05:59 host2 sshd[1538724]: Disconnected from invalid user ospite 102.205.46.101 port 37194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.44
country_id: 6252001
description:
2025-12-10 02:06:00 dovecot_login authenticator failed for ([70.174.168.44]) [70.174.168.44]:60782: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.119.123
country_id: 1605651
description:
Dec 10 02:06:20 host2 sshd[1539065]: Disconnected from invalid user sai 209.15.119.123 port 43664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2025-12-10 02:06:44 dovecot_login authenticator failed for (nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:48622: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-10 02:07:28 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:40351: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 02:07:41 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (boism) [96.230.65.90]:51338: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.66.15.181
country_id: 6252001
description:
[2025-12-10 02:08:42 +0530] info [whostmgrd] 68.66.15.181 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.205.46.101
country_id: 2328926
description:
Dec 10 02:08:18 host2 sshd[1540341]: Disconnected from invalid user ubuntu 102.205.46.101 port 45262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 02:09:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (belmonic) [87.103.126.54]:18100: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.205.46.101
country_id: 2328926
description:
Dec 10 02:09:23 host2 sshd[1541037]: Disconnected from invalid user test 102.205.46.101 port 56644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.104
country_id: 6252001
description:
Dec 10 02:09:56 host2 dovecot[802051]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.104, lip=66.85.158.91, session=<lb4m6opFyM0tT7Vo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.199.71.101
country_id: 6252001
description:
[2025-12-10 02:11:01 +0530] info [cpaneld] 71.199.71.101 - hos "GET /login/?login_only=1&user=hos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.61.83.244
country_id: 6252001
description:
[2025-12-10 02:11:01 +0530] info [cpaneld] 136.61.83.244 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.253.210.4
country_id: 6252001
description:
[2025-12-10 02:10:55 +0530] info [cpaneld] 67.253.210.4 - host2 "GET /login/?login_only=1&user=host2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.51.10.223
country_id: 6252001
description:
[2025-12-10 02:10:55 +0530] info [cpaneld] 74.51.10.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.57.132
country_id: 6252001
description:
[2025-12-10 02:10:58 +0530] info [whostmgrd] 35.149.57.132 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 10 02:11:05 host2 sshd[1542684]: Disconnected from invalid user smbuser 158.69.213.129 port 40656 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.186.235.16
country_id: 6252001
description:
[2025-12-10 02:10:54 +0530] info [cpaneld] 66.186.235.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.22.199.102
country_id: 6252001
description:
[2025-12-10 02:10:59 +0530] info [cpaneld] 73.22.199.102 - host2phenomhostcom "GET /login/?login_only=1&user=host2phenomhostcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host2phenomhostcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.136.49.208
country_id: 6252001
description:
[2025-12-10 02:11:00 +0530] info [cpaneld] 76.136.49.208 - host "GET /login/?login_only=1&user=host&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 10 02:12:46 host2 sshd[1543709]: Disconnected from invalid user pascal 158.69.213.129 port 37944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.118
country_id: 3865483
description:
Dec 10 02:16:24 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.1.224.118, lip=66.85.158.91, TLS, session=<28kPAItFYq+6AeB2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.237
country_id: 3175395
description:
Dec 10 02:16:42 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.77.50.237, lip=66.85.158.91, TLS, session=<CFdZAYtFQMC5TTLt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 02:16:01 host2 sshd[1546310]: Disconnected from invalid user user 2.57.121.25 port 21709 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-10 02:16:08 dovecot_login authenticator failed for (nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:34152: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-10 02:17:08 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52370: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 02:17:31 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<y4UtBYtFeMCqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.75.185.190
country_id: 6252001
description:
2025-12-10 02:19:35 dovecot_login authenticator failed for (149-75-185-190.s445.c3-0.elg-e6k1.nape.il.cable.rcncustomer.com) [149.75.185.190]:51198: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-10 02:20:12 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:57728: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-10 02:24:37 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:36998: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-10 02:24:45 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:58387: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-10 02:23:57 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:34743: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2025-12-10 02:24:25 dovecot_login authenticator failed for (nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:56760: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-10 02:24:33 dovecot_plain authenticator failed for (hally) [64.72.74.162]:47125: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-10 02:24:44 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:44186: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.219
country_id: 2635167
description:
Dec 10 02:24:15 host2 dovecot[802051]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.219, lip=66.85.158.91, TLS, session=<aqxbHYtF+b2594nb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-10 02:24:22 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:33946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-10 02:25:04 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:38133: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.173.39
country_id: 1512440
description:
2025-12-10 02:24:57 dovecot_login authenticator failed for ([45.92.173.39]) [45.92.173.39]:33736: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-10 02:26:03 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:63458: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-10 02:26:18 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:20214: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-10 02:28:28 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:46453: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-10 02:28:35 dovecot_login authenticator failed for ([178.239.238.23]) [178.239.238.23]:51114: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-10 02:28:43 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 02:30:03 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<n03yMYtFOOiqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-12-10 02:30:18 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:53517: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.72
country_id: 3996063
description:
2025-12-10 02:30:31 dovecot_login authenticator failed for ([177.236.144.72]) [177.236.144.72]:60534: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.100.141.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.100.141.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.167
country_id: 3175395
description:
Dec 10 02:31:43 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=185.15.171.167, lip=66.85.158.91, TLS, session=<YO8FN4tFMIG5D6un>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.176
country_id: 3469034
description:
Dec 10 02:31:22 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=177.130.170.176, lip=66.85.158.91, TLS, session=<sTLCNYtFGbqxgqqw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.55.164.246
country_id: 3469034
description:
2025-12-10 02:31:35 dovecot_login authenticator failed for ([177.55.164.246]) [177.55.164.246]:60786: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-10 02:32:07 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:35036: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-10 02:32:48 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40200: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 02:35:04 host2 sshd[1559460]: Disconnected from invalid user admin 2.57.121.112 port 22755 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.54.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 216.49.54.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.57.35.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.57.35.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.7.83.22
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 216.7.83.22 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.134.18.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.134.18.18 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.180.59.199
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.180.59.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.38.254.109
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.38.254.109 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.162.23.95
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.162.23.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-10 02:40:49 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:59386: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-12-10 02:41:31 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:46139: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.211.107
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.151.211.107 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.220.218.81
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 168.220.218.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 138.197.125.55
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[138.197.125.55] [Remote Port]=[49942] [Authentication Database]=[mail] [Username]=[admin@melanifinefood.com] (12/10 failures) (blocked until [Wed Dec 10 21:14:49 2025 UTC/Thu Dec 11 02:44:49 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 02:44:51 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<xvDlZotFFsOKxX03>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.161.59
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 104.32.161.59 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-10 02:45:51 dovecot_login authenticator failed for ([177.236.146.191]) [177.236.146.191]:39752: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.240.54.229
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 209.240.54.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.59.192
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.37.59.192 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.59.221.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.59.221.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.134.96.70
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.134.96.70 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 02:47:47 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<EHZmcYtF0MOKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-10 02:48:41 dovecot_plain authenticator failed for (wedismsh) [5.11.143.72]:40442: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.188.9.248
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 173.188.9.248 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.225.246.102
country_id: 3469034
description:
Dec 10 02:49:02 host2 sshd[1569625]: Disconnected from invalid user ubuntu 200.225.246.102 port 53000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-10 02:49:32 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:33308: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-10 02:49:32 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:48764: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 10 02:49:44 host2 sshd[1570037]: Disconnected from invalid user pepe 195.178.191.5 port 45264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.251.103.9
country_id: 2510769
description:
2025-12-10 02:49:52 dovecot_login authenticator failed for 85.251.103.9.dyn.user.ono.com [85.251.103.9]:49807: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 10 02:50:21 host2 sshd[1570608]: Disconnected from invalid user ventas05 195.178.191.5 port 33328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-10 02:49:55 dovecot_login authenticator failed for ([122.185.184.134]) [182.95.226.82]:39686: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-10 02:50:10 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:50900: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.211.219.73
country_id: 3175395
description:
2025-12-10 02:50:33 dovecot_login authenticator failed for host-62-211-219-73.retail.telecomitalia.it ([185.196.221.176]) [62.211.219.73]:59890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.173
country_id: 6251999
description:
2025-12-10 02:50:19 dovecot_login authenticator failed for ([207.134.139.173]) [207.134.139.173]:17793: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.91.162
country_id: 2921044
description:
Dec 10 02:50:02 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.226.91.162, lip=66.85.158.92, TLS, session=<wSiLeYtFfHJA4lui>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.129.192.27
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 66.129.192.27 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.159
country_id: 6252001
description:
2025-12-10 02:50:48 dovecot_login authenticator failed for ([98.185.120.159]) [98.185.120.159]:60204: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-10 02:50:11 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:40433: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.225.246.102
country_id: 3469034
description:
Dec 10 02:50:24 host2 sshd[1570630]: Disconnected from invalid user ubuntu 200.225.246.102 port 50994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 10 02:51:03 host2 sshd[1571154]: Disconnected from invalid user ubuntu 103.164.81.65 port 32418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.210.70.23
country_id: 3469034
description:
Dec 10 02:51:25 host2 sshd[1571367]: Disconnected from invalid user ftp-test 191.210.70.23 port 58098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.156
country_id: 6252001
description:
2025-12-10 02:51:41 dovecot_login authenticator failed for ([98.185.120.156]) [98.185.120.156]:60440: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.225.246.102
country_id: 3469034
description:
Dec 10 02:51:45 host2 sshd[1571598]: Disconnected from invalid user vasya 200.225.246.102 port 49012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-10 02:52:23 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2025-12-10 02:52:38 dovecot_login authenticator failed for (host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:47293: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 10 02:52:22 host2 sshd[1571933]: Disconnected from invalid user vhpadmin 103.164.81.65 port 58156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-10 02:53:46 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:62207: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.130.237.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.130.237.77 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-10 02:53:14 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:46383: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 10 02:54:49 host2 sshd[1574000]: Disconnected from invalid user dev 118.194.250.47 port 44032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-10 02:54:11 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:50214: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 10 02:54:16 host2 sshd[1573435]: Disconnected from invalid user wafer 103.164.81.65 port 41752 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-10 02:55:40 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (tholly) [73.176.157.57]:45220: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 10 02:55:59 host2 sshd[1575377]: Disconnected from invalid user enter 195.178.191.5 port 52868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 10 02:56:13 host2 sshd[1575609]: Disconnected from invalid user ubuntu 118.194.250.47 port 41462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-10 02:57:13 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:53843: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.214.205
country_id: 6252001
description:
Dec 10 02:57:34 host2 sshd[1576630]: Disconnected from invalid user ventas05 192.227.214.205 port 38522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-10 02:57:45 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:38187: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.247.156.14
country_id: 6252001
description:
[2025-12-10 02:57:48 +0530] info [whostmgrd] 73.247.156.14 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 02:57:47 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<efQjlYtFCNuPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 10 02:57:08 host2 sshd[1576286]: Disconnected from invalid user clamav 152.52.15.214 port 19906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-10 02:57:25 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:45356: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-12-10 02:57:29 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:60994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.1.172.183
country_id: 6252001
description:
[2025-12-10 02:57:37 +0530] info [whostmgrd] 172.1.172.183 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.135.37.173
country_id: 6252001
description:
[2025-12-10 02:58:21 +0530] info [whostmgrd] 47.135.37.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.214.205
country_id: 6252001
description:
Dec 10 03:00:15 host2 sshd[1578729]: Disconnected from invalid user PRUEBA 192.227.214.205 port 57320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-10 03:00:22 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (lounvicar) [98.227.25.115]:57914: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.174.38.112
country_id: 6252001
description:
[2025-12-10 03:00:56 +0530] info [whostmgrd] 146.174.38.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.151.134
country_id: 6252001
description:
[2025-12-10 03:02:03 +0530] info [whostmgrd] 76.38.151.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.253
country_id: 6252001
description:
Dec 10 03:02:15 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.253, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<23NDpYtFx9DG6xj9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 03:03:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (preed) [87.103.126.54]:30017: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.53.181.253
country_id: 6252001
description:
[2025-12-10 03:04:18 +0530] info [whostmgrd] 38.53.181.253 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.206.108
country_id: 953987
description:
Dec 10 03:04:17 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=197.234.206.108, lip=66.85.158.91, TLS, session=<0b1iq4tFLIfF6s5s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.168.175
country_id: 3175395
description:
Dec 10 03:03:56 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.15.168.175, lip=66.85.158.91, TLS, session=<Efs0qotFddC5D6iv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.86.93.110
country_id: 6252001
description:
[2025-12-10 03:04:58 +0530] info [whostmgrd] 152.86.93.110 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.227.214.205
country_id: 6252001
description:
Dec 10 03:05:27 host2 sshd[1583221]: Disconnected from invalid user x 192.227.214.205 port 36112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 03:06:09 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<q1sSs4tF4tC8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.210.70.23
country_id: 3469034
description:
Dec 10 03:06:31 host2 sshd[1584213]: Disconnected from invalid user sammy 191.210.70.23 port 50145 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.42.170
country_id: 1821275
description:
2025-12-10 03:07:29 dovecot_login authenticator failed for ([125.31.42.170]) [125.31.42.170]:60380: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 10 03:06:55 host2 sshd[1584581]: Disconnected from invalid user x 154.222.24.142 port 48900 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-10 03:07:11 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:36494: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Dec 10 03:09:39 host2 sshd[1586961]: Disconnected from invalid user liu 154.222.24.142 port 45898 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.26.131
country_id: 6252001
description:
[2025-12-10 03:08:56 +0530] info [whostmgrd] 172.59.26.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.214.205
country_id: 6252001
description:
Dec 10 03:09:06 host2 sshd[1586614]: Disconnected from invalid user pepe 192.227.214.205 port 42774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-10 03:11:07 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:48532: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-12-10 03:11:31 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:60998: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 03:12:41 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<p7N2yotFQLqqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.65
country_id: 798544
description:
Dec 10 03:12:19 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=77.65.142.65, lip=66.85.158.91, TLS, session=<8xRNyItF8pdNQY5B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.165
country_id: 3175395
description:
Dec 10 03:12:39 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<marketing>, method=PLAIN, rip=185.197.8.165, lip=66.85.158.91, TLS, session=<hpJpyYtFD7u5xQil>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.129.219.63
country_id: 6252001
description:
[2025-12-10 03:13:01 +0530] info [whostmgrd] 74.129.219.63 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-12-10 03:14:52 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (suota) [71.229.43.123]:43646: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.154.95.225
country_id: 6252001
description:
[2025-12-10 03:15:31 +0530] info [whostmgrd] 76.154.95.225 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.80.116
country_id: 6252001
description:
[2025-12-10 03:15:35 +0530] info [whostmgrd] 172.59.80.116 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.140.68.132
country_id: 6252001
description:
[2025-12-10 03:14:55 +0530] info [whostmgrd] 69.140.68.132 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.12.117.40
country_id: 6252001
description:
[2025-12-10 03:14:59 +0530] info [whostmgrd] 47.12.117.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-10 03:16:22 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:38149: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-12-10 03:15:54 dovecot_login authenticator failed for ([207.188.158.216]) [207.188.158.216]:37127: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.85.224.184
country_id: 6252001
description:
[2025-12-10 03:15:53 +0530] info [whostmgrd] 73.85.224.184 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.22.254.195
country_id: 6252001
description:
[2025-12-10 03:15:56 +0530] info [whostmgrd] 99.22.254.195 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-10 03:16:07 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:43640: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-10 03:16:11 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:60241: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-10 03:17:15 dovecot_login authenticator failed for ([172.82.64.201]) [172.82.64.201]:38732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-12-10 03:17:37 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:45056: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.187.209
country_id: 6252001
description:
[2025-12-10 03:17:40 +0530] info [whostmgrd] 73.71.187.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.45.153.72
country_id: 6252001
description:
[2025-12-10 03:18:24 +0530] info [whostmgrd] 74.45.153.72 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.202.65
country_id: 6252001
description:
[2025-12-10 03:19:16 +0530] info [whostmgrd] 47.148.202.65 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 03:20:14 host2 sshd[1595462]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.52.34.214
country_id: 6252001
description:
[2025-12-10 03:20:30 +0530] info [whostmgrd] 68.52.34.214 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.94
country_id: 6252001
description:
Dec 10 03:20:39 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.94, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7zAS54tFe9OTuYRe>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 03:21:36 host2 sshd[1596621]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.99.243
country_id: 294640
description:
2025-12-10 03:21:47 dovecot_login authenticator failed for ([130.185.99.243]) [130.185.99.243]:58076: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-10 03:22:09 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:45648: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-10 03:22:37 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:51526: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-10 03:22:51 dovecot_login authenticator failed for ([95.164.177.6]) [95.164.177.6]:57176: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 10 03:25:17 host2 sshd[1599332]: Disconnected from invalid user huawei 117.216.211.19 port 50820 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 03:25:35 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<1MiQ+ItFluWqQMFo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.221.14
country_id: 6252001
description:
[2025-12-10 03:25:40 +0530] info [whostmgrd] 73.120.221.14 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Dec 10 03:25:49 host2 sshd[1599805]: Disconnected from invalid user erick 198.98.51.235 port 56808 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.34.168.71
country_id: 6252001
description:
[2025-12-10 03:25:15 +0530] info [whostmgrd] 68.34.168.71 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.202.147
country_id: 6252001
description:
[2025-12-10 03:26:33 +0530] info [whostmgrd] 76.38.202.147 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.120.92.103
country_id: 6252001
description:
[2025-12-10 03:26:33 +0530] info [whostmgrd] 199.120.92.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-12-10 03:25:57 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:43710: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
country_id: 2661886
description:
2025-12-10 03:26:20 dovecot_login authenticator failed for 217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:38870: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.150
country_id: 2464461
description:
Dec 10 03:27:02 host2 sshd[1600483]: Disconnected from invalid user sysadmin 197.5.145.150 port 49096 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-10 03:27:15 dovecot_plain authenticator failed for (vitral) [65.20.191.12]:58493: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 10 03:27:28 host2 sshd[1600810]: Disconnected from invalid user ali 117.216.211.19 port 33916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Dec 10 03:28:59 host2 sshd[1601659]: Disconnected from invalid user test 198.98.51.235 port 57208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 10 03:29:08 host2 sshd[1601782]: Disconnected from invalid user postgres 172.208.24.217 port 64434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Dec 10 03:29:23 host2 sshd[1601918]: Disconnected from invalid user ruoyi 186.10.86.130 port 51958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 10 03:29:29 host2 sshd[1601963]: Disconnected from invalid user user5 117.216.211.19 port 44270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 10 03:29:49 host2 sshd[1602165]: Disconnected from invalid user ruoyi 23.95.128.167 port 50686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 10 03:30:12 host2 sshd[1602570]: Disconnected from invalid user scan 181.188.176.247 port 43692 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.65.243.200
country_id: 6252001
description:
[2025-12-10 03:30:16 +0530] info [whostmgrd] 174.65.243.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 10 03:30:24 host2 sshd[1602805]: Disconnected from invalid user mytest 172.208.24.217 port 65528 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.41.38.209
country_id: 6252001
description:
[2025-12-10 03:30:50 +0530] info [whostmgrd] 96.41.38.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 03:29:57 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.168.217
country_id: 6252001
description:
[2025-12-10 03:31:28 +0530] info [whostmgrd] 172.56.168.217 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.80.12.245
country_id: 6252001
description:
[2025-12-10 03:31:32 +0530] info [whostmgrd] 67.80.12.245 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Dec 10 03:30:53 host2 sshd[1603234]: Disconnected from invalid user admin1 198.98.51.235 port 56866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 10 03:32:06 host2 sshd[1604587]: Disconnected from invalid user ftptest 23.95.128.167 port 42254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.98.153.146
country_id: 3932488
description:
2025-12-10 03:32:10 dovecot_login authenticator failed for ([200.37.228.213]) [191.98.153.146]:38807: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.152
country_id: 1643084
description:
Dec 10 03:32:17 host2 sshd[1604718]: Disconnected from invalid user erick 103.13.206.152 port 39648 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.204
country_id: 6252001
description:
Dec 10 03:32:50 host2 pure-ftpd[1605170]: (?@205.210.31.204) [INFO] New connection from 205.210.31.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-10 03:31:57 dovecot_login authenticator failed for (nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:47626: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.51.235
country_id: 6252001
description:
Dec 10 03:31:59 host2 sshd[1604363]: Disconnected from invalid user scan 198.98.51.235 port 53356 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.52
country_id: 6252001
description:
[2025-12-10 03:33:23 +0530] info [whostmgrd] 172.58.212.52 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 10 03:33:44 host2 sshd[1605795]: Disconnected from invalid user ca 23.95.128.167 port 59132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 10 03:33:08 host2 sshd[1605469]: Disconnected from invalid user n 181.188.176.247 port 46198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 10 03:33:12 host2 sshd[1605508]: Disconnected from invalid user huawei 23.95.128.167 port 37276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 10 03:33:55 host2 sshd[1605906]: Disconnected from invalid user erick 181.188.176.247 port 51874 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.249.101.8
country_id: 6252001
description:
[2025-12-10 03:34:42 +0530] info [whostmgrd] 73.249.101.8 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 10 03:35:17 host2 dovecot[1607655]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.44.220
country_id: 1227603
description:
Dec 10 03:35:25 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.44.220, lip=66.85.158.91, TLS, session=<anmwG4xFs02vnSzc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-10 03:35:43 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (miges) [73.224.171.101]:40186: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-10 03:35:50 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:51017: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.164.105.106
country_id: 6252001
description:
[2025-12-10 03:35:05 +0530] info [whostmgrd] 66.164.105.106 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.150
country_id: 1694008
description:
2025-12-10 03:36:05 dovecot_login authenticator failed for ([124.105.219.170]) [124.105.218.150]:51590: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 03:40:03 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<YGtVLIxFIJOKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-10 03:40:20 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:45799: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-12-10 03:40:39 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:41832: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-12-10 03:40:42 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:60823: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.228.173.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.228.173.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.251.103.9
country_id: 2510769
description:
2025-12-10 03:41:13 dovecot_login authenticator failed for 85.251.103.9.dyn.user.ono.com [85.251.103.9]:57906: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Dec 10 03:41:25 host2 sshd[1612811]: Disconnected from invalid user ca 101.47.48.255 port 45466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.34.142.254
country_id: 2963597
description:
Dec 10 03:41:32 host2 sshd[1612868]: Disconnected from invalid user deposito 176.34.142.254 port 36032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.68.133
country_id: 1880251
description:
Dec 10 03:41:43 host2 sshd[1612997]: Disconnected from invalid user nicole 43.134.68.133 port 53346 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.223
country_id: 3996063
description:
2025-12-10 03:41:49 dovecot_login authenticator failed for (201.173.56.223-clientes-izzi.mx) [201.173.56.223]:47398: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 10 03:42:13 host2 sshd[1613297]: Disconnected from invalid user mike 190.129.122.185 port 40402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-10 03:42:01 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:44044: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 03:43:01 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<D6nrNoxFqpWKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.34.142.254
country_id: 2963597
description:
Dec 10 03:43:25 host2 sshd[1613964]: Disconnected from invalid user admin 176.34.142.254 port 63370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 10 03:43:27 host2 sshd[1613984]: Disconnected from invalid user maha 108.173.137.12 port 48678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 10 03:43:46 host2 sshd[1614150]: Disconnected from invalid user UBUNTU 8.243.50.114 port 43532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-10 03:43:52 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (cochicel) [73.144.27.228]:48674: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 03:44:05 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ezG+OoxFbL0XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 10 03:44:29 host2 sshd[1614918]: Disconnected from invalid user platform 8.243.50.114 port 57848 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.34.142.254
country_id: 2963597
description:
Dec 10 03:44:03 host2 sshd[1614357]: Disconnected from invalid user devadmin 176.34.142.254 port 64164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Dec 10 03:45:19 host2 sshd[1616203]: Disconnected from invalid user mohamed 101.47.48.255 port 53796 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.214.193
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.214.193 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.34.142.254
country_id: 2963597
description:
Dec 10 03:45:40 host2 sshd[1616655]: Disconnected from invalid user user 176.34.142.254 port 39402 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 10 03:46:18 host2 sshd[1617564]: Disconnected from invalid user vector 202.157.176.165 port 34664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-10 03:46:27 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:45458: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 10 03:46:36 host2 sshd[1617811]: Disconnected from invalid user ubuntu 8.243.50.114 port 44578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.63
country_id: 3996063
description:
2025-12-10 03:46:40 dovecot_login authenticator failed for (189.219.138.63-clientes-izzi.mx) [189.219.138.63]:60333: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.68.133
country_id: 1880251
description:
Dec 10 03:46:59 host2 sshd[1618109]: Disconnected from invalid user vector 43.134.68.133 port 37670 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.134.21.204
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 74.134.21.204 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-12-10 03:47:34 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:47612: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Dec 10 03:47:41 host2 sshd[1618621]: Disconnected from invalid user aaa 45.249.245.22 port 40952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Dec 10 03:47:48 host2 sshd[1618665]: Disconnected from invalid user ali 101.47.48.255 port 38882 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.134.68.133
country_id: 1880251
description:
Dec 10 03:48:23 host2 sshd[1619174]: Disconnected from invalid user systems 43.134.68.133 port 54084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.22.8.217
country_id: 3865483
description:
2025-12-10 03:47:58 dovecot_login authenticator failed for ([186.22.8.217]) [186.22.8.217]:48898: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.175.151.48
country_id: 130758
description:
Dec 10 03:49:42 host2 sshd[1620135]: Disconnected from invalid user walter 79.175.151.48 port 55866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.66.223
country_id: 6252001
description:
Dec 10 03:49:52 host2 sshd[1620260]: Disconnected from invalid user bb 159.198.66.223 port 57716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 10 03:49:54 host2 sshd[1620268]: Disconnected from invalid user distro 108.173.137.12 port 33424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Dec 10 03:50:07 host2 sshd[1620642]: Disconnected from invalid user loguser 45.249.245.22 port 36528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.175.151.48
country_id: 130758
description:
Dec 10 03:52:04 host2 sshd[1622646]: Disconnected from invalid user nodejs 79.175.151.48 port 53468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.179.102.248
country_id: 1210997
description:
Dec 10 03:52:33 host2 sshd[1623012]: Disconnected from invalid user sonar 118.179.102.248 port 41416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 10 03:51:52 host2 sshd[1622413]: Disconnected from invalid user user 190.129.122.185 port 51634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-10 03:53:28 dovecot_plain authenticator failed for (inenus) [65.20.143.159]:60192: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Dec 10 03:55:46 host2 sshd[1626137]: Disconnected from invalid user q 45.78.201.248 port 44236 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.248
country_id: 1880251
description:
Dec 10 03:56:56 host2 sshd[1627127]: Disconnected from invalid user platform 45.78.201.248 port 48022 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-10 03:57:06 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3744: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-10 03:57:49 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:40310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 03:58:08 host2 sshd[1628069]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 03:58:59 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<i7YHcIxF5oOPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-10 04:00:18 dovecot_login authenticator failed for ([119.96.229.113]) [185.183.103.121]:59214: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Dec 10 04:00:23 host2 sshd[1629679]: Disconnected from invalid user wangjie 45.78.201.248 port 52860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 04:00:28 host2 sshd[1629794]: Disconnected from invalid user username 62.60.131.157 port 24688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-10 04:00:54 dovecot_login authenticator failed for ([211.49.80.72]) [178.232.80.9]:45661: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-10 04:01:37 dovecot_login authenticator failed for ([125.17.216.185]) [128.185.246.106]:57622: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-10 04:02:25 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (antesca) [73.145.107.251]:39822: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.187.161.131
country_id: 1861060
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 89.187.161.131 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2025-12-10 04:05:02 dovecot_plain authenticator failed for c-98-195-138-52.hsd1.tx.comcast.net (spardst) [98.195.138.52]:59870: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.111.178
country_id: 1733045
description:
Dec 10 04:05:26 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=72.60.111.178, lip=66.85.158.91, session=<jScUh4xF6oxIPG+y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.4
country_id: 1733045
description:
2025-12-10 04:05:57 dovecot_login authenticator failed for ([49.124.151.4]) [49.124.151.4]:34728: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.143.88
country_id: 1819730
description:
2025-12-10 04:06:05 dovecot_login authenticator failed for (m121-202-143-88.smartone.com) [121.202.143.88]:34307: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-10 04:06:11 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:39669: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-10 04:06:18 dovecot_login authenticator failed for ([180.94.75.110]) [180.94.75.110]:34490: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.211
country_id: 1733045
description:
2025-12-10 04:07:17 dovecot_login authenticator failed for ([49.124.149.211]) [49.124.149.211]:53062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 04:07:37 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<ld3sjoxFOOuqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-12-10 04:07:55 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:45102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 04:08:05 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<8vyMkIxFDtq8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-10 04:09:42 dovecot_plain authenticator failed for (couss) [64.53.7.231]:42298: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-10 04:09:47 dovecot_plain authenticator failed for (spisal) [65.20.133.4]:35017: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-10 04:11:44 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:38751: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-10 04:12:05 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:33087: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.224.46
country_id: 1269750
description:
2025-12-10 04:12:40 dovecot_plain authenticator failed for (1VT5KO7) [106.222.224.46]:16726: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-10 04:12:43 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:53628: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.81.15.232
country_id: 241170
description:
Dec 10 04:18:05 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=154.81.15.232, lip=66.85.158.91, TLS handshaking: Connection closed, session=<UktvtIxFRF2aUQ/o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 04:20:36 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<FC1OvYxF6ouqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.250
country_id: 1733045
description:
2025-12-10 04:22:00 dovecot_login authenticator failed for ([49.124.152.250]) [49.124.152.250]:33734: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.41
country_id: 6252001
description:
2025-12-10 04:22:22 dovecot_login authenticator failed for ([98.181.46.41]) [98.181.46.41]:48445: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 04:22:25 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.210.91
country_id: 798544
description:
Dec 10 04:25:45 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=91.246.210.91, lip=66.85.158.91, TLS, session=<AbPozoxF7JBb9tJb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 04:26:00 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<3gSo0IxFotMXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.7.187.206
country_id: 3469034
description:
Dec 10 04:26:05 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=45.7.187.206, lip=66.85.158.91, TLS, session=<kowA0IxF2+wtB7vO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-12-10 04:26:10 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:60818: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-10 04:26:25 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:45888: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 10 04:26:27 host2 sshd[1658356]: Disconnected from invalid user git 189.50.142.82 port 52209 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Dec 10 04:26:51 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.1, lip=66.85.158.92, session=<p77J04xFc5tV2ZUB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Dec 10 04:27:47 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.108, lip=66.85.158.91, session=<dB4n14xFQOXG6xhs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.15
country_id: 2750405
description:
Dec 10 04:28:18 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=212.73.148.15, lip=66.85.158.92, TLS: Connection closed, session=<nPT22IxFEdDUSZQP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.167.84
country_id: 2921044
description:
Dec 10 04:29:29 host2 pure-ftpd[1662412]: (?@164.90.167.84) [INFO] New connection from 164.90.167.84


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 164.90.167.84
country_id: 2921044
description:
Dec 10 04:29:32 host2 pure-ftpd[1662494]: (?@164.90.167.84) [INFO] New connection from 164.90.167.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-12-10 04:30:44 dovecot_login authenticator failed for (SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:56552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.90.170.26
country_id: 6251999
description:
2025-12-10 04:31:04 dovecot_login authenticator failed for ([174.90.170.26]) [174.90.170.26]:34712: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-10 04:31:10 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:38468: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-12-10 04:31:35 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:47210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-12-10 04:31:40 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:33568: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-10 04:31:54 dovecot_login authenticator failed for ([182.95.228.194]) [182.95.228.194]:44246: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-10 04:32:10 dovecot_plain authenticator failed for (crostal) [65.20.133.4]:60511: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-10 04:32:13 dovecot_plain authenticator failed for (motareas) [154.144.243.93]:49630: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-10 04:32:13 dovecot_login authenticator failed for (246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:47210: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-10 04:32:22 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:59234: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-10 04:32:23 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:49818: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 10 04:33:12 host2 sshd[1667142]: Disconnected from invalid user vikas 189.50.142.82 port 54177 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 04:35:34 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<L+Hd8oxFENyKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-10 04:36:21 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:56548: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-10 04:36:35 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:49566: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-12-10 04:37:32 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:58594: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-10 04:37:41 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:59188: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-10 04:37:40 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:60911: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-10 04:37:28 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:4959: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 04:38:31 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<m61s/YxFTN+KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-10 04:41:09 dovecot_plain authenticator failed for (lidity) [65.20.143.159]:51303: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-10 04:46:44 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:56344: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-12-10 04:46:56 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:54126: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-12-10 04:47:58 dovecot_login authenticator failed for ([110.77.148.87]) [110.77.148.87]:33714: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-12-10 04:48:24 dovecot_login authenticator failed for ([92.62.74.41]) [92.62.74.41]:56706: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.23.215.194
country_id: 6252001
description:
Dec 10 04:48:43 host2 pure-ftpd[1682993]: (?@107.23.215.194) [INFO] New connection from 107.23.215.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.63.161.126
country_id: 2510769
description:
2025-12-10 04:50:21 dovecot_login authenticator failed for static-126-161-63-95.ipcom.comunitel.net [95.63.161.126]:52754: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-10 04:50:34 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:47634: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-10 04:54:09 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:59771: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-12-10 04:54:38 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:38781: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.160.203.96
country_id: 1861060
description:
2025-12-10 04:55:37 dovecot_login authenticator failed for p6032-ipngnfx01funabasi.chiba.ocn.ne.jp [114.160.203.96]:60967: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-10 04:55:42 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:39124: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.167.82.206
country_id: 6252001
description:
2025-12-10 04:55:54 dovecot_login authenticator failed for (syn-024-167-082-206.res.spectrum.com) [24.167.82.206]:36374: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-10 04:55:56 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:32896: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.188.178.23
country_id: 6252001
description:
2025-12-10 04:57:20 dovecot_login authenticator failed for syn-108-188-178-023.biz.spectrum.com [108.188.178.23]:55530: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.130.115.203
country_id: 174982
description:
2025-12-10 04:57:35 dovecot_login authenticator failed for (203.115.130.46.in-addr.viva.am) [46.130.115.203]:22791: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-10 04:57:58 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (nonium) [68.60.77.128]:34804: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.201
country_id: 6252001
description:
Dec 10 04:59:38 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7+AMSY1FUM7N0h/J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 04:59:41 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<vvgTSY1Feq2Pbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-10 05:00:30 dovecot_plain authenticator failed for (licing) [192.81.229.179]:49376: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-10 05:00:35 dovecot_plain authenticator failed for (contiss) [5.31.15.108]:42713: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-12-10 05:01:45 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:47672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-10 05:02:34 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:60050: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-10 05:02:01 dovecot_login authenticator failed for ([182.74.13.219]) [182.74.12.86]:51752: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.75.185.190
country_id: 6252001
description:
2025-12-10 05:02:14 dovecot_login authenticator failed for (149-75-185-190.s445.c3-0.elg-e6k1.nape.il.cable.rcncustomer.com) [149.75.185.190]:35294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-10 05:02:58 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (thrutted) [73.195.211.98]:54790: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 05:03:48 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<z2zYV41F3JiqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 05:04:17 host2 sshd[1697970]: Disconnected from invalid user usuario 62.60.131.157 port 24787 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-12-10 05:11:35 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:52988: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 05:11:50 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<xdSLdI1F6Le8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.95.157
country_id: 1880251
description:
Dec 10 05:10:57 host2 sshd[1703971]: Disconnected from invalid user test4 129.226.95.157 port 52084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.119
country_id: 798544
description:
Dec 10 05:12:36 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<awanish>, method=PLAIN, rip=178.216.30.119, lip=66.85.158.91, TLS, session=<z9pzdo1F89my2B53>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.6
country_id: 1269750
description:
2025-12-10 05:12:04 dovecot_login authenticator failed for ([182.66.251.185]) [182.95.124.6]:55950: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.69
country_id: 3175395
description:
Dec 10 05:12:19 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<awanish@maximsholdings.com>, method=PLAIN, rip=185.197.8.69, lip=66.85.158.91, TLS, session=<imJldY1FVqK5xQhF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.97.41
country_id: 6290252
description:
Dec 10 05:14:30 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=109.206.97.41, lip=66.85.158.91, TLS, session=<w/w6fY1FEZFtzmEp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.223
country_id: 99237
description:
Dec 10 05:14:49 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.213.223, lip=66.85.158.91, TLS, session=<cZxOfo1F/9RBFNXf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-10 05:15:20 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:46114: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.53.232
country_id: 3469034
description:
Dec 10 05:15:31 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 36 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=170.82.53.232, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ywq7f41FmtGqUjXo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-10 05:15:34 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:34914: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 190.89.136.234
country_id: 3469034
description:
Dec 10 05:15:36 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=190.89.136.234, lip=66.85.158.91, TLS, session=<PFItgo1F07i+WYjq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-10 05:15:08 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (unbed) [66.177.30.53]:59548: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.95.157
country_id: 1880251
description:
Dec 10 05:16:17 host2 sshd[1709421]: Disconnected from invalid user firefart 129.226.95.157 port 48580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 05:17:11 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<NvGrh41FgrOqQMFo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.226.95.157
country_id: 1880251
description:
Dec 10 05:17:35 host2 sshd[1710699]: Disconnected from invalid user ansadmin 129.226.95.157 port 52600 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.216.244.43
country_id: 6252001
description:
Dec 10 05:18:53 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=48.216.244.43, lip=66.85.158.92, session=<S6bgjY1Fvt8w2PQr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.95.157
country_id: 1880251
description:
Dec 10 05:20:33 host2 sshd[1714033]: Disconnected from invalid user alireza 129.226.95.157 port 53304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2025-12-10 05:20:35 dovecot_login authenticator failed for ([59.145.84.169]) [182.95.176.122]:43462: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-10 05:20:48 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:42425: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.236.172
country_id: 1605651
description:
Dec 10 05:20:50 host2 sshd[1714300]: Disconnected from invalid user zoom 49.49.236.172 port 48354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-10 05:20:17 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:39633: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-12-10 05:20:27 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:53658: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.87.76.87
country_id: 6290252
description:
Dec 10 05:21:41 host2 sshd[1715055]: Disconnected from invalid user nasrin 93.87.76.87 port 48770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-10 05:21:45 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:36844: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.8
country_id: 2750405
description:
Dec 10 05:22:20 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.14.32.8, lip=66.85.158.91, session=<bQE8mo1FoNEfDiAI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.236.172
country_id: 1605651
description:
Dec 10 05:22:52 host2 sshd[1715998]: Disconnected from invalid user novinhost 49.49.236.172 port 47596 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-10 05:22:00 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:55220: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.87.76.87
country_id: 6290252
description:
Dec 10 05:23:26 host2 sshd[1716586]: Disconnected from invalid user zoom 93.87.76.87 port 36802 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.49.236.172
country_id: 1605651
description:
Dec 10 05:24:16 host2 sshd[1717407]: Disconnected from invalid user share 49.49.236.172 port 45062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.236.172
country_id: 1605651
description:
Dec 10 05:24:56 host2 sshd[1717998]: Disconnected from invalid user reloj 49.49.236.172 port 57894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.87.76.87
country_id: 6290252
description:
Dec 10 05:25:11 host2 sshd[1718414]: Disconnected from invalid user deploy 93.87.76.87 port 44588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-12-10 05:26:06 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:58914: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-12-10 05:26:16 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:57475: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.57.180
country_id: 6252001
description:
Dec 10 05:26:40 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.106.57.180, lip=66.85.158.92, session=<APy9qY1FDJcUajm0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.36
country_id: 3996063
description:
2025-12-10 05:26:45 dovecot_login authenticator failed for (189.219.138.36-clientes-izzi.mx) [189.219.138.36]:59891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.87.76.87
country_id: 6290252
description:
Dec 10 05:28:02 host2 sshd[1721121]: Disconnected from invalid user extern 93.87.76.87 port 41720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.23.246
country_id: 895949
description:
2025-12-10 05:29:35 dovecot_login authenticator failed for ([49.246.3.236]) [41.60.23.246]:52570: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 05:30:53 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<2360uI1FMOWKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.143.101.69
country_id: 3686110
description:
Dec 10 05:30:02 host2 sshd[1723176]: Disconnected from invalid user ftpuser 190.143.101.69 port 42376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.27
country_id: 1522867
description:
2025-12-10 05:30:47 dovecot_login authenticator failed for ([182.74.216.122]) [212.116.247.27]:55071: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.143.101.69
country_id: 3686110
description:
Dec 10 05:31:28 host2 sshd[1724479]: Disconnected from invalid user rootadmin 190.143.101.69 port 38414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.143.101.69
country_id: 3686110
description:
Dec 10 05:32:11 host2 sshd[1724990]: Disconnected from invalid user ubuntu 190.143.101.69 port 37792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-10 05:32:26 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:49463: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 05:32:29 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (jacan) [51.195.117.220]:37797: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-10 05:32:56 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:41047: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.214.99.144
country_id: 2921044
description:
Dec 10 05:33:19 host2 sshd[1725796]: Disconnected from invalid user bot 181.214.99.144 port 48722 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 05:33:50 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<fu88w41FkumKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.214.99.144
country_id: 2921044
description:
Dec 10 05:34:21 host2 sshd[1726509]: Disconnected from invalid user user 181.214.99.144 port 46912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-12-10 05:34:38 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:38429: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-10 05:34:47 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:60524: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.214.99.144
country_id: 2921044
description:
Dec 10 05:34:53 host2 sshd[1726814]: Disconnected from invalid user info 181.214.99.144 port 60146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.214.99.144
country_id: 2921044
description:
Dec 10 05:35:25 host2 sshd[1727539]: Disconnected from invalid user pon 181.214.99.144 port 45128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-10 05:36:14 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:56872: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.214.99.144
country_id: 2921044
description:
Dec 10 05:36:29 host2 sshd[1728329]: Disconnected from invalid user ubuntu 181.214.99.144 port 43310 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-10 05:36:35 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:46192: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 181.214.99.144
country_id: 2921044
description:
Dec 10 05:35:58 host2 sshd[1727882]: Received disconnect from 181.214.99.144 port 58336:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.201
country_id: 1269750
description:
2025-12-10 05:37:48 dovecot_login authenticator failed for (nsg-corporate-201.229.187.122.airtel.in) [122.187.229.201]:44623: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.42.170
country_id: 1821275
description:
2025-12-10 05:37:17 dovecot_login authenticator failed for ([125.31.42.170]) [125.31.42.170]:59432: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-10 05:37:18 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:53108: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-12-10 05:37:27 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:61949: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
country_id: 3469034
description:
2025-12-10 05:37:34 dovecot_login authenticator failed for (Bundle-Ether3.2078.static.gvt.net.br) [179.185.1.97]:45439: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.133.103
country_id: 1733045
description:
2025-12-10 05:37:44 dovecot_login authenticator failed for ([49.124.133.103]) [49.124.133.103]:60786: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2025-12-10 05:40:49 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:63857: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-10 05:41:04 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:4409: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-10 05:44:13 dovecot_plain authenticator failed for (shoto) [91.73.188.251]:57599: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-10 05:45:20 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:58710: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-10 05:45:33 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:35624: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-10 05:45:49 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:60926: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-12-10 05:45:11 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:35960: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.52.218.176
country_id: 6252001
description:
2025-12-10 05:45:13 dovecot_login authenticator failed for (ZHrhL3v) [65.52.218.176]:52548: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.52.218.176
country_id: 6252001
description:
2025-12-10 05:46:05 dovecot_login authenticator failed for (ehfDJtf) [65.52.218.176]:53585: 535 Incorrect authentication data (set_id=ajith)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 65.52.218.176
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[65.52.218.176] [Authentication Database]=[mail] [Username]=[ajith] (5/5 failures) (blocked until [Wed Dec 10 00:31:03 2025 UTC/Wed Dec 10 06:01:03 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-10 05:46:34 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:57183: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-12-10 05:47:03 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:33058: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 05:48:55 host2 sshd[1737797]: Disconnected from invalid user  62.60.131.157 port 32339 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.52.218.176
country_id: 6252001
description:
2025-12-10 05:49:05 dovecot_login authenticator failed for (BLEfd9) [65.52.218.176]:54139: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.176.195
country_id: 798544
description:
2025-12-10 05:51:39 dovecot_login authenticator failed for 5.185.176.195.ipv4.public.orange.pl [5.185.176.195]:44100: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 10 05:51:54 host2 sshd[1740683]: Disconnected from invalid user deploy 152.32.250.188 port 37292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.123
country_id: 2635167
description:
2025-12-10 05:51:03 dovecot_login authenticator failed for (77-89-143-123.fluidata.co.uk) [77.89.143.123]:50736: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.254.153
country_id: 3469034
description:
2025-12-10 05:52:34 dovecot_login authenticator failed for ([45.173.254.224]) [45.173.254.153]:60871: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 05:52:45 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (bosic) [51.195.117.220]:38428: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-12-10 05:52:51 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:60177: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-10 05:52:02 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:36076: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 10 05:53:21 host2 sshd[1742286]: Disconnected from invalid user es 152.32.250.188 port 50162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.113
country_id: 2186224
description:
2025-12-10 05:53:28 dovecot_login authenticator failed for ([121.73.168.113]) [121.73.168.113]:33942: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 10 05:53:55 host2 sshd[1742959]: Disconnected from invalid user syncthing 41.216.178.119 port 41590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-10 05:54:08 dovecot_login authenticator failed for ([182.78.10.145]) [122.185.101.50]:34478: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-10 05:54:48 dovecot_login authenticator failed for ([14.195.19.75]) [14.195.19.75]:58286: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 10 05:56:12 host2 sshd[1746419]: Disconnected from invalid user applmgr 41.216.178.119 port 54058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 10 05:56:17 host2 sshd[1746511]: Disconnected from invalid user sysadmin 152.32.250.188 port 47686 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.161
country_id: 6252001
description:
Dec 10 05:56:42 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.161, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QMAhFY5FsNbG6xih>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-10 05:57:23 dovecot_plain authenticator failed for (cliting) [81.0.54.119]:52336: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 10 05:57:39 host2 sshd[1748537]: Disconnected from invalid user administrator 41.216.178.119 port 41330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 10 05:57:39 host2 sshd[1748529]: Disconnected from invalid user angela 152.32.250.188 port 60566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-10 05:57:56 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:51824: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-10 05:58:18 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:37116: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.151.151.79
country_id: 130758
description:
Dec 10 05:58:20 host2 sshd[1749462]: Disconnected from invalid user newuser 193.151.151.79 port 57560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-10 05:58:41 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64310: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 10 05:59:12 host2 sshd[1750608]: Disconnected from invalid user ca 41.216.178.119 port 33456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 06:00:10 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<2yBpIY5FYKmqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 10 06:00:44 host2 sshd[1752533]: Disconnected from invalid user sahil 41.216.178.119 port 46732 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-10 06:01:12 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:55292: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.234
country_id: 3996063
description:
2025-12-10 06:01:25 dovecot_login authenticator failed for (201.173.92.234-clientes-izzi.mx) [201.173.92.234]:57408: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-10 06:02:34 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:49572: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-10 06:03:41 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:41744: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.186
country_id: 1269750
description:
2025-12-10 06:03:03 dovecot_login authenticator failed for (static.bb.ill.59.92.51.186.bsnl.in) [59.92.51.186]:39861: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec 10 06:03:05 host2 dovecot[1607708]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS: Connection closed, session=<zYf3K45FwrFChJl3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2025-12-10 06:03:29 dovecot_login authenticator failed for ([49.124.148.192]) [49.124.148.192]:53174: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 06:04:38 host2 dovecot[1607708]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<6JleMY5F8OiPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-10 06:05:15 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (femint) [93.145.118.40]:38950: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 06:05:17 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (hootelison) [51.195.117.220]:54983: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.151.151.79
country_id: 130758
description:
Dec 10 06:07:17 host2 sshd[1761789]: Disconnected from invalid user es 193.151.151.79 port 56532 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 06:09:20 host2 sshd[1764304]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 10 06:10:43 host2 dovecot[1766324]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-10 06:10:42 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:51726: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-10 06:10:57 dovecot_login authenticator failed for ([182.95.178.206]) [182.95.178.206]:45730: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-10 06:10:59 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (oboacalike) [98.192.74.183]:60086: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.135
country_id: 1733045
description:
2025-12-10 06:11:20 dovecot_login authenticator failed for ([49.124.142.135]) [49.124.142.135]:36844: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.151.151.79
country_id: 130758
description:
Dec 10 06:11:52 host2 sshd[1768000]: Disconnected from invalid user ca 193.151.151.79 port 54104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2025-12-10 06:11:59 dovecot_login authenticator failed for ([49.124.146.42]) [49.124.146.42]:50308: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-10 06:12:13 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:43445: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 06:13:14 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<YMYcUI5FQuWqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-10 06:14:00 dovecot_plain authenticator failed for (xylock) [102.53.15.17]:57492: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 06:14:40 host2 sshd[1771344]: Disconnected from invalid user user 2.57.121.25 port 49687 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 06:15:29 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<billing@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<PtonWI5FOs68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.70
country_id: 1733045
description:
2025-12-10 06:16:34 dovecot_login authenticator failed for ([49.124.151.70]) [49.124.151.70]:37486: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.54
country_id: 2186224
description:
2025-12-10 06:17:13 dovecot_login authenticator failed for ([121.73.162.54]) [121.73.162.54]:35596: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-10 06:17:29 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (adiaterus) [73.195.211.98]:42950: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-10 06:17:34 dovecot_login authenticator failed for ([125.18.210.161]) [182.95.119.118]:36680: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.10.205.174
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 195.10.205.174 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.42.20
country_id: 2395170
description:
Dec 10 06:19:54 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=154.127.42.20, lip=66.85.158.91, TLS, session=<3bcNZ45FabuafyoU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.225.217.97
country_id: 3469034
description:
Dec 10 06:20:14 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.225.217.97, lip=66.85.158.91, TLS, session=<n1QzaI5FWLS64dlh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 06:22:51 host2 sshd[1779152]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec 10 06:22:55 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<4nLEco5F8IEf3Dhi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 06:24:50 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (calcona) [87.103.126.54]:26157: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-10 06:26:16 dovecot_login authenticator failed for ([152.52.92.105]) [152.52.192.74]:50894: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 06:26:47 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<V7mbgI5FqKaKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-10 06:27:15 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:59804: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 06:29:47 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ixxUi45FvK2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-12-10 06:30:08 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:56450: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-10 06:30:19 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (suplobing) [174.59.253.88]:34968: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-10 06:30:23 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:55790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-10 06:33:23 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:52790: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-12-10 06:33:32 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:53019: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-10 06:34:00 dovecot_login authenticator failed for ([182.95.2.9]) [182.78.67.22]:43108: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-10 06:34:09 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:38559: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-10 06:34:50 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:62091: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-10 06:34:51 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:38278: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-10 06:33:58 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:60846: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.163
country_id: 3996063
description:
2025-12-10 06:34:57 dovecot_login authenticator failed for (201.172.88.163-clientes-izzi.mx) [201.172.88.163]:53693: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-10 06:35:19 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:52230: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-10 06:35:21 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:39606: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.222
country_id: 3469034
description:
Dec 10 06:35:48 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.89.136.222, lip=66.85.158.91, TLS, session=<W5bdn45FSJa+WYje>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.42.6
country_id: 2395170
description:
Dec 10 06:36:09 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=154.127.42.6, lip=66.85.158.91, TLS, session=<rr4YoY5FMdeafyoG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.102.101.248
country_id: 1269750
description:
2025-12-10 06:36:12 dovecot_login authenticator failed for ([14.102.101.248]) [14.102.101.248]:44688: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-10 06:36:24 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:54054: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-10 06:37:36 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (bansive) [68.193.149.88]:52897: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 06:38:26 host2 sshd[1790821]: Disconnected from invalid user admin 2.57.121.112 port 47097 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.62
country_id: 1880251
description:
Dec 10 06:40:21 host2 sshd[1792499]: Disconnected from invalid user q 45.78.223.62 port 36952 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.102.98.235
country_id: 6252001
description:
Dec 10 06:40:22 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.102.98.235, lip=66.85.158.91, session=<Ba5TsY5FaK8UZmLr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.213.7.87
country_id: 6252001
description:
2025-12-10 06:41:03 dovecot_login authenticator failed for 87.sub-97-213-7.myvzw.com [97.213.7.87]:45682: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-10 06:41:25 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:38456: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 10 06:42:00 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<ARoit45F5FenXpI4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-10 06:42:00 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:56790: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-10 06:42:13 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57664: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.118
country_id: 6252001
description:
Dec 10 06:42:29 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.118, lip=66.85.158.91, session=<iKjXuI5FwuUUQcN2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.139
country_id: 6252001
description:
Dec 10 06:42:46 host2 sshd[1794486]: Disconnected from invalid user minecraft 165.154.235.139 port 45058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.235.139
country_id: 6252001
description:
Dec 10 06:43:53 host2 sshd[1795246]: Disconnected from invalid user asd 165.154.235.139 port 51848 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 06:45:06 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<5eQRwo5FmL4XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.139
country_id: 6252001
description:
Dec 10 06:45:41 host2 sshd[1797406]: Disconnected from invalid user sbserver 165.154.235.139 port 55200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.101
country_id: 3469034
description:
Dec 10 06:46:24 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.248.101, lip=66.85.158.91, TLS, session=<Eq2lxY5Ft7u60fhl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.224
country_id: 3865483
description:
Dec 10 06:46:46 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.251.224, lip=66.85.158.91, TLS, session=<MAYIx45Fmd2zAPvg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.62
country_id: 1880251
description:
Dec 10 06:48:38 host2 sshd[1800236]: Disconnected from invalid user mike 45.78.223.62 port 47300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.249
country_id: 2300660
description:
Dec 10 06:48:40 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=41.139.28.249, lip=66.85.158.91, TLS, session=<sJHDzY5FToopixz5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.222
country_id: 2300660
description:
Dec 10 06:49:02 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=41.139.18.222, lip=66.85.158.91, TLS, session=<0sMkz45Fl9IpixLe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-10 06:51:32 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (licals) [73.213.236.66]:39528: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-10 06:51:31 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:41529: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-10 06:52:01 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:43860: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.62
country_id: 1880251
description:
Dec 10 06:52:11 host2 sshd[1804494]: Disconnected from invalid user user 45.78.223.62 port 37144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.62
country_id: 1880251
description:
Dec 10 06:54:32 host2 sshd[1807820]: Disconnected from invalid user bb 45.78.223.62 port 45814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-10 06:55:11 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (extedate) [196.47.172.253]:33333: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.61
country_id: 6252001
description:
Dec 10 06:55:13 host2 pure-ftpd[1809116]: (?@147.185.132.61) [INFO] New connection from 147.185.132.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 06:55:06 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (syness) [96.230.65.90]:37212: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-10 06:55:57 dovecot_login authenticator failed for (221-169-97-62.cust.smartcall.no) [62.97.169.221]:38606: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 06:55:58 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<GdHw6I5FTqqqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-10 06:56:23 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:46864: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-10 07:00:52 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:48696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-12-10 07:01:13 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:56344: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.64
country_id: 3996063
description:
2025-12-10 07:01:13 dovecot_login authenticator failed for (201.173.97.64-clientes-izzi.mx) [201.173.97.64]:56738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-10 07:01:14 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (culoprevit) [217.215.74.195]:51455: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.192
country_id: 6252001
description:
2025-12-10 07:01:45 dovecot_login authenticator failed for ([72.214.132.192]) [72.214.132.192]:39697: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-10 07:02:20 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:58502: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-12-10 07:02:36 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:36342: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-10 07:03:31 dovecot_plain authenticator failed for (amethuze) [185.214.169.10]:33640: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 07:03:34 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (whonsm) [51.195.117.220]:25065: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.193.134
country_id: 1269750
description:
2025-12-10 07:07:15 dovecot_login authenticator failed for ([122.175.193.134]) [122.175.193.134]:35726: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 07:07:18 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<RdFzEY9FHNGPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.54
country_id: 6252001
description:
2025-12-10 07:07:43 dovecot_login authenticator failed for ([98.185.120.54]) [98.185.120.54]:46855: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-10 07:08:25 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:42994: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-10 07:08:58 dovecot_login authenticator failed for ([182.95.20.115]) [182.95.229.142]:40040: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 07:09:11 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<EnMwGI9F5teqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 07:12:27 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<gIHqI49FXpgXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-10 07:16:14 dovecot_plain authenticator failed for (diang) [65.20.153.146]:58936: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-10 07:17:28 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:51132: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.0.182
country_id: 3469034
description:
2025-12-10 07:17:50 dovecot_login authenticator failed for ([177.74.52.129]) [177.74.0.182]:39159: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 07:18:43 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<xEZSOo9F8Lu8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-10 07:19:53 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (kyriasseed) [73.68.220.15]:59872: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-10 07:21:21 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 10 07:21:20 host2 sshd[1838376]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 58380


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-10 07:21:33 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:55410: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-10 07:21:19 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:43040: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-10 07:22:30 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:39235: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 07:22:45 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hhrCSI9FltiKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.30
country_id: 1733045
description:
2025-12-10 07:22:53 dovecot_login authenticator failed for ([49.124.151.30]) [49.124.151.30]:36572: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 07:25:45 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<YbV6U49FIuGKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.122
country_id: 690791
description:
Dec 10 07:25:19 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=176.103.7.122, lip=66.85.158.91, TLS, session=<dm8NUY9FE52wZwd6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.186.172.98
country_id: 1269750
description:
Dec 10 07:25:40 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=103.186.172.98, lip=66.85.158.91, TLS, session=<dKkzUo9F3upnuqxi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.173
country_id: 6251999
description:
2025-12-10 07:26:26 dovecot_login authenticator failed for ([207.134.139.173]) [207.134.139.173]:65342: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-10 07:26:43 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:44399: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.223
country_id: 1643084
description:
Dec 10 07:27:01 host2 sshd[1845073]: Disconnected from invalid user hamza 27.112.78.223 port 46000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-10 07:26:08 dovecot_login authenticator failed for (nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:59838: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-12-10 07:27:02 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:33762: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-10 07:27:28 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:52834: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-10 07:27:42 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:43007: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-10 07:27:45 dovecot_login authenticator failed for (kLU3OJlI) [178.16.54.32]:56225: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-10 07:28:09 dovecot_login authenticator failed for (8tgm4vWh9) [178.16.54.32]:59584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-10 07:29:42 dovecot_login authenticator failed for (1lV7uEj) [178.16.54.32]:56945: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-10 07:30:30 dovecot_plain authenticator failed for (helly) [154.144.243.93]:42454: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.223
country_id: 1643084
description:
Dec 10 07:30:41 host2 sshd[1849283]: Disconnected from invalid user paul 27.112.78.223 port 47702 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-10 07:31:04 dovecot_login authenticator failed for ([128.185.13.33]) [122.184.123.118]:37944: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-12-10 07:31:21 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:61931: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-10 07:31:56 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:50961: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 10 07:32:16 host2 sshd[1850980]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 60436


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.223
country_id: 1643084
description:
Dec 10 07:32:26 host2 sshd[1851092]: Disconnected from invalid user support 27.112.78.223 port 53578 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.215
country_id: 3469034
description:
Dec 10 07:32:57 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.248.215, lip=66.85.158.91, TLS, session=<5P9EbI9FwYe60fjX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-10 07:32:14 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:40032: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.166
country_id: 1269750
description:
Dec 10 07:33:17 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.164.246.166, lip=66.85.158.91, TLS, session=<MGl2bY9FLKZnpPam>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 07:37:01 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (sodefow) [51.195.117.220]:37848: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-10 07:39:52 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:33648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-10 07:40:12 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:53616: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.186.210.191
country_id: 6252001
description:
Dec 10 07:41:07 host2 sshd[1860038]: Disconnected from invalid user test4 91.186.210.191 port 34948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 10 07:41:35 host2 sshd[1860368]: Disconnected from invalid user bharath 103.186.1.197 port 40950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.70
country_id: 1733045
description:
2025-12-10 07:42:05 dovecot_login authenticator failed for ([49.124.151.70]) [49.124.151.70]:37756: 535 Incorrect authentication data (set_id=contactus@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-12-10 07:42:30 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:62423: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 10 07:44:54 host2 sshd[1863416]: Disconnected from invalid user wade 103.186.1.197 port 42172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.23
country_id: 798549
description:
Dec 10 07:44:26 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=85.217.149.23, lip=66.85.158.92, TLS: Connection closed, session=<yYJmlo9FQ6JV2ZUX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.6.212.12
country_id: 798544
description:
Dec 10 07:44:41 host2 sshd[1863223]: Disconnected from invalid user test 31.6.212.12 port 55674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 10 07:45:37 host2 sshd[1864361]: Disconnected from invalid user webmin 103.186.1.197 port 55758 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.211.174
country_id: 174982
description:
2025-12-10 07:46:02 dovecot_login authenticator failed for (host-174.211.77.5.ucom.am) [5.77.211.174]:37494: 535 Incorrect authentication data (set_id=contactus@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec 10 07:45:23 host2 sshd[1864243]: Disconnected from invalid user ansible 103.49.238.251 port 60248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.201
country_id: 1269750
description:
2025-12-10 07:46:31 dovecot_login authenticator failed for (nsg-corporate-201.229.187.122.airtel.in) [122.187.229.201]:35918: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.6.212.12
country_id: 798544
description:
Dec 10 07:46:53 host2 sshd[1865224]: Disconnected from invalid user ubuntu 31.6.212.12 port 60696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 10 07:46:54 host2 sshd[1865236]: Disconnected from invalid user openstack 103.186.1.197 port 57874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 10 07:47:35 host2 sshd[1865834]: Disconnected from invalid user ubuntu 103.186.1.197 port 38942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.186.210.191
country_id: 6252001
description:
Dec 10 07:47:59 host2 sshd[1866118]: Disconnected from invalid user applmgr 91.186.210.191 port 42248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec 10 07:49:26 host2 sshd[1867484]: Disconnected from invalid user wade 103.49.238.251 port 35752 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 31.6.212.12
country_id: 798544
description:
Dec 10 07:49:35 host2 sshd[1867647]: Received disconnect from 31.6.212.12 port 39128:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.6.212.12
country_id: 798544
description:
Dec 10 07:49:35 host2 sshd[1867647]: Disconnected from invalid user openstack 31.6.212.12 port 39128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-10 07:50:54 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:54757: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-10 07:50:32 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:38768: 535 Incorrect authentication data (set_id=contactus@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
country_id: 1269750
description:
2025-12-10 07:50:35 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:52625: 535 Incorrect authentication data (set_id=contactus@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.57
country_id: 2635167
description:
Dec 10 07:50:41 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.57, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zE7CrI9Fatcjy9M5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-10 07:50:50 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:57606: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.57
country_id: 2635167
description:
Dec 10 07:51:17 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.211.57, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<bYznro9FnuAjy9M5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 07:51:41 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<1Hk8sI9F/O2qQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.18.224
country_id: 3996063
description:
Dec 10 07:51:43 host2 sshd[1869559]: Disconnected from invalid user cdr 201.124.18.224 port 60817 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-10 07:52:00 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:35644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.92.163
country_id: 1269750
description:
2025-12-10 07:52:03 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.92.163]:58032: 535 Incorrect authentication data (set_id=contactus@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.171.144
country_id: 6252001
description:
2025-12-10 07:52:17 dovecot_login authenticator failed for ([70.174.171.144]) [70.174.171.144]:37506: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-10 07:52:20 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:65472: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.18.224
country_id: 3996063
description:
Dec 10 07:53:00 host2 sshd[1870658]: Disconnected from invalid user webmin 201.124.18.224 port 40012 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.18.224
country_id: 3996063
description:
Dec 10 07:54:17 host2 sshd[1871869]: Disconnected from invalid user openstack 201.124.18.224 port 47442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2025-12-10 07:56:01 dovecot_login authenticator failed for 93-42-227-251.ip88.fastwebnet.it [93.42.227.251]:45342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-10 07:56:40 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:46350: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-10 07:56:51 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:47039: 535 Incorrect authentication data (set_id=contactus@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.254.5
country_id: 3996063
description:
2025-12-10 07:57:00 dovecot_login authenticator failed for ([189.219.254.5]) [189.219.254.5]:44002: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.62
country_id: 2186224
description:
2025-12-10 07:57:19 dovecot_login authenticator failed for ([121.73.162.62]) [121.73.162.62]:36356: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2025-12-10 07:57:26 dovecot_login authenticator failed for (nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:54928: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.65.255
country_id: 2750405
description:
Dec 10 07:57:51 host2 sshd[1874877]: Disconnected from invalid user user 157.245.65.255 port 51630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-10 07:57:08 dovecot_login authenticator failed for ([125.23.243.66]) [125.23.41.122]:46894: 535 Incorrect authentication data (set_id=contactus@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.57
country_id: 2635167
description:
Dec 10 07:57:17 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.57, lip=66.85.158.91, TLS, session=<0fZYxI9FcvAjy9M5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.18.224
country_id: 3996063
description:
Dec 10 07:58:51 host2 sshd[1875808]: Disconnected from invalid user oracle 201.124.18.224 port 41512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.161.11.213
country_id: 6251999
description:
Dec 10 07:59:14 host2 sshd[1876097]: Disconnected from invalid user u1 51.161.11.213 port 38834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Dec 10 07:59:20 host2 sshd[1876168]: Disconnected from invalid user ali 223.197.248.209 port 33713 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.57.49
country_id: 6252001
description:
Dec 10 07:59:26 host2 sshd[1876256]: Disconnected from invalid user rootuser 107.172.57.49 port 57702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Dec 10 07:59:52 host2 sshd[1876573]: Disconnected from invalid user mc2 67.10.185.103 port 35570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Dec 10 07:59:56 host2 sshd[1876607]: Disconnected from invalid user u1 103.154.77.48 port 42852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Dec 10 08:00:42 host2 sshd[1877382]: Disconnected from invalid user ubuntu 67.10.185.103 port 49032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Dec 10 08:01:48 host2 sshd[1878232]: Disconnected from invalid user xmr 103.154.77.48 port 50478 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 08:02:27 host2 sshd[1878788]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Dec 10 08:02:40 host2 sshd[1878906]: Disconnected from invalid user jose 67.10.185.103 port 59712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Dec 10 08:03:56 host2 sshd[1880445]: Disconnected from invalid user system 67.10.185.103 port 57406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-10 08:03:18 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (katemboss) [73.176.157.57]:42332: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 10 08:03:27 host2 sshd[1879924]: Disconnected from invalid user diquest 34.66.72.251 port 45752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Dec 10 08:03:41 host2 sshd[1880148]: Disconnected from invalid user ali 103.154.77.48 port 58116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 10 08:04:11 host2 sshd[1880710]: Disconnected from invalid user sftpuser 37.59.110.4 port 58096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Dec 10 08:04:26 host2 sshd[1880890]: Disconnected from invalid user ubuntu 154.144.225.226 port 33838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Dec 10 08:04:34 host2 sshd[1880966]: Disconnected from invalid user user 223.197.248.209 port 57110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.65.255
country_id: 2750405
description:
Dec 10 08:04:36 host2 sshd[1880983]: Disconnected from invalid user janusz 157.245.65.255 port 52490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 10 08:04:37 host2 sshd[1880993]: Disconnected from invalid user john 34.66.72.251 port 51374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.65.255
country_id: 2750405
description:
Dec 10 08:04:05 host2 sshd[1880636]: Disconnected from invalid user cron 157.245.65.255 port 50434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.65.255
country_id: 2750405
description:
Dec 10 08:05:40 host2 sshd[1881769]: Disconnected from invalid user dolphinscheduler 157.245.65.255 port 48314 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 10 08:05:43 host2 sshd[1881840]: Disconnected from invalid user user 34.66.72.251 port 45638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Dec 10 08:05:47 host2 sshd[1881867]: Disconnected from invalid user yxsong 223.197.248.209 port 41735 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.57.49
country_id: 6252001
description:
Dec 10 08:05:07 host2 sshd[1881438]: Disconnected from invalid user oem 107.172.57.49 port 45818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 08:05:09 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<j8do4I9FQtOqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-10 08:06:07 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:38279: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.216.245.138
country_id: 3469034
description:
Dec 10 08:06:18 host2 sshd[1882203]: Disconnected from invalid user test 186.216.245.138 port 19533 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.39.230
country_id: 3202326
description:
2025-12-10 08:06:26 dovecot_login authenticator failed for ([5.59.39.230]) [5.59.39.230]:35771: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-12-10 08:06:46 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:54949: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Dec 10 08:06:23 host2 sshd[1882251]: Disconnected from invalid user usuario1 154.144.225.226 port 55644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 10 08:06:46 host2 sshd[1882502]: Disconnected from invalid user oem 34.66.72.251 port 48178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.154.21
country_id: 2245662
description:
Dec 10 08:07:57 host2 sshd[1883428]: Disconnected from invalid user sftpuser 41.82.154.21 port 48156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-12-10 08:07:07 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:61510: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.57.49
country_id: 6252001
description:
Dec 10 08:07:14 host2 sshd[1882957]: Disconnected from invalid user macro 107.172.57.49 port 60918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 10 08:07:28 host2 sshd[1883076]: Disconnected from invalid user ubuntu 37.59.110.4 port 46746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 10 08:08:09 host2 sshd[1883597]: Disconnected from invalid user usuario1 37.59.110.4 port 39066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.161.11.213
country_id: 6251999
description:
Dec 10 08:08:15 host2 sshd[1883686]: Disconnected from invalid user xiaoli 51.161.11.213 port 49142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.57.49
country_id: 6252001
description:
Dec 10 08:08:22 host2 sshd[1883765]: Disconnected from invalid user user 107.172.57.49 port 44108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.216.245.138
country_id: 3469034
description:
Dec 10 08:08:41 host2 sshd[1883959]: Disconnected from invalid user sdadmin 186.216.245.138 port 20744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 10 08:08:58 host2 sshd[1884133]: Disconnected from invalid user ubuntu 196.92.7.249 port 33972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 08:09:16 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<xhoX749FuqyPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.161.11.213
country_id: 6251999
description:
Dec 10 08:09:25 host2 sshd[1884484]: Disconnected from invalid user yxsong 51.161.11.213 port 35070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-10 08:09:34 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:54987: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-10 08:10:04 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:32826: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.161.11.213
country_id: 6251999
description:
Dec 10 08:10:02 host2 sshd[1884972]: Disconnected from invalid user p 51.161.11.213 port 39388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-10 08:10:07 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:45223: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-10 08:10:26 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:58238: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-10 08:10:58 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:59694: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.154.21
country_id: 2245662
description:
Dec 10 08:10:19 host2 sshd[1885327]: Disconnected from invalid user taiko 41.82.154.21 port 33235 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-10 08:10:24 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:41346: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-12-10 08:10:26 dovecot_login authenticator failed for ([61.246.205.1]) [125.19.218.2]:34368: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-10 08:10:38 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:57653: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Dec 10 08:10:52 host2 sshd[1885994]: Disconnected from invalid user tommy 196.92.7.246 port 40836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-10 08:11:43 dovecot_plain authenticator failed for (gratic) [5.31.23.133]:53751: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-10 08:11:55 dovecot_plain authenticator failed for (nicof) [24.187.213.29]:39702: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.82.154.21
country_id: 2245662
description:
Dec 10 08:12:32 host2 sshd[1887712]: Disconnected from invalid user saeed 41.82.154.21 port 46544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-10 08:13:43 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:48692: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-10 08:13:55 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:40650: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 10 08:14:25 host2 sshd[1889428]: Disconnected from invalid user sysadmin 196.92.7.249 port 42284 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.12
country_id: 6252001
description:
Dec 10 08:14:59 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.12, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<o9WsA5BFU8qTuYQM>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 08:15:59 host2 sshd[1891077]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-10 08:15:28 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:60448: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-10 08:15:37 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:4688: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-10 08:15:41 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:54424: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Dec 10 08:15:02 host2 sshd[1890020]: Disconnected from invalid user wanghao 196.92.7.247 port 36958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-10 08:15:17 dovecot_login authenticator failed for ([182.95.228.110]) [182.95.228.110]:40992: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-10 08:16:41 dovecot_login authenticator failed for (dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:43994: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.92.7.247
country_id: 2542007
description:
Dec 10 08:16:18 host2 sshd[1891421]: Disconnected from invalid user saeed 196.92.7.247 port 44470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-10 08:17:50 dovecot_plain authenticator failed for (unciturs) [80.227.147.94]:54774: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Dec 10 08:17:31 host2 sshd[1892705]: Disconnected from invalid user alex 196.92.7.247 port 33908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Dec 10 08:18:07 host2 sshd[1893303]: Disconnected from invalid user sftpuser 196.92.7.249 port 47062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 08:19:19 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<mNIKE5BFnqyKxX03>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.104.186.210
country_id: 2802361
description:
[2025-12-10 08:21:24 +0530] info [webmaild] 185.104.186.210 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-10 08:21:59 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:59320: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-12-10 08:21:08 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:45554: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.36
country_id: 3175395
description:
Dec 10 08:22:46 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.15.169.36, lip=66.85.158.91, TLS, session=<T3ZpHpBFzJ65D6kk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 08:22:53 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<3EbJH5BFHIO8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-10 08:22:14 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:57476: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 08:22:24 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<z7UUHpBFeLeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-12-10 08:22:29 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:62708: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.210
country_id: 3865483
description:
Dec 10 08:23:09 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.250.210, lip=66.85.158.91, TLS, session=<pfGyH5BFqNmzAPrS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-10 08:24:42 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (colatioum) [217.215.74.195]:35795: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2025-12-10 08:24:48 dovecot_plain authenticator failed for cm-72-241-202-104.buckeyecom.net (metes) [72.241.202.104]:42530: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-10 08:26:55 dovecot_plain authenticator failed for (suilackg) [102.53.15.180]:24493: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-10 08:31:03 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:37097: 535 Incorrect authentication data (set_id=promo@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-10 08:31:14 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:44345: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 08:32:42 host2 sshd[1906104]: Disconnected from invalid user user 2.57.121.25 port 32436 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.22.151.143
country_id: 2802361
description:
Dec 10 08:33:40 host2 pure-ftpd[1907111]: (?@34.22.151.143) [INFO] New connection from 34.22.151.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-10 08:34:19 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (butomyarns) [98.40.101.10]:54886: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-10 08:34:58 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:64807: 535 Incorrect authentication data (set_id=promo@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-10 08:35:01 dovecot_login authenticator failed for ([103.67.152.201]) [103.67.152.201]:46866: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.108
country_id: 3624060
description:
2025-12-10 08:35:19 dovecot_login authenticator failed for ([186.177.88.108]) [186.177.88.108]:45479: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-12-10 08:35:18 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:38648: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-10 08:35:32 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:59912: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-10 08:35:34 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:34332: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-10 08:37:52 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (poraclunt) [73.88.196.91]:37082: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-10 08:39:17 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:36594: 535 Incorrect authentication data (set_id=promo@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-10 08:40:03 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:40183: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.70.118
country_id: 1168579
description:
2025-12-10 08:40:16 dovecot_login authenticator failed for ([115.42.70.118]) [115.42.70.118]:35843: 535 Incorrect authentication data (set_id=promo@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-10 08:40:20 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (oporad) [51.195.117.220]:31752: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-10 08:40:23 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:34210: 535 Incorrect authentication data (set_id=promo@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-10 08:40:36 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:32788: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-10 08:40:40 dovecot_plain authenticator failed for (slish) [102.53.15.180]:48346: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-10 08:40:42 dovecot_login authenticator failed for (cm-84.213.188.130.get.no) [84.213.188.130]:55783: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.112.224
country_id: 3865483
description:
Dec 10 08:42:45 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.110.112.224, lip=66.85.158.91, TLS, session=<LtjfZZBFyLe+bnDg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.85
country_id: 732800
description:
Dec 10 08:43:04 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=185.253.159.85, lip=66.85.158.91, TLS, session=<IX0TZ5BFxsy5/Z9V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.191.141.128
country_id: 1512440
description:
2025-12-10 08:43:54 dovecot_plain authenticator failed for (priblecul) [185.191.141.128]:55762: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.53.38.51
country_id: 6251999
description:
2025-12-10 08:44:33 dovecot_plain authenticator failed for (halope) [24.53.38.51]:54436: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-10 08:44:53 dovecot_login authenticator failed for (nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:33200: 535 Incorrect authentication data (set_id=promo@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 08:45:20 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 08:45:23 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<qhFDcJBFPr8XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.145
country_id: 2186224
description:
2025-12-10 08:45:39 dovecot_login authenticator failed for ([121.73.163.145]) [121.73.163.145]:40762: 535 Incorrect authentication data (set_id=promo@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.95
country_id: 6252001
description:
2025-12-10 08:45:12 dovecot_login authenticator failed for ([98.185.120.95]) [98.185.120.95]:40506: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-10 08:46:08 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:39213: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Dec 10 08:46:19 host2 sshd[1921158]: Disconnected from invalid user lily 202.152.201.166 port 53386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.180.32.104
country_id: 130758
description:
Dec 10 08:48:15 host2 sshd[1923053]: Disconnected from invalid user dspace 2.180.32.104 port 37920 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.152.201.166
country_id: 1643084
description:
Dec 10 08:48:25 host2 sshd[1923188]: Disconnected from invalid user devops 202.152.201.166 port 35420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.139
country_id: 1819730
description:
Dec 10 08:48:42 host2 sshd[1923401]: Disconnected from invalid user devops 101.36.122.139 port 57690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-10 08:48:59 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (callenthe) [73.168.136.150]:56054: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 08:49:45 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Dec 10 08:49:02 host2 sshd[1923660]: Disconnected from invalid user ubuntu 202.152.201.166 port 48254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 08:49:04 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (repenal) [96.230.65.90]:42388: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Dec 10 08:49:19 host2 sshd[1923889]: Disconnected from invalid user alex 160.202.8.218 port 51640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 08:49:28 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<SSjafpBFPKaqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.180.32.104
country_id: 130758
description:
Dec 10 08:50:31 host2 sshd[1924910]: Disconnected from invalid user msf 2.180.32.104 port 37836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Dec 10 08:50:21 host2 sshd[1924801]: Disconnected from invalid user adminer 202.152.201.166 port 45684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.139
country_id: 1819730
description:
Dec 10 08:51:13 host2 sshd[1925457]: Disconnected from invalid user chris 101.36.122.139 port 54736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.55.83.74
country_id: 718075
description:
Dec 10 08:51:21 host2 sshd[1925579]: Disconnected from invalid user ftp_user 92.55.83.74 port 50690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Dec 10 08:53:20 host2 sshd[1927150]: Disconnected from invalid user ubuntu 160.202.8.218 port 43980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.55.83.74
country_id: 718075
description:
Dec 10 08:54:26 host2 sshd[1928472]: Disconnected from invalid user ansible 92.55.83.74 port 33166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-10 08:54:48 dovecot_login authenticator failed for 24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:54466: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.95
country_id: 6252001
description:
2025-12-10 08:55:08 dovecot_login authenticator failed for ([98.185.120.95]) [98.185.120.95]:48460: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.223
country_id: 1643084
description:
Dec 10 08:55:09 host2 sshd[1929430]: Disconnected from invalid user alex 103.139.193.223 port 35496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.180.32.104
country_id: 130758
description:
Dec 10 08:55:54 host2 sshd[1930188]: Disconnected from invalid user training 2.180.32.104 port 48980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-10 08:56:21 dovecot_plain authenticator failed for (ulant) [64.72.74.162]:45301: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 08:56:40 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=</DScmJBF8KYXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.202.8.218
country_id: 1269750
description:
Dec 10 08:56:04 host2 sshd[1930358]: Disconnected from invalid user celery 160.202.8.218 port 53328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.72
country_id: 1880251
description:
Dec 10 08:57:25 host2 sshd[1931401]: Disconnected from invalid user celery 101.47.48.72 port 41156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.223
country_id: 1643084
description:
Dec 10 08:58:24 host2 sshd[1932254]: Disconnected from invalid user kube 103.139.193.223 port 50236 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.48.72
country_id: 1880251
description:
Dec 10 08:58:36 host2 sshd[1932363]: Disconnected from invalid user informix 101.47.48.72 port 38588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-10 08:58:52 dovecot_login authenticator failed for (nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:41246: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-10 08:59:06 dovecot_login authenticator failed for (industrianaval.fla.gvt.net.br) [187.58.66.231]:51808: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.55.83.74
country_id: 718075
description:
Dec 10 09:00:58 host2 sshd[1934410]: Disconnected from invalid user admin 92.55.83.74 port 50796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.223
country_id: 1643084
description:
Dec 10 09:01:48 host2 sshd[1935227]: Disconnected from invalid user prince 103.139.193.223 port 52954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-10 09:03:04 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (ationo) [196.47.172.253]:48165: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 09:03:08 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Z+zAr5BFvqGqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.72
country_id: 1880251
description:
Dec 10 09:03:11 host2 sshd[1936720]: Disconnected from invalid user alex 101.47.48.72 port 40928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-10 09:03:43 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:35784: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-10 09:04:23 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:35104: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-10 09:04:34 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:38454: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-10 09:04:53 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:59900: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-10 09:05:03 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:59100: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-12-10 09:05:30 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:4331: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.77.208
country_id: 3469034
description:
Dec 10 09:06:22 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=187.120.77.208, lip=66.85.158.91, TLS, session=<FaRLupBFo+y7eE3Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.143
country_id: 3469034
description:
Dec 10 09:06:43 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=186.209.249.143, lip=66.85.158.91, TLS, session=<ur6Qu5BFMJC60fmP>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 82.152.110.30
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 82.152.110.30: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.57.97.103
country_id: 2510769
description:
2025-12-10 09:09:50 dovecot_login authenticator failed for 103.red-83-57-97.dynamicip.rima-tde.net [83.57.97.103]:45617: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-12-10 09:10:04 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:51384: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.117.199.59
country_id: 433561
description:
2025-12-10 09:10:43 dovecot_login authenticator failed for ([154.117.199.59]) [154.117.199.59]:41092: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.81
country_id: 3624060
description:
2025-12-10 09:11:34 dovecot_login authenticator failed for ([186.177.88.81]) [186.177.88.81]:35614: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 09:12:19 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<h7CX0JBFTqePbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-10 09:13:11 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (parnflamy) [73.176.157.57]:40904: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-10 09:13:30 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (sphes) [96.230.65.90]:53586: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.99.249
country_id: 3469034
description:
Dec 10 09:14:27 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=45.227.99.249, lip=66.85.158.91, TLS, session=<lzI215BFl7gt42P5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.177.155.107
country_id: 2510769
description:
Dec 10 09:14:06 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=94.177.155.107, lip=66.85.158.91, TLS, session=<xVkb1pBF1tBesZtr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2025-12-10 09:15:46 dovecot_login authenticator failed for h95-155-228-189.cust.bredband2.com [95.155.228.189]:44651: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2025-12-10 09:16:07 dovecot_login authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:52206: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 09:16:06 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<QsYj3pBF7JqKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-10 09:16:07 dovecot_login authenticator failed for ([149.54.15.42]) [149.54.15.42]:32779: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.238.221.65
country_id: 3996063
description:
2025-12-10 09:16:32 dovecot_login authenticator failed for ([177.238.221.65]) [177.238.221.65]:57704: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.145.237.167
country_id: 6252001
description:
[2025-12-10 09:16:55 +0530] info [cpaneld] 192.145.237.167 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-10 09:18:51 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (aupled) [89.67.37.2]:59233: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec 10 09:19:10 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<77IZ6ZBFMqSKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-10 09:20:25 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:46429: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-10 09:20:08 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:60230: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-10 09:22:05 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:60196: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-10 09:22:08 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:49927: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-10 09:22:19 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:56981: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-10 09:22:31 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:46152: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-10 09:22:11 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:49110: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-10 09:22:21 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:63002: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-10 09:22:24 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (ferblain) [89.67.37.2]:46553: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-10 09:23:56 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:49648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.213.7.87
country_id: 6252001
description:
2025-12-10 09:24:56 dovecot_login authenticator failed for 87.sub-97-213-7.myvzw.com [97.213.7.87]:51536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-10 09:24:16 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:59347: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.231.50
country_id: 1269750
description:
2025-12-10 09:24:29 dovecot_login authenticator failed for ([182.95.85.109]) [125.19.231.50]:42602: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-10 09:24:29 dovecot_login authenticator failed for ([182.95.178.206]) [182.95.178.206]:39228: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-10 09:25:07 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (upers) [217.215.74.195]:37599: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-10 09:28:42 dovecot_login authenticator failed for (nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:45132: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.114
country_id: 6252001
description:
2025-12-10 09:28:42 dovecot_login authenticator failed for wsip-184-191-250-114.fv.ks.cox.net [184.191.250.114]:59280: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 09:28:46 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<t89yC5FF5Lm8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-10 09:29:10 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:43796: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-10 09:29:25 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:40348: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-10 09:29:48 dovecot_login authenticator failed for (30-170-97-62.cust.smartcall.no) [62.97.170.30]:42800: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-12-10 09:30:02 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:43044: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec 10 09:31:32 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<mh1KFZFFqNcXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-10 09:34:55 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:32891: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-12-10 09:35:21 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:48240: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-10 09:36:00 dovecot_login authenticator failed for (nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:34140: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.113.154.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.113.154.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.145.69.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.145.69.206 - ksoft "GET /login/?login_only=1&user=ksoft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.23.161.61
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 203.23.161.61 - ksof "GET /login/?login_only=1&user=ksof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.28.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.181.28.50 - kso "GET /login/?login_only=1&user=kso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.55.142.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.55.142.77 - ks "GET /login/?login_only=1&user=ks&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ks (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.144.63
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.128.144.63 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.47.5.224
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.47.5.224 - ksoftweblk "GET /login/?login_only=1&user=ksoftweblk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoftweblk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.2.140.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 100.2.140.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.97.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.4.97.121 - simpurity "GET /login/?login_only=1&user=simpurity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpurity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.166.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.166.130 - simpurit "GET /login/?login_only=1&user=simpurit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-10 09:37:18 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (tounflass) [73.199.161.144]:60294: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.224.139.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.224.139.72 - simpur "GET /login/?login_only=1&user=simpur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.45.153.96
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.45.153.96 - simpu "GET /login/?login_only=1&user=simpu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.72.178.179
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.72.178.179 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.60.180.131
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.60.180.131 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.136.42.227
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.136.42.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.3.199.248
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.3.199.248 - simpuritylk "GET /login/?login_only=1&user=simpuritylk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpuritylk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.174.5.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.174.5.218 - simpuri "GET /login/?login_only=1&user=simpuri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpuri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.33.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.202.33.238 - simp "GET /login/?login_only=1&user=simp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.22.99.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.22.99.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.239.116.61
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.239.116.61 - sim "GET /login/?login_only=1&user=sim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sim (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-10 09:40:00 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64548: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-10 09:42:35 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:7418: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.3.212.163
country_id: 3469034
description:
2025-12-10 09:42:42 dovecot_plain authenticator failed for ([89.116.164.85]) [187.3.212.163]:4498: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.74.211.157
country_id: 6252001
description:
2025-12-10 09:42:40 dovecot_plain authenticator failed for 138-74-211-157.aln01-oa01.aln.ne.allofiber.net ([89.116.164.85]) [138.74.211.157]:43100: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.249.48
country_id: 3469034
description:
2025-12-10 09:42:41 dovecot_plain authenticator failed for ([89.116.164.85]) [187.95.249.48]:19301: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.117.10.192
country_id: 3865483
description:
2025-12-10 09:42:45 dovecot_plain authenticator failed for ([89.116.164.85]) [181.117.10.192]:44102: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.200.183.164
country_id: 3686110
description:
2025-12-10 09:42:54 dovecot_plain authenticator failed for ([89.116.164.85]) [152.200.183.164]:47308: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.102.205
country_id: 3895114
description:
2025-12-10 09:42:54 dovecot_plain authenticator failed for ([89.116.164.85]) [45.170.102.205]:60655: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.184.113.247
country_id: 6252001
description:
2025-12-10 09:42:57 dovecot_plain authenticator failed for ([89.116.164.85]) [72.184.113.247]:58000: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.109.249
country_id: 99237
description:
2025-12-10 09:42:41 dovecot_plain authenticator failed for ([89.116.164.85]) [185.181.109.249]:50706: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.155.204.95
country_id: 3469034
description:
2025-12-10 09:42:42 dovecot_plain authenticator failed for ([89.116.164.85]) [177.155.204.95]:50272: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.169
country_id: 3658394
description:
2025-12-10 09:42:46 dovecot_plain authenticator failed for ([89.116.164.85]) [181.199.46.169]:43577: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.109.172.126
country_id: 3469034
description:
2025-12-10 09:42:52 dovecot_plain authenticator failed for ([89.116.164.85]) [179.109.172.126]:27666: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.147.46.79
country_id: 1694008
description:
2025-12-10 09:42:55 dovecot_plain authenticator failed for ([89.116.164.85]) [115.147.46.79]:54480: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.23.192.112
country_id: 3469034
description:
2025-12-10 09:43:00 dovecot_plain authenticator failed for ([89.116.164.85]) [187.23.192.112]:16943: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.1.128.41
country_id: 3686110
description:
2025-12-10 09:42:55 dovecot_plain authenticator failed for ([89.116.164.85]) [179.1.128.41]:57946: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.116.253.130
country_id: 3865483
description:
2025-12-10 09:42:56 dovecot_plain authenticator failed for ([89.116.164.85]) [181.116.253.130]:14906: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.25.28.156
country_id: 3865483
description:
2025-12-10 09:42:56 dovecot_plain authenticator failed for ([89.116.164.85]) [181.25.28.156]:56704: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.200.111
country_id: 3469034
description:
2025-12-10 09:42:56 dovecot_plain authenticator failed for ([89.116.164.85]) [131.0.200.111]:54235: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-10 09:42:51 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:33442: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.215.39.24
country_id: 3895114
description:
2025-12-10 09:42:41 dovecot_plain authenticator failed for pc-24-39-215-201.cm.vtr.net ([89.116.164.85]) [201.215.39.24]:35660: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.159.52.22
country_id: 1733045
description:
2025-12-10 09:42:42 dovecot_plain authenticator failed for ([89.116.164.85]) [110.159.52.22]:40238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.209.110.203
country_id: 3865483
description:
2025-12-10 09:42:43 dovecot_plain authenticator failed for ([89.116.164.85]) [181.209.110.203]:36881: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.253.160.205
country_id: 3686110
description:
2025-12-10 09:42:42 dovecot_plain authenticator failed for ([89.116.164.85]) [190.253.160.205]:59536: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.233.65.49
country_id: 298795
description:
2025-12-10 09:42:43 dovecot_plain authenticator failed for ([89.116.164.85]) [178.233.65.49]:18475: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.255.10.9
country_id: 3865483
description:
2025-12-10 09:42:55 dovecot_plain authenticator failed for ([89.116.164.85]) [132.255.10.9]:35721: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.255.181.210
country_id: 1522867
description:
2025-12-10 09:42:59 dovecot_plain authenticator failed for ([89.116.164.85]) [145.255.181.210]:36642: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.184.113.247
country_id: 6252001
description:
2025-12-10 09:43:04 dovecot_login authenticator failed for ([89.116.164.85]) [72.184.113.247]:58000: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.200.111
country_id: 3469034
description:
2025-12-10 09:43:03 dovecot_login authenticator failed for ([89.116.164.85]) [131.0.200.111]:54235: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.8.92
country_id: 3865483
description:
2025-12-10 09:43:06 dovecot_plain authenticator failed for ([89.116.164.85]) [181.46.8.92]:58688: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.255.181.210
country_id: 1522867
description:
2025-12-10 09:43:06 dovecot_login authenticator failed for ([89.116.164.85]) [145.255.181.210]:36642: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.23.192.112
country_id: 3469034
description:
2025-12-10 09:43:07 dovecot_login authenticator failed for ([89.116.164.85]) [187.23.192.112]:16943: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.227.93.253
country_id: 3658394
description:
2025-12-10 09:43:09 dovecot_plain authenticator failed for ([89.116.164.85]) [148.227.93.253]:8016: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.2.131
country_id: 3865483
description:
2025-12-10 09:43:09 dovecot_plain authenticator failed for ([89.116.164.85]) [200.105.2.131]:34668: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.25.28.156
country_id: 3865483
description:
2025-12-10 09:43:03 dovecot_login authenticator failed for ([89.116.164.85]) [181.25.28.156]:56704: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.106.34.17
country_id: 1861060
description:
2025-12-10 09:43:10 dovecot_plain authenticator failed for p6053018-ipoe.ipoe.ocn.ne.jp ([89.116.164.85]) [220.106.34.17]:38684: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.79.247.170
country_id: 3895114
description:
2025-12-10 09:43:11 dovecot_plain authenticator failed for 186-79-247-170.fo.baf.movistar.cl ([89.116.164.85]) [186.79.247.170]:40541: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.137.117.161
country_id: 3996063
description:
2025-12-10 09:43:11 dovecot_plain authenticator failed for ([89.116.164.85]) [189.137.117.161]:53336: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.76.19.203
country_id: 2510769
description:
2025-12-10 09:43:14 dovecot_plain authenticator failed for 203.19.76.188.dynamic.jazztel.es ([89.116.164.85]) [188.76.19.203]:5421: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.116.253.130
country_id: 3865483
description:
2025-12-10 09:43:03 dovecot_login authenticator failed for ([89.116.164.85]) [181.116.253.130]:14906: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.122.59.189
country_id: 3469034
description:
2025-12-10 09:43:09 dovecot_plain authenticator failed for ([89.116.164.85]) [187.122.59.189]:5022: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.61.71
country_id: 1733045
description:
2025-12-10 09:43:10 dovecot_plain authenticator failed for ([89.116.164.85]) [115.132.61.71]:33241: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.50.101.206
country_id: 3439705
description:
2025-12-10 09:43:13 dovecot_plain authenticator failed for r186-50-101-206.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.50.101.206]:33326: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-10 09:45:01 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:58551: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-10 09:44:55 dovecot_plain authenticator failed for (hativist) [81.0.54.119]:57715: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.43.227.113
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.43.227.113 - visionsolutionsho "GET /login/?login_only=1&user=visionsolutionsho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionsho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.199.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.50.199.18 - visionsolutio "GET /login/?login_only=1&user=visionsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.228.217.248
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 134.228.217.248 - visionsolu "GET /login/?login_only=1&user=visionsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.157.228.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.157.228.91 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.221.115.131
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.221.115.131 - visionsolutionshospital "GET /login/?login_only=1&user=visionsolutionshospital&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospital (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.137.202.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.137.202.64 - visionsolutionshospi "GET /login/?login_only=1&user=visionsolutionshospi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.134.203.149
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.134.203.149 - seya "GET /login/?login_only=1&user=seya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.33.104.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.33.104.230 - sey "GET /login/?login_only=1&user=sey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.199.63.170
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.199.63.170 - visionsolution "GET /login/?login_only=1&user=visionsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.149.34.194
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.149.34.194 - visionsoluti "GET /login/?login_only=1&user=visionsoluti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsoluti (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-10 09:45:37 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:41369: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.22.229.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.22.229.127 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.60.185.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.60.185.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.161.160.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.161.160.111 - seyawin "GET /login/?login_only=1&user=seyawin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.214.95.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.214.95.178 - visionsol "GET /login/?login_only=1&user=visionsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-10 09:45:28 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:55265: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.25.247.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.25.247.21 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.154.26.167
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 149.154.26.167 - visionsolutionshos "GET /login/?login_only=1&user=visionsolutionshos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.182.242.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.182.242.121 - seyaw "GET /login/?login_only=1&user=seyaw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyaw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.41.180.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.41.180.217 - visions "GET /login/?login_only=1&user=visions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.43.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.158.43.234 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.132.89.152
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.132.89.152 - visionso "GET /login/?login_only=1&user=visionso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.122.180.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.122.180.160 - visionsolutionshospitalcom "GET /login/?login_only=1&user=visionsolutionshospitalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospitalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.231.240.25
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.231.240.25 - visionsolutionshosp "GET /login/?login_only=1&user=visionsolutionshosp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshosp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.82.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.148.82.180 - visionsolut "GET /login/?login_only=1&user=visionsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.16.86.190
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.16.86.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.205.85.137
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.205.85.137 - seyawi "GET /login/?login_only=1&user=seyawi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.174.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.40.174.133 - se "GET /login/?login_only=1&user=se&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user se (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.31.173.14
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.31.173.14 - visionsolutionsh "GET /login/?login_only=1&user=visionsolutionsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.22.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.149.22.67 - visionsolutions "GET /login/?login_only=1&user=visionsolutions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.196.143.211
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 142.196.143.211 - seyawincom "GET /login/?login_only=1&user=seyawincom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawincom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.117.174.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.117.174.73 - vision "GET /login/?login_only=1&user=vision&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vision (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.220.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.152.220.11 - visio "GET /login/?login_only=1&user=visio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.197.123.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.197.123.143 - visi "GET /login/?login_only=1&user=visi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.19.59.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.19.59.17 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.64.140.161
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 139.64.140.161 - vis "GET /login/?login_only=1&user=vis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.51.65.232
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.51.65.232 - visions2 "GET /login/?login_only=1&user=visions2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.41.206.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.41.206.65 - visions1 "GET /login/?login_only=1&user=visions1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 09:47:29 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<HltVTpFFaq6qQMFo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.115.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.115.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.130.79
country_id: 2077456
description:
2025-12-10 09:49:00 dovecot_login authenticator failed for (61-69-130-79.static.tpgi.com.au) [61.69.130.79]:35927: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.180.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.7.180.252 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.86.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.86.250 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.48.128.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.48.128.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.78.225.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.78.225.209 - ksoftlk "GET /login/?login_only=1&user=ksoftlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoftlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.51.46.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.51.46.21 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.207.198.158
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.207.198.158 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.42.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.226.42.230 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.227.92.236
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.227.92.236 - ksoft "GET /login/?login_only=1&user=ksoft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.228.119.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.228.119.91 - kso "GET /login/?login_only=1&user=kso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.166.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.37.166.143 - ksof "GET /login/?login_only=1&user=ksof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.62.122
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.224.62.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.163.39.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.163.39.252 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.123.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.44.123.126 - ks "GET /login/?login_only=1&user=ks&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ks (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.17.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.158.17.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2025-12-10 09:49:14 dovecot_login authenticator failed for ([103.111.6.121]) [103.111.6.121]:46385: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-10 09:54:06 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:44584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-10 09:54:28 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:32778: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-10 09:54:27 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:49526: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-12-10 09:54:51 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:60218: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 09:55:47 host2 sshd[1989969]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.238.192.73
country_id: 6252001
description:
[2025-12-10 09:55:42 +0530] info [cpaneld] 73.238.192.73 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.18.29
country_id: 6252001
description:
[2025-12-10 09:55:43 +0530] info [cpaneld] 74.105.18.29 - ceylondigest "GET /login/?login_only=1&user=ceylondigest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.127.48.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.127.48.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.185.88.99
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.185.88.99 - askinternationalco "GET /login/?login_only=1&user=askinternationalco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.106.47.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.106.47.130 - askinternati "GET /login/?login_only=1&user=askinternati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.130.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.130.92 - askin "GET /login/?login_only=1&user=askin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.106.236.223
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.106.236.223 - ask "GET /login/?login_only=1&user=ask&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ask (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.134.15.211
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 135.134.15.211 - aski "GET /login/?login_only=1&user=aski&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aski (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.140.34.189
country_id: 6252001
description:
[2025-12-10 09:55:50 +0530] info [cpaneld] 74.140.34.189 - ceylondige "GET /login/?login_only=1&user=ceylondige&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondige (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.72.132.143
country_id: 6252001
description:
[2025-12-10 09:55:53 +0530] info [cpaneld] 198.72.132.143 - ceylondig "GET /login/?login_only=1&user=ceylondig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.88.169.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.88.169.24 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.206.247.25
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.206.247.25 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.231.116.249
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.231.116.249 - askinte1 "GET /login/?login_only=1&user=askinte1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.162.30.215
country_id: 6252001
description:
[2025-12-10 09:55:49 +0530] info [cpaneld] 24.162.30.215 - ceylondiges "GET /login/?login_only=1&user=ceylondiges&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondiges (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.145.166
country_id: 6252001
description:
[2025-12-10 09:55:55 +0530] info [cpaneld] 45.50.145.166 - ceylondi "GET /login/?login_only=1&user=ceylondi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.111.150.140
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.111.150.140 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.133.182.2
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.133.182.2 - askinternat "GET /login/?login_only=1&user=askinternat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.172.13.106
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.172.13.106 - askint "GET /login/?login_only=1&user=askint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.220.110.173
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.220.110.173 - askinte "GET /login/?login_only=1&user=askinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.81.224.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.81.224.176 - askinternationalconsortium "GET /login/?login_only=1&user=askinternationalconsortium&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalconsortium (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.191.141.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.191.141.208 - askinternationalconsortiumcom "GET /login/?login_only=1&user=askinternationalconsortiumcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalconsortiumcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.58.87.241
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.58.87.241 - askinternationalcons "GET /login/?login_only=1&user=askinternationalcons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalcons (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.120.152.19
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.120.152.19 - askinternational "GET /login/?login_only=1&user=askinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.150.204.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.150.204.219 - askinternationa "GET /login/?login_only=1&user=askinternationa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.70.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.136.70.24 - askintern "GET /login/?login_only=1&user=askintern&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askintern (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.209.51.91
country_id: 6252001
description:
[2025-12-10 09:55:56 +0530] info [cpaneld] 97.209.51.91 - ceylond "GET /login/?login_only=1&user=ceylond&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.16.214.14
country_id: 6252001
description:
[2025-12-10 09:56:02 +0530] info [cpaneld] 76.16.214.14 - cey "GET /login/?login_only=1&user=cey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.51.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.147.51.237 - askinternationalc "GET /login/?login_only=1&user=askinternationalc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.226.11.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.226.11.134 - askinternation "GET /login/?login_only=1&user=askinternation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.90.230.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.90.230.151 - askinter "GET /login/?login_only=1&user=askinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.102.43.68
country_id: 6252001
description:
[2025-12-10 09:55:42 +0530] info [cpaneld] 97.102.43.68 - askinte2 "GET /login/?login_only=1&user=askinte2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.173.229.17
country_id: 6252001
description:
[2025-12-10 09:55:48 +0530] info [cpaneld] 104.173.229.17 - ceylondigestcom "GET /login/?login_only=1&user=ceylondigestcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondigestcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.238.67
country_id: 6252001
description:
[2025-12-10 09:55:46 +0530] info [whostmgrd] 76.33.238.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.151.189.221
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.151.189.221 - askinterna "GET /login/?login_only=1&user=askinterna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinterna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.199.139.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.199.139.50 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-10 09:55:48 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:60352: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.88.133.84
country_id: 6252001
description:
[2025-12-10 09:56:01 +0530] info [cpaneld] 73.88.133.84 - ceyl "GET /login/?login_only=1&user=ceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.29.189.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.29.189.138 - askinternationalcon "GET /login/?login_only=1&user=askinternationalcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalcon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.146.244.125
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.146.244.125 - askinternatio "GET /login/?login_only=1&user=askinternatio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternatio (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.72
country_id: 3996063
description:
2025-12-10 09:55:58 dovecot_login authenticator failed for ([177.236.144.72]) [177.236.144.72]:47472: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.254.254.239
country_id: 6252001
description:
[2025-12-10 09:55:57 +0530] info [cpaneld] 216.254.254.239 - ceylon "GET /login/?login_only=1&user=ceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.191.49
country_id: 6252001
description:
[2025-12-10 09:56:00 +0530] info [cpaneld] 143.105.191.49 - ceylo "GET /login/?login_only=1&user=ceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.11.9.149
country_id: 6252001
description:
[2025-12-10 09:56:10 +0530] info [cpaneld] 75.11.9.149 - ceylond2 "GET /login/?login_only=1&user=ceylond2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.120.233.99
country_id: 6252001
description:
[2025-12-10 09:56:03 +0530] info [cpaneld] 73.120.233.99 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.184.157.31
country_id: 6252001
description:
[2025-12-10 09:56:07 +0530] info [cpaneld] 47.184.157.31 - ceylond1 "GET /login/?login_only=1&user=ceylond1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 10 09:57:15 host2 sshd[1991707]: Disconnected from invalid user user 2.57.121.25 port 7852 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.61.74.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.61.74.51 - ajsstarlog "GET /login/?login_only=1&user=ajsstarlog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.201.132
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.51.201.132 - ajsstarl "GET /login/?login_only=1&user=ajsstarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.162.132.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 165.162.132.31 - ajssta "GET /login/?login_only=1&user=ajssta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.196.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.196.65 - ajsst "GET /login/?login_only=1&user=ajsst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.44.43.168
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.44.43.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.232.204.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.232.204.210 - ajsstarlogcom "GET /login/?login_only=1&user=ajsstarlogcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarlogcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.2.174
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.2.174 - ajsstarlo "GET /login/?login_only=1&user=ajsstarlo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarlo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.19.124
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.149.19.124 - ajs "GET /login/?login_only=1&user=ajs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajs (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.64.165
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.44.64.165 - aj "GET /login/?login_only=1&user=aj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.216.97.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.216.97.116 - ajsstar2 "GET /login/?login_only=1&user=ajsstar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.72.181.117
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.72.181.117 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.86.204.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.86.204.143 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.207.85.125
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.207.85.125 - ajsstar "GET /login/?login_only=1&user=ajsstar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.187.52
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.44.187.52 - ajss "GET /login/?login_only=1&user=ajss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.87.72.220
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.87.72.220 - ajsstar1 "GET /login/?login_only=1&user=ajsstar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-12-10 10:00:32 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:36526: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 10:01:25 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<4BErgJFFXsSqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-10 10:01:58 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:47579: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-10 10:02:14 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:35328: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 10 10:03:06 host2 sshd[1997380]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 52690


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-10 10:05:46 dovecot_plain authenticator failed for (renescar) [24.93.140.162]:51603: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.31.64.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.31.64.163 - maximsholdingscom "GET /login/?login_only=1&user=maximsholdingscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.55.108.9
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.55.108.9 - maximshol "GET /login/?login_only=1&user=maximshol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximshol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.143.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.49.143.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.171.8.189
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.171.8.189 - cloudtourssrila "GET /login/?login_only=1&user=cloudtourssrila&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrila (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.30.236.152
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.30.236.152 - cloudtourssril "GET /login/?login_only=1&user=cloudtourssril&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssril (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.250.139.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 130.250.139.243 - maximsholdin "GET /login/?login_only=1&user=maximsholdin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.3.38.94
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.3.38.94 - maximsh "GET /login/?login_only=1&user=maximsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.12.30.173
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.12.30.173 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.178.237.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.178.237.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.83.26.71
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.83.26.71 - cloudtourssrilank "GET /login/?login_only=1&user=cloudtourssrilank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.234.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.157.234.127 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.217.151.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.217.151.102 - maximsh2 "GET /login/?login_only=1&user=maximsh2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.153.233.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.153.233.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-10 10:06:27 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (bruls) [73.137.7.97]:45324: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.85.200.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.85.200.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.78.179.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.78.179.29 - cloudtourssrilanka "GET /login/?login_only=1&user=cloudtourssrilanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilanka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.180.164
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.41.180.164 - cloudtourssrilankacom "GET /login/?login_only=1&user=cloudtourssrilankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.162.70.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.162.70.225 - cloudtourssrilan "GET /login/?login_only=1&user=cloudtourssrilan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.171.84.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.171.84.208 - maximsholdings "GET /login/?login_only=1&user=maximsholdings&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.209.102.118
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.209.102.118 - maximsho "GET /login/?login_only=1&user=maximsho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.193.155.112
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.193.155.112 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.194.87.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.194.87.45 - maximsholding "GET /login/?login_only=1&user=maximsholding&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholding (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.112.190.69
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.112.190.69 - maximsholdi "GET /login/?login_only=1&user=maximsholdi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.156.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.66.156.17 - maximshold "GET /login/?login_only=1&user=maximshold&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximshold (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.9.17.8
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.9.17.8 - max "GET /login/?login_only=1&user=max&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user max (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.215.6.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 134.215.6.7 - cloudtourssri "GET /login/?login_only=1&user=cloudtourssri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.108.57.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.108.57.163 - maxims "GET /login/?login_only=1&user=maxims&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maxims (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.104.173.14
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.104.173.14 - cloudtourssr "GET /login/?login_only=1&user=cloudtourssr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.238.51.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.238.51.239 - cloudtourss "GET /login/?login_only=1&user=cloudtourss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.244.96.44
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.244.96.44 - maxi "GET /login/?login_only=1&user=maxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maxi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.124.85.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.124.85.202 - maximsh1 "GET /login/?login_only=1&user=maximsh1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.249.233.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.249.233.207 - cloudt "GET /login/?login_only=1&user=cloudt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.228.108.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.228.108.34 - clou "GET /login/?login_only=1&user=clou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.30.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.30.188 - cloudto1 "GET /login/?login_only=1&user=cloudto1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.180.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.41.180.64 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.117.19.149
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.117.19.149 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.140.155.22
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.140.155.22 - jr "GET /login/?login_only=1&user=jr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.230.79.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.230.79.36 - cloudtours "GET /login/?login_only=1&user=cloudtours&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtours (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.77.220.188
country_id: 203312
description:
Dec 10 10:07:41 host2 sshd[2002970]: Disconnected from invalid user dockeradmin 41.77.220.188 port 48928 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.157.164.244
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.157.164.244 - jrdc "GET /login/?login_only=1&user=jrdc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrdc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.147.179.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.147.179.10 - jrdclk "GET /login/?login_only=1&user=jrdclk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.95.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.151.95.80 - cloudtour "GET /login/?login_only=1&user=cloudtour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtour (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.46.243.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.46.243.56 - cloud "GET /login/?login_only=1&user=cloud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloud (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.202.116.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.202.116.160 - clo "GET /login/?login_only=1&user=clo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.50.184.141
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.50.184.141 - cl "GET /login/?login_only=1&user=cl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.22.220.213
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.22.220.213 - cloudto2 "GET /login/?login_only=1&user=cloudto2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.2.187.170
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.2.187.170 - cloudto "GET /login/?login_only=1&user=cloudto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.145.44.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.145.44.176 - cloudtou "GET /login/?login_only=1&user=cloudtou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.231.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.147.231.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.153.232.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.153.232.203 - jrd "GET /login/?login_only=1&user=jrd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrd (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a0e:97c0:3ea:402::1
country_id: 3042058
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2a0e:97c0:3ea:402::1 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 10 10:09:24 host2 sshd[2004763]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-10 10:11:12 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:35837: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-12-10 10:11:25 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:45632: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.23.113
country_id: 6252001
description:
[2025-12-10 10:17:05 +0530] info [cpaneld] 172.251.23.113 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.3.200.174
country_id: 6252001
description:
[2025-12-10 10:16:48 +0530] info [cpaneld] 160.3.200.174 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-10 10:16:52 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:54888: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.91.232.151
country_id: 6252001
description:
[2025-12-10 10:16:52 +0530] info [whostmgrd] 76.91.232.151 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.191.109.214
country_id: 6252001
description:
[2025-12-10 10:16:59 +0530] info [cpaneld] 24.191.109.214 - anandaoba "GET /login/?login_only=1&user=anandaoba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaoba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.178.123.9
country_id: 6252001
description:
[2025-12-10 10:17:02 +0530] info [cpaneld] 76.178.123.9 - ananda "GET /login/?login_only=1&user=ananda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ananda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.140.11.113
country_id: 6252001
description:
[2025-12-10 10:17:03 +0530] info [cpaneld] 76.140.11.113 - anand "GET /login/?login_only=1&user=anand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 205.178.64.74
country_id: 6252001
description:
[2025-12-10 10:16:53 +0530] info [cpaneld] 205.178.64.74 - anandaobauaeorg "GET /login/?login_only=1&user=anandaobauaeorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauaeorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.31.57.22
country_id: 6252001
description:
[2025-12-10 10:16:54 +0530] info [cpaneld] 76.31.57.22 - anandaobaua "GET /login/?login_only=1&user=anandaobaua&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobaua (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2025-12-10 10:17:02 dovecot_login authenticator failed for ([78.197.6.173]) [78.197.6.173]:64610: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.86.96.26
country_id: 6252001
description:
[2025-12-10 10:17:13 +0530] info [cpaneld] 75.86.96.26 - anandao1 "GET /login/?login_only=1&user=anandao1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.93.78.213
country_id: 6252001
description:
[2025-12-10 10:17:14 +0530] info [cpaneld] 76.93.78.213 - anandao2 "GET /login/?login_only=1&user=anandao2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.240.52.38
country_id: 6252001
description:
[2025-12-10 10:16:51 +0530] info [cpaneld] 67.240.52.38 - anandaobauae "GET /login/?login_only=1&user=anandaobauae&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauae (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.179.103
country_id: 6252001
description:
[2025-12-10 10:16:56 +0530] info [cpaneld] 169.150.179.103 - anandaobau "GET /login/?login_only=1&user=anandaobau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.36.23.84
country_id: 6252001
description:
[2025-12-10 10:17:00 +0530] info [cpaneld] 98.36.23.84 - anandaob "GET /login/?login_only=1&user=anandaob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.171.23.87
country_id: 6252001
description:
[2025-12-10 10:17:04 +0530] info [cpaneld] 66.171.23.87 - anan "GET /login/?login_only=1&user=anan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anan (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-12-10 10:17:10 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:56468: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.132.179
country_id: 6252001
description:
[2025-12-10 10:16:50 +0530] info [cpaneld] 76.32.132.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.10.164.153
country_id: 6252001
description:
[2025-12-10 10:17:01 +0530] info [cpaneld] 172.10.164.153 - anandao "GET /login/?login_only=1&user=anandao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.38.22.192
country_id: 6252001
description:
[2025-12-10 10:17:06 +0530] info [cpaneld] 47.38.22.192 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-10 10:17:10 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:55498: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2025-12-10 10:17:25 dovecot_login authenticator failed for dsl-212-135-208-13.dsl.easynet.co.uk [212.135.208.13]:38828: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 10 10:18:58 host2 dovecot[1766329]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=<wWEWv5FFEKks3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-12-10 10:20:02 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:42125: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-10 10:20:15 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:53500: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.36
country_id: 3996063
description:
2025-12-10 10:21:17 dovecot_login authenticator failed for (189.219.138.36-clientes-izzi.mx) [189.219.138.36]:41408: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-12-10 10:21:31 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:59772: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-10 10:20:45 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:33135: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.150
country_id: 1694008
description:
2025-12-10 10:21:00 dovecot_login authenticator failed for ([124.105.219.170]) [124.105.218.150]:51458: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 10 10:21:57 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=</DPCyZFFmqos3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-10 10:22:51 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (proty) [24.98.45.238]:34810: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.90.173.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.90.173.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.46.25.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.46.25.133 - asrgroup "GET /login/?login_only=1&user=asrgroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.242.94.0
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.242.94.0 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.131.115
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 74.244.131.115 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.81.161.152
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.81.161.152 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.232.134.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.232.134.145 - asrgrou "GET /login/?login_only=1&user=asrgrou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.133.78.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.133.78.196 - asrgrouplk "GET /login/?login_only=1&user=asrgrouplk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrouplk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.101.2.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.101.2.252 - asrgr "GET /login/?login_only=1&user=asrgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.213.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.213.160 - asrgro "GET /login/?login_only=1&user=asrgro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.250.229.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.250.229.79 - asr "GET /login/?login_only=1&user=asr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.15.56.130
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.15.56.130 - asrg "GET /login/?login_only=1&user=asrg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrg (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-10 10:26:05 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:42138: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-10 10:25:49 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:38586: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-10 10:27:07 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:60578: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-10 10:26:48 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:35816: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-10 10:26:55 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (hamudien) [69.142.126.37]:33618: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 10 10:28:58 host2 sshd[2026561]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 65182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-10 10:30:43 dovecot_plain authenticator failed for (avachanita) [88.207.210.23]:61801: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-10 10:32:28 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (cravintion) [68.40.189.43]:40892: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-10 10:33:50 dovecot_plain authenticator failed for (refaluscip) [5.11.140.219]:34418: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 10 10:36:09 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<zPln/JFFgNm8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-10 10:36:23 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:55300: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.111
country_id: 3996063
description:
2025-12-10 10:36:43 dovecot_login authenticator failed for (201.173.97.111-clientes-izzi.mx) [201.173.97.111]:41885: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:37:20 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<7ojBAJJF6OcDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-10 10:37:40 dovecot_plain authenticator failed for (crifies) [154.144.243.93]:39164: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.70.74.154
country_id: 3469034
description:
Dec 10 10:39:21 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=177.70.74.154, lip=66.85.158.91, TLS, session=<qDvgBpJFltSxRkqa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.234
country_id: 6252001
description:
Dec 10 10:39:58 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.234, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<H/QyCpJFkMOTuYXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-10 10:40:13 dovecot_plain authenticator failed for (korulgena) [75.97.190.237]:55032: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.140.192
country_id: 357994
description:
2025-12-10 10:40:23 dovecot_login authenticator failed for ([41.65.118.172]) [41.239.140.192]:58952: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.60
country_id: 798544
description:
Dec 10 10:39:40 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=91.228.33.60, lip=66.85.158.91, TLS, session=<aRgUCJJFhNZb5CE8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:41:32 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<pZ/JD5JFep4Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.234
country_id: 6252001
description:
Dec 10 10:40:47 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=147.185.133.234, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<7X0TDZJFuuiTuYXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-10 10:40:54 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:38291: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 10:41:05 host2 sshd[2040779]: Disconnected from invalid user admin 2.57.121.112 port 16108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:42:20 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<6GCgEpJFWp4Dg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:42:28 host2 dovecot[1766329]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<x1kjE5JFhJ4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-10 10:42:59 dovecot_plain authenticator failed for (vioged) [41.248.243.181]:47916: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-10 10:45:29 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:60334: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.206
country_id: 1269750
description:
2025-12-10 10:45:20 dovecot_login authenticator failed for ([182.95.63.206]) [182.95.63.206]:52110: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-10 10:46:07 dovecot_login authenticator failed for ([182.95.229.38]) [182.95.229.38]:39714: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-10 10:46:31 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:45528: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec 10 10:45:38 host2 dovecot[1766329]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<PJZzHpJFkJ8Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-10 10:45:46 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:57304: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-10 10:46:48 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:37372: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 10:46:49 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<FGuUIpJFUpiqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.234
country_id: 6252001
description:
Dec 10 10:47:25 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.234, lip=66.85.158.92, TLS, session=<nLHNJJJF+uuTuYXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-10 10:48:12 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (matidneped) [73.213.236.66]:36324: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 10 10:48:31 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<gv7BKJJFFJyLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.157
country_id: 3865483
description:
Dec 10 10:49:28 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.122.133.157, lip=66.85.158.91, TLS, session=<MnP+KpJFmqK+eoWd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.154
country_id: 3865483
description:
Dec 10 10:49:50 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.124.218.154, lip=66.85.158.91, TLS, session=<GmVMLJJFkpa6fNqa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2025-12-10 10:51:47 dovecot_login authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:65338: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-10 10:52:16 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:47848: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-10 10:52:23 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:59220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-12-10 10:52:43 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:51408: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 10 10:54:37 host2 sshd[2054350]: Disconnected from invalid user admin 2.57.121.112 port 58699 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.112.215
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.2.112.215 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.37.199.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.37.199.135 - systemteclk "GET /login/?login_only=1&user=systemteclk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemteclk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.204.190.241
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.204.190.241 - kamechote "GET /login/?login_only=1&user=kamechote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.36.65.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.36.65.24 - syste "GET /login/?login_only=1&user=syste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user syste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.242.129.136
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.242.129.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.214.228
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.214.228 - kamechotech "GET /login/?login_only=1&user=kamechotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.83.68.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.83.68.116 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.55.150.82
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.55.150.82 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.205.229.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.205.229.10 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.186.54.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.186.54.60 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.33.12.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.33.12.73 - systemte "GET /login/?login_only=1&user=systemte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.157.240.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.157.240.31 - systemt "GET /login/?login_only=1&user=systemt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.142.14.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.142.14.177 - system "GET /login/?login_only=1&user=system&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user system (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.244.27.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.244.27.50 - kamechotechcom "GET /login/?login_only=1&user=kamechotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.21.124.156
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.21.124.156 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.92.152.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.92.152.212 - systemtec "GET /login/?login_only=1&user=systemtec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemtec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.140.79.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.140.79.243 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 10 10:58:12 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<1cJmS5JFIpg2rEyT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.180.189
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.176.180.189 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.166.143.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.166.143.18 - kamechotec "GET /login/?login_only=1&user=kamechotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.58.147.227
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.58.147.227 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.164.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.164.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.50.140.198
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.50.140.198 - syst "GET /login/?login_only=1&user=syst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user syst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.150.221
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.15.150.221 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.230.109.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.230.109.55 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.252.218.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.252.218.145 - kamechot "GET /login/?login_only=1&user=kamechot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.159.235
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.194.159.235 - kamecho1 "GET /login/?login_only=1&user=kamecho1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.180.246.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.180.246.135 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.26.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.171.26.13 - kamecho2 "GET /login/?login_only=1&user=kamecho2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec 10 11:00:52 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Hf/HVJJFjoeqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.16
country_id: 6252001
description:
2025-12-10 11:02:20 dovecot_login authenticator failed for ([98.181.44.16]) [98.181.44.16]:49547: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-10 11:03:18 dovecot_login authenticator failed for ([94.207.251.240]) [94.207.251.240]:42587: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.61.226.85
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.61.226.85 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.107.171.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.107.171.91 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.172.214.9
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.172.214.9 - saaralk "GET /login/?login_only=1&user=saaralk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saaralk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.15.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.15.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.236
country_id: 3469034
description:
Dec 10 11:04:56 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.89.137.236, lip=66.85.158.91, TLS, session=<HWdoYpJFlc6+WYns>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.100
country_id: 3469034
description:
Dec 10 11:05:16 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=177.44.96.100, lip=66.85.158.91, TLS, session=<i8SWY5JFbtmxLGBk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.238.5.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.238.5.138 - saar "GET /login/?login_only=1&user=saar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.94.239.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.94.239.21 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.66.242.74
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.66.242.74 - saara "GET /login/?login_only=1&user=saara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.59.158
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.151.59.158 - saa "GET /login/?login_only=1&user=saa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-10 11:06:33 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:57626: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.77.225.4
country_id: 798549
description:
2025-12-10 11:06:03 dovecot_plain authenticator failed for (6LCBR6) [82.77.225.4]:64782: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2025-12-10 11:06:50 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:35032: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.191.197.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.191.197.250 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.23.190.112
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.23.190.112 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.107.61.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.107.61.11 - essenceceylo "GET /login/?login_only=1&user=essenceceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.50.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.226.50.7 - essence1 "GET /login/?login_only=1&user=essence1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.7.176.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.7.176.188 - essenceceylonteacom "GET /login/?login_only=1&user=essenceceylonteacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylonteacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.81.162.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.81.162.178 - essencecey "GET /login/?login_only=1&user=essencecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.25.1
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.181.25.1 - essenceceyl "GET /login/?login_only=1&user=essenceceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.141.197
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.62.141.197 - essencece "GET /login/?login_only=1&user=essencece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.63.33.44
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.63.33.44 - ess "GET /login/?login_only=1&user=ess&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ess (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.101.67.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.101.67.145 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.129.96.157
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.129.96.157 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.79.175.58
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.79.175.58 - essenceceylontea "GET /login/?login_only=1&user=essenceceylontea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User essenceceylontea has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.112.206.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.112.206.208 - essenceceylont "GET /login/?login_only=1&user=essenceceylont&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylont (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.147.185.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.147.185.234 - essenc "GET /login/?login_only=1&user=essenc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.248.99.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.248.99.237 - essence2 "GET /login/?login_only=1&user=essence2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.234.44.91
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.234.44.91 - essenceceylonte "GET /login/?login_only=1&user=essenceceylonte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylonte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.146.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.175.146.64 - essenceceylon "GET /login/?login_only=1&user=essenceceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.94.66.49
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.94.66.49 - essencec "GET /login/?login_only=1&user=essencec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.180.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.241.180.53 - essence "GET /login/?login_only=1&user=essence&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.181.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.128.181.206 - esse "GET /login/?login_only=1&user=esse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.172.197.168
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.172.197.168 - essen "GET /login/?login_only=1&user=essen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essen (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.132.164.17
country_id: 2635167
description:
Dec 10 11:10:08 host2 sshd[2073622]: Disconnected from invalid user surubu 23.132.164.17 port 55870 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-10 11:09:41 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (frevellars) [73.213.237.28]:55316: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-10 11:12:06 dovecot_login authenticator failed for ([46.212.35.53]) [46.212.35.53]:41373: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-10 11:12:11 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:53316: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-10 11:12:27 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:54577: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-10 11:11:47 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:48693: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-10 11:13:06 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:40614: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-10 11:13:31 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:60697: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-10 11:12:58 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (submon) [2.135.31.74]:40213: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.72.2
country_id: 690791
description:
Dec 10 11:15:20 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=194.44.72.2, lip=66.85.158.91, TLS, session=<9LCRh5JFmcHCLEgC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.139.20
country_id: 690791
description:
Dec 10 11:15:43 host2 dovecot[1766329]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=37.221.139.20, lip=66.85.158.91, TLS, session=<ti/DiJJF9rEl3YsU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.117.92
country_id: 6252001
description:
[2025-12-10 11:16:53 +0530] info [cpaneld] 184.164.117.92 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.138.205.200
country_id: 6252001
description:
[2025-12-10 11:16:54 +0530] info [cpaneld] 64.138.205.200 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.206.219.35
country_id: 6252001
description:
[2025-12-10 11:17:06 +0530] info [cpaneld] 98.206.219.35 - neo "GET /login/?login_only=1&user=neo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.16.204.178
country_id: 6252001
description:
[2025-12-10 11:16:57 +0530] info [whostmgrd] 24.16.204.178 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 10 11:17:03 host2 sshd[2081983]: Disconnected from invalid user  62.60.131.157 port 65016 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.97.216.156
country_id: 6252001
description:
[2025-12-10 11:17:03 +0530] info [cpaneld] 97.97.216.156 - neote "GET /login/?login_only=1&user=neote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.164.138.173
country_id: 6252001
description:
[2025-12-10 11:17:07 +0530] info [cpaneld] 47.164.138.173 - ne "GET /login/?login_only=1&user=ne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ne (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.145.135
country_id: 798544
description:
Dec 10 11:17:34 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=78.31.145.135, lip=66.85.158.91, TLS, session=<MNl0j5JFgeVOH5GH>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.118.67.85
country_id: 6252001
description:
[2025-12-10 11:16:55 +0530] info [cpaneld] 23.118.67.85 - neotechlk "GET /login/?login_only=1&user=neotechlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.72.199.225
country_id: 6252001
description:
[2025-12-10 11:17:00 +0530] info [cpaneld] 198.72.199.225 - neotech "GET /login/?login_only=1&user=neotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.183.26
country_id: 6252001
description:
[2025-12-10 11:16:59 +0530] info [cpaneld] 76.35.183.26 - neotechl "GET /login/?login_only=1&user=neotechl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.170.12.48
country_id: 6252001
description:
[2025-12-10 11:17:04 +0530] info [cpaneld] 24.170.12.48 - neot "GET /login/?login_only=1&user=neot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.125.1
country_id: 6252001
description:
[2025-12-10 11:16:58 +0530] info [cpaneld] 129.222.125.1 - neotechlkcom "GET /login/?login_only=1&user=neotechlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.224.90.56
country_id: 6252001
description:
[2025-12-10 11:17:02 +0530] info [cpaneld] 98.224.90.56 - neotec "GET /login/?login_only=1&user=neotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotec (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-10 11:17:55 dovecot_plain authenticator failed for (bactotraus) [46.10.210.68]:51263: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.195
country_id: 3469034
description:
Dec 10 11:17:56 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=191.240.96.195, lip=66.85.158.91, TLS, session=<cQPGkJJFJr6/8GDD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-10 11:18:00 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:43970: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-10 11:18:18 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:57025: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.81.150
country_id: 1269750
description:
2025-12-10 11:19:06 dovecot_login authenticator failed for ([103.181.81.150]) [103.181.81.150]:42078: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-10 11:19:24 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:39323: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 10 11:20:39 host2 dovecot[1766329]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<rWuMm5JFerKPbvgo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-10 11:22:55 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.37.42.58
country_id: 6252001
description:
[2025-12-10 11:23:14 +0530] info [cpaneld] 50.37.42.58 - gnetunivers "GET /login/?login_only=1&user=gnetunivers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetunivers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.155.21.137
country_id: 6252001
description:
[2025-12-10 11:23:20 +0530] info [cpaneld] 47.155.21.137 - gnetu "GET /login/?login_only=1&user=gnetu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.164.192.145
country_id: 6252001
description:
[2025-12-10 11:23:19 +0530] info [cpaneld] 47.164.192.145 - gnetun "GET /login/?login_only=1&user=gnetun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.95.74.143
country_id: 6252001
description:
[2025-12-10 11:23:21 +0530] info [cpaneld] 73.95.74.143 - gnet "GET /login/?login_only=1&user=gnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.240.13.34
country_id: 6252001
description:
[2025-12-10 11:23:09 +0530] info [cpaneld] 209.240.13.34 - gnetuniversals "GET /login/?login_only=1&user=gnetuniversals&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.213.21
country_id: 6252001
description:
[2025-12-10 11:23:16 +0530] info [cpaneld] 72.80.213.21 - gnetunive "GET /login/?login_only=1&user=gnetunive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetunive (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.113.111.45
country_id: 6252001
description:
[2025-12-10 11:23:18 +0530] info [cpaneld] 172.113.111.45 - gnetuni "GET /login/?login_only=1&user=gnetuni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.24.48.83
country_id: 6252001
description:
[2025-12-10 11:23:22 +0530] info [cpaneld] 66.24.48.83 - gne "GET /login/?login_only=1&user=gne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.105.103.190
country_id: 6252001
description:
[2025-12-10 11:23:06 +0530] info [cpaneld] 76.105.103.190 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.119.75
country_id: 6252001
description:
[2025-12-10 11:23:08 +0530] info [cpaneld] 135.129.119.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.176.79.24
country_id: 6252001
description:
[2025-12-10 11:23:12 +0530] info [cpaneld] 73.176.79.24 - gnetuniversal "GET /login/?login_only=1&user=gnetuniversal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.184.118.86
country_id: 6252001
description:
[2025-12-10 11:23:11 +0530] info [cpaneld] 75.184.118.86 - gnetuniversalscom "GET /login/?login_only=1&user=gnetuniversalscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversalscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.70.235.228
country_id: 6252001
description:
[2025-12-10 11:23:15 +0530] info [cpaneld] 73.70.235.228 - gnetuniver "GET /login/?login_only=1&user=gnetuniver&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniver (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.56.210.247
country_id: 6252001
description:
[2025-12-10 11:23:23 +0530] info [cpaneld] 142.56.210.247 - gnetuni1 "GET /login/?login_only=1&user=gnetuni1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.215.14.153
country_id: 6252001
description:
[2025-12-10 11:23:25 +0530] info [cpaneld] 74.215.14.153 - gnetuni2 "GET /login/?login_only=1&user=gnetuni2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.41.147.54
country_id: 6252001
description:
[2025-12-10 11:23:36 +0530] info [cpaneld] 158.41.147.54 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.16.113.254
country_id: 6252001
description:
[2025-12-10 11:23:10 +0530] info [whostmgrd] 45.16.113.254 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.212.61.67
country_id: 6252001
description:
[2025-12-10 11:23:13 +0530] info [cpaneld] 67.212.61.67 - gnetuniversa "GET /login/?login_only=1&user=gnetuniversa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.36.96
country_id: 6252001
description:
[2025-12-10 11:23:17 +0530] info [cpaneld] 73.74.36.96 - gnetuniv "GET /login/?login_only=1&user=gnetuniv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.177.54
country_id: 6252001
description:
[2025-12-10 11:23:23 +0530] info [cpaneld] 169.150.177.54 - gn "GET /login/?login_only=1&user=gn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.131.83
country_id: 6252001
description:
[2025-12-10 11:23:38 +0530] info [cpaneld] 76.32.131.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.221.105.97
country_id: 6252001
description:
[2025-12-10 11:23:44 +0530] info [cpaneld] 74.221.105.97 - myproteinb "GET /login/?login_only=1&user=myproteinb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myproteinb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.25.100.74
country_id: 6252001
description:
[2025-12-10 11:23:47 +0530] info [cpaneld] 137.25.100.74 - myprotei "GET /login/?login_only=1&user=myprotei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprotei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.101.166
country_id: 6252001
description:
[2025-12-10 11:23:50 +0530] info [cpaneld] 172.56.101.166 - myprot "GET /login/?login_only=1&user=myprot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.51.43.45
country_id: 6252001
description:
[2025-12-10 11:23:42 +0530] info [cpaneld] 73.51.43.45 - myproteinboxlk "GET /login/?login_only=1&user=myproteinboxlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myproteinboxlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.14.148
country_id: 6252001
description:
[2025-12-10 11:23:46 +0530] info [cpaneld] 35.149.14.148 - myprotein "GET /login/?login_only=1&user=myprotein&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprotein (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.198.39
country_id: 6252001
description:
[2025-12-10 11:23:48 +0530] info [cpaneld] 73.15.198.39 - myprote "GET /login/?login_only=1&user=myprote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.89.88
country_id: 6252001
description:
[2025-12-10 11:23:52 +0530] info [cpaneld] 47.152.89.88 - mypro "GET /login/?login_only=1&user=mypro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mypro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.120.81
country_id: 6252001
description:
[2025-12-10 11:23:54 +0530] info [cpaneld] 73.93.120.81 - myp "GET /login/?login_only=1&user=myp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.58.112
country_id: 6252001
description:
[2025-12-10 11:23:57 +0530] info [cpaneld] 68.224.58.112 - myprote1 "GET /login/?login_only=1&user=myprote1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.227.238
country_id: 6252001
description:
[2025-12-10 11:23:40 +0530] info [cpaneld] 172.59.227.238 - myproteinbox "GET /login/?login_only=1&user=myproteinbox&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.212.224.140
country_id: 6252001
description:
[2025-12-10 11:23:43 +0530] info [cpaneld] 73.212.224.140 - myproteinbo "GET /login/?login_only=1&user=myproteinbo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myproteinbo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.54.29.236
country_id: 6252001
description:
[2025-12-10 11:23:53 +0530] info [cpaneld] 142.54.29.236 - mypr "GET /login/?login_only=1&user=mypr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mypr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.196.64.224
country_id: 6252001
description:
[2025-12-10 11:23:56 +0530] info [cpaneld] 216.196.64.224 - my "GET /login/?login_only=1&user=my&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user my (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.41.241.211
country_id: 6252001
description:
[2025-12-10 11:23:59 +0530] info [cpaneld] 96.41.241.211 - myprote2 "GET /login/?login_only=1&user=myprote2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.25.67
country_id: 1605651
description:
Dec 10 11:24:20 host2 sshd[2091359]: Disconnected from invalid user pp 49.228.25.67 port 47870 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.131.63.232
country_id: 6252001
description:
[2025-12-10 11:23:41 +0530] info [whostmgrd] 65.131.63.232 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.246
country_id: 6252001
description:
2025-12-10 11:24:55 dovecot_login authenticator failed for wsip-184-191-242-246.fv.ks.cox.net [184.191.242.246]:49851: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-10 11:25:08 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:47344: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.50.13.224
country_id: 6252001
description:
[2025-12-10 11:28:29 +0530] info [cpaneld] 76.50.13.224 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.130.123
country_id: 6252001
description:
[2025-12-10 11:28:28 +0530] info [cpaneld] 174.134.130.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.87.48.59
country_id: 6252001
description:
[2025-12-10 11:28:32 +0530] info [cpaneld] 23.87.48.59 - bostonlankacom "GET /login/?login_only=1&user=bostonlankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonlankacom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-10 11:28:19 dovecot_plain authenticator failed for (undiskle) [91.73.195.150]:33835: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.17.12
country_id: 6252001
description:
[2025-12-10 11:28:31 +0530] info [whostmgrd] 76.150.17.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.22.10.43
country_id: 6252001
description:
[2025-12-10 11:28:30 +0530] info [cpaneld] 73.22.10.43 - bostonlanka "GET /login/?login_only=1&user=bostonlanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.51.161
country_id: 6252001
description:
[2025-12-10 11:28:34 +0530] info [cpaneld] 76.32.51.161 - bostonlank "GET /login/?login_only=1&user=bostonlank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonlank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.247.209.173
country_id: 6252001
description:
[2025-12-10 11:28:35 +0530] info [cpaneld] 76.247.209.173 - bostonlan "GET /login/?login_only=1&user=bostonlan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonlan (has_cpuser_file failed)


